Loading story…
Check Point Research reported that the Karius banking Trojan was being distributed through the RIG Exploit Kit while still under active development. The malware was built to carry out browser-based web injects, modify legitimate online banking login pages, steal credentials, and exfiltrate the data to its command-and-control infrastructure.
Researchers said Karius used an injector executable and two DLL modules to establish persistence, weaken some Internet Explorer protections, inject into explorer.exe and supported browsers, and pass stolen information through a named pipe before transmission. The sample appeared immature and likely in testing, with incomplete webinject targets, placeholder strings, and buggy early versions, but its code and behavior showed notable similarities to established banking Trojans including Ramnit, Vawtrak, and TrickBot.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Check Point Research discovered and analyzed a banking Trojan called Karius, finding it was already being distributed via the RIG Exploit Kit and designed to steal banking credentials through browser web injects. The researchers assessed the malware as still under development, with buggy early versions, incomplete webinject targets, and placeholder content.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks' Unit 42 reported increased activity from the **KRBanker** banking trojan, also known as **Blackmoon**, targeting financial institutions in South Korea. The malware was delivered through the **KaiXin exploit kit** and the **NEWSPOT** adware program, using Adobe Flash flaws `CVE-2014-0569` and `CVE-2015-3133` to infect victims. Once executed, KRBanker used **process hollowing** and contacted command-and-control infrastructure after pulling pharming server information from **Qzone** profile nickname fields. Rather than relying on a traditional man-in-the-browser approach, KRBanker manipulated victims through **pharming**, redirecting traffic for selected Korean banks to fraudulent sites while legitimate URLs could still appear in the browser. The malware also abused Windows **Proxy Auto-Config** settings to steer banking traffic, stole digital certificates from the `NPKI` directory, and was capable of terminating **AhnLab V3** security software, increasing the risk of credential theft and fraudulent banking transactions.
Jun 29, 2026
Researchers detailed how the **Gootkit** banking trojan’s first-stage loader establishes persistence, evades analysis, and prepares browser-focused theft operations. The malware, a long-running **Node.js**-based threat associated with banking fraud, uses self-injection, multithreading, and runtime string decryption, then performs extensive sandbox and virtual-machine checks against filenames, environment variables, CPU identifiers, MAC prefixes, loaded modules, usernames, computer names, and BIOS-related registry values. If it detects an analysis environment, Gootkit may delete itself or sleep indefinitely; otherwise, it continues to persistence and payload retrieval. The loader stores encrypted configuration data, recovers command-and-control settings with a simple XOR routine, and can persist either by creating a randomly named Windows service under `%SystemRoot%` or by abusing **IEAK PendingGPOs** so `explorer.exe` launches it without administrator rights. It also acts as an updater, sending host metadata to C2 servers over HTTP, downloading replacement executables, disabling Internet Explorer Protected Mode, and injecting decrypted x86 and x64 DLLs into browser processes via section mapping APIs. Separate reporting on a misconfigured Gootkit C2 server showed operators targeting mainly German and French bank customers with web injects, stolen-data parsers, and fraud-enabling notifications, while Microsoft published hunting guidance linking likely delivery and C2 activity to alerts involving `wscript.exe`, ZIP files, and JavaScript execution.
Aug 15, 2026
Researchers detailed how the **Seamless** drive-by download campaign delivered the **Ramnit** banking trojan after filtering victims by time zone and geolocation, then redirecting selected targets to a **RIG Exploit Kit** landing page. The malware used a custom command-and-control protocol over TCP port `443` that mimicked secure traffic but was **not HTTPS**, with RC4-encrypted data chunks reportedly decodable using a stable key observed in the analyzed environment. The analysis found that Ramnit registered infected hosts by sending two MD5 values to its command server before retrieving region-specific modules and web-inject configurations. Japan-focused infections received localized credit-card-themed web injects, while downloaded components supported antivirus interference, cookie theft, browser injection, and browser communication hooks; U.S.-targeted infections used a similar module set but could also fetch tools such as an FTP grabber and **AZORult**.
Aug 15, 2026