Loading story…
Proofpoint researchers identified DanaBot, a Delphi-based banking Trojan, in active email campaigns targeting users in Australia. The malware was delivered through malicious Word documents containing macros and ZIP archives with JavaScript downloaders, then installed only on systems geolocated in Australia. Proofpoint attributed the observed distribution activity to TA547, linking the operation to malspam campaigns designed to quietly steal financial and other sensitive data rather than disrupt victims with ransomware.
DanaBot was described as a modular threat under active development, with capabilities including banking web injects, credential and information theft, VNC-based remote access, proxy and network sniffing functions, and monitoring of cryptocurrency wallets. The malware communicated with command-and-control servers over raw TCP on port 443, using encrypted payloads verified with RSA, and researchers observed multiple versions in the wild along with earlier repository samples, indicating the malware was evolving and may have been used by more than one actor.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Proofpoint observed email campaigns in May 2018 delivering DanaBot to targets in Australia via malicious Word documents with macros and zipped JavaScript downloaders. The activity was attributed to TA547, and the malware was only downloaded for victims geolocated in Australia.
Proofpoint reported that earlier DanaBot samples were present in malware repositories in April 2018, indicating the banking Trojan was already in circulation before the observed email campaigns.
Proofpoint published research describing DanaBot as a new Delphi-based banking Trojan under active development, detailing its modular capabilities, command-and-control communications, and multiple versions seen in the wild.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
justice.gov
Open sourceproofpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that the **DanaBot** banking Trojan broadened its operations from earlier campaigns in Australia and Poland to additional targets in **Italy, Germany, Austria, and Ukraine**. The largest activity remained focused on Poland, where attackers used invoice-themed spam emails to deliver the malware through the **Brushaloader** infection chain, combining **PowerShell** and **VBS** scripts to compromise victims. Researchers said DanaBot’s operators also continued to enhance the malware’s modular capabilities, adding **TOR-based C2 list updates**, a new **64-bit stealer** plug-in, and an **RDP** plug-in based on **RDPWrap** to strengthen remote access and reconnaissance. The malware was observed targeting **banking portals, webmail services, cryptocurrency wallets, and corporate banking and remote access software**, with the Ukrainian campaign showing particular interest in enterprise financial and remote administration tools.
Jun 29, 2026
Proofpoint reported that **DanaBot**, a Delphi-based banking Trojan and stealer sold through a malware-as-a-service model, re-emerged with a fourth major version after activity dropped in mid-2020. The updated malware kept its modular design, hardcoded command-and-control infrastructure, **TOR** fallback, and a binary TCP protocol protected with **AES-256** and **RSA**, while continuing to support multiple affiliates. Researchers said recent infections were tied to software cracks and warez sites delivering a multi-stage bundle that included a credential stealer, a likely AutoIT cryptocurrency miner, and DanaBot; the stealer collected browser credentials, cookies, screenshots, system details, and potentially cryptocurrency wallet data. Earlier Proofpoint research showed DanaBot had already expanded from Australia into Europe and the United States through large affiliate-driven campaigns, including eFax-themed phishing that used malicious macro documents to install **Hancitor**, then fetch Pony stealer variants and DanaBot. Proofpoint also uncovered what it assessed to be the malware’s affiliate control panel, a graphical client tied to DanaBot through shared infrastructure, protocol overlap, and an embedded RSA public key, indicating a centralized global backend rather than fully separate affiliate infrastructure. The panel exposed extensive operator capabilities, including keylogging, webinjects, screen recording, file operations, screenshots, command execution, and remote access through **VNC** and **RDP**.
Jun 29, 2026
Researchers reported that **DanaBot**, long tracked as a banking Trojan, expanded its operations with new modules and delivery tactics that turned infected systems into platforms for broader criminal activity. ESET found the malware harvesting email addresses from compromised webmail sessions and, on some Open-Xchange services, sending reply-chain spam with malicious ZIP attachments from victims’ own accounts to spread additional payloads. The campaigns, including activity targeting Italy, showed DanaBot moving beyond credential theft and banking fraud into self-propagating spam operations, while infrastructure and payload patterns also suggested cooperation with other malware operators, including possible links to **GootKit**. Check Point later observed DanaBot campaigns delivering a Delphi-based ransomware strain dubbed **NonRansomware** through its modular command-and-control framework. In one European campaign, a `crypt` module fetched from `95.179.186.57` encrypted files with a `.non` extension, dropped **HowToBackFiles.txt** ransom notes, disabled defenses and recovery mechanisms, and created persistence with a scheduled task. The DanaBot platform itself was described as actively maintained, with updated plugins, revised string encryption and filename generation, and newer **AES256/RSA**-based C2 communications, underscoring its evolution from a banking Trojan into a multi-purpose malware service capable of spam distribution, payload delivery, and ransomware deployment.
Aug 14, 2026