Loading story…
Researchers documented a DanaBot loader campaign that used HTML smuggling to deliver malware through email, embedding a malicious ZIP archive directly inside an HTML attachment rather than downloading it from an external server. In the observed lure, Polish-language text told the recipient that the file could not be previewed and should be downloaded, after which the HTML generated a file named dokumentacja_28380.zip for the victim.
The delivery method relied on a data: URI containing a base64-encoded ZIP archive in the link itself, allowing the payload to be reconstructed locally in the browser and reducing visible network indicators. Separate technical analysis of HTML smuggling explains that the technique abuses standard browser features to assemble and save malicious content on the endpoint, helping attackers bypass some gateway inspection and URL-based defenses.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
G DATA described a DanaBot loader delivery technique in which a phishing email used HTML smuggling to drop a ZIP archive named "dokumentacja_28380.zip." The payload was embedded directly in a base64 data URI within the email's download link rather than fetched from an external URL.
Outflank published a blog post explaining the HTML smuggling technique. The reference provides the publication date but no additional event details in the supplied content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that the **DanaBot** banking trojan was updated with a completely new command-and-control protocol that replaced earlier plaintext traffic with multiple layers of **AES** and **RSA** encryption. The change significantly reduced the visibility of network traffic, broke existing network-based detection signatures, and made packet analysis far more difficult without the corresponding RSA keys, indicating a deliberate effort by the operators to evade defenders and respond to prior public research. Researchers also observed architectural changes in DanaBot’s delivery and persistence mechanisms. A new loader component now maintains persistence as a service and downloads the main module, plugins, and configuration files, while the updated malware was pushed both to existing victims and through malspam campaigns in Poland. Active campaign identifiers showed targeting in **Poland, Italy, and Australia**, alongside limited-functionality test campaigns, underscoring continued development and operational expansion by the threat actors behind DanaBot.
Jun 29, 2026
Researchers reported that **DanaBot**, long tracked as a banking Trojan, expanded its operations with new modules and delivery tactics that turned infected systems into platforms for broader criminal activity. ESET found the malware harvesting email addresses from compromised webmail sessions and, on some Open-Xchange services, sending reply-chain spam with malicious ZIP attachments from victims’ own accounts to spread additional payloads. The campaigns, including activity targeting Italy, showed DanaBot moving beyond credential theft and banking fraud into self-propagating spam operations, while infrastructure and payload patterns also suggested cooperation with other malware operators, including possible links to **GootKit**. Check Point later observed DanaBot campaigns delivering a Delphi-based ransomware strain dubbed **NonRansomware** through its modular command-and-control framework. In one European campaign, a `crypt` module fetched from `95.179.186.57` encrypted files with a `.non` extension, dropped **HowToBackFiles.txt** ransom notes, disabled defenses and recovery mechanisms, and created persistence with a scheduled task. The DanaBot platform itself was described as actively maintained, with updated plugins, revised string encryption and filename generation, and newer **AES256/RSA**-based C2 communications, underscoring its evolution from a banking Trojan into a multi-purpose malware service capable of spam distribution, payload delivery, and ransomware deployment.
Aug 14, 2026
Proofpoint researchers identified **DanaBot**, a Delphi-based banking Trojan, in active email campaigns targeting users in Australia. The malware was delivered through malicious Word documents containing macros and ZIP archives with JavaScript downloaders, then installed only on systems geolocated in Australia. Proofpoint attributed the observed distribution activity to **TA547**, linking the operation to malspam campaigns designed to quietly steal financial and other sensitive data rather than disrupt victims with ransomware. DanaBot was described as a modular threat under active development, with capabilities including banking web injects, credential and information theft, **VNC-based remote access**, proxy and network sniffing functions, and monitoring of cryptocurrency wallets. The malware communicated with command-and-control servers over raw TCP on port `443`, using encrypted payloads verified with RSA, and researchers observed multiple versions in the wild along with earlier repository samples, indicating the malware was evolving and may have been used by more than one actor.
Jun 29, 2026