Loading story…
The Cinobi banking trojan was used in a long-running campaign targeting users in Japan, combining phishing emails, fake banking pages, and malvertising to steal credentials from online banking customers. Trend Micro linked the activity to Operation Overtrap and said the attackers used a custom Bottle Exploit Kit against Japanese-language Internet Explorer users, exploiting CVE-2018-15982 and CVE-2018-8174 before deploying Cinobi. The malware used a multi-stage infection chain with locale checks for Japanese systems, RC4-encrypted configuration files, a CMSTPLUA UAC bypass, persistence through a malicious Winsock provider, and later adopted Tor-based command-and-control communications.
Researchers later observed the same malware family evolve beyond browser exploits and traditional banking targets. In a newer malvertising campaign attributed to Water Kappa, victims in Japan were lured to download ZIP files disguised as porn games, reward-point apps, or video-streaming software; the infection chain used legitimate Logitech Capture components for DLL sideloading, with LogiCapture.exe loading a malicious Xjs.dll that decrypted shellcode from format.cfg and launched staged Cinobi payloads. Updated Cinobi configurations targeted 11 Japanese financial institutions, including at least three cryptocurrency trading services, showing that the operators had expanded from online banking theft to credential theft against cryptocurrency exchange users while continuing to restrict access to Japanese IP addresses and reuse related infrastructure.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Trend Micro telemetry cited in the report shows Bottle Exploit Kit was the most active exploit kit detected in Japan in February 2020.
On September 29, 2019, the exploit kit stopped dropping a clean binary and began delivering a newly identified banking trojan named Cinobi to victims.
In mid-September 2019, victims were redirected to the exploit kit after clicking links from social media platforms, showing an active malvertising-driven infection path.
The campaign was first discovered in September 2019 through activity involving a then-unidentified exploit kit used against Japanese users.
Trend Micro telemetry indicates the Operation Overtrap banking malware campaign had been active since at least April 2019, targeting online banking users in Japan through phishing and malvertising.
Researchers observed updated Cinobi configurations targeting 11 Japanese financial institutions, including at least three cryptocurrency trading services, marking an expansion from banking theft to cryptocurrency account credential theft.
Trend Micro reported a new campaign attributed to Water Kappa that delivered Cinobi through malicious ads and ZIP archives, moving beyond the earlier Internet Explorer-focused Bottle exploit kit approach.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 42 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed renewed analysis of **Tinba** (also known as **Tiny Banker** or **Zusy**), a compact banking trojan built to steal credentials, browsing data, and financial information through **man-in-the-browser** techniques. The malware injects code into browser and system processes, targets **Internet Explorer, Chrome, Firefox, and Opera**, and uses webinjects and network sniffing to capture login sessions and abuse or bypass some two-factor authentication workflows. Reports also describe Tinba storing stolen data from banking, webmail, and social media sites, while dropping or using components such as `bin.exe`, `cfg.dat`, `web.dat`, and `log.dat` during infection. The malware maintains persistence by copying itself into **`%APPDATA%`** and creating an auto-run registry entry, while using anti-debugging checks including **`IsDebuggerPresent`** to hinder analysis. Investigators said Tinba has been delivered through spam attachments, drive-by downloads, and the **Angler Exploit Kit**, and that it communicates with command-and-control infrastructure through **DGA-generated fast-flux domains** as well as hard-coded servers. Additional reporting linked Tinba infrastructure and traffic patterns to overlaps with **Zeus** and **SpyEye**, with observed indicators including suspected C2 domains, IP addresses, malware hashes, and an RC4-encoded HTTP POST pattern used during bot communications.
Aug 15, 2026
Researchers reported that the **BBTok** banking Trojan has been actively targeting users in **Brazil and Mexico**, impersonating more than 40 banks to steal **2FA tokens**, payment card data, and other banking credentials. The malware campaign uses strong geo-fencing and customized delivery chains that adapt lures to a victim’s country and Windows version, helping operators reduce detection while focusing on regional banking customers. Earlier reporting also documented BBTok activity in Mexico, indicating the malware family has remained active across multiple years. Check Point said the operators rely on layered obfuscation and **living-off-the-land binaries** to deploy payloads, including infection chains that use **LNK files**, a renamed `cmd.exe`, **MSBuild**, SMB-hosted XML, and downloader DLLs such as **Trammy** and **Gammy**. Analysis of older server-side artifacts showed the operation has evolved since at least 2022, with experimentation involving **Follina** and **XLL-based** vectors, while server comments and artifacts suggest with high confidence that the threat actors are Brazilian. The campaign was assessed to have targeted hundreds of users and also supports broader remote-control functions beyond credential theft.
Aug 14, 2026
Researchers and incident responders documented a targeted intrusion campaign by **CryptoMimic**—also tracked as **Dangerous Password**, **CageyChameleon**, and **Leery Turtle**—that focused on banks, financial organizations, and especially cryptocurrency businesses. The attacks used spear-phishing lures that delivered ZIP or RAR archives containing malicious `.lnk` shortcut files and decoy documents; when opened, the shortcuts launched `mshta.exe` to fetch remote HTML or VBScript payloads. JPCERT/CC said the activity hit Japanese organizations tied to cryptocurrency operations, while later analysis captured a full intrusion chain in which the initial script deployed staged implants including **Cabbage RAT** variants, a browser information stealer, **msoRAT**, and a credential theft component that abused Windows Security Packages. Across the reports, the malware showed consistent tradecraft: persistence through Startup-folder shortcuts and registry changes, victim filtering and antivirus checks, host reconnaissance via WMI, and command-and-control through **Bitly** links and spoofed cloud-themed domains such as **cloudfiles.club** and **msupdatepms.xyz**. The operators collected browser cookies, saved passwords, OS and hardware details, process lists, and likely system credentials, then used interactive follow-on access, including legitimate **VNC** tools, for manual post-compromise activity and possible cryptocurrency theft. Investigators also observed cleanup actions such as event log deletion and destructive behavior, and noted that the tooling and operational patterns shared multiple similarities with activity previously linked to **Lazarus**, though attribution remained unconfirmed.
Aug 15, 2026