Loading story…
Zscaler ThreatLabz reported that the Ares banking trojan was updated with a fallback domain generation algorithm (DGA) that closely mirrors the older DGA used by Qakbot. Reverse engineering indicates the logic was likely reimplemented from public knowledge rather than copied directly from Qakbot’s codebase. The added DGA gives Ares a way to recover command-and-control communications if its primary infrastructure is disrupted, while the malware also retains hardcoded infrastructure including tomolina[.]top/panel/connect.php.
The Qakbot DGA that Ares appears to emulate is designed to generate large batches of pseudo-random domains using a date-based seed and CRC-32-derived values, with support for multiple top-level domains including .com, .net, .org, .info, and .biz. Zscaler said the Ares update also modified its API hashing routine using logic derived from the Kronos/Osiris lineage to hinder static detection, and linked current activity to campaigns targeting financial institutions in Mexico, including a hardcoded web inject configuration aimed at BBVA Mexico.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
ThreatLabz reported that none of the example Ares DGA domains generated for August 29, 2022 resolved at the time of publication.
ThreatLabz said newly analyzed Ares samples carrying the updated functionality were compiled on August 15, 2022.
In August 2022, Ares was updated to add a fallback domain generation algorithm for command-and-control when its primary hardcoded infrastructure is unreachable. ThreatLabz assessed the implementation closely mirrors Qakbot's older DGA but was likely reimplemented rather than copied directly from Qakbot code.
Zscaler ThreatLabz reported that the threat actors using the Ares banking trojan were inactive from approximately March 2022 to June 2022.
The reverse-engineering post analyzed a Qakbot.T sample dated December 23, 2015, which unpacked to an executable that decrypted and loaded a Qakbot DLL. Microsoft detected all three analyzed stages as Qakbot.T.
The Qakbot banking trojan had relied on a domain generation algorithm for command-and-control communication since at least September 2013, according to the reverse-engineering analysis.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 607 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented **Qadars** as a banking Trojan focused on web-injection fraud against financial institutions, with the heaviest activity observed in the Netherlands and additional targeting in France, Canada, India, Australia, and Italy. The malware hooked **Firefox** and **Internet Explorer** to perform man-in-the-browser attacks, delivered region-specific webinjects, stored downloaded configurations encrypted in the Windows registry, and later added **FTP credential theft**. Campaigns were linked to **pay-per-install** distribution and later to the **Nuclear Exploit Kit**, while some operations also used **Android/Perkele** malware to intercept SMS transaction codes and bypass two-factor authentication during fraudulent transfers. Later reverse engineering tied a newer sample to a likely **Qadars 3.0.0.0** variant that introduced a **domain generation algorithm (DGA)** for command-and-control discovery, a capability not highlighted in earlier reporting on version 2. The malware was found to generate up to **200 candidate domains** per cycle, resolve them with `gethostbyname`, and retry after a **20-second** sleep if none were reachable. The DGA was described as **time-dependent and deterministic**, seeded by the current week so domains rotated every seven days, producing **12-character** second-level domains across **`.com`**, **`.org`**, and **`.net`** to make infrastructure tracking and takedown more difficult.
Aug 15, 2026
The operator behind the **Osiris** banking trojan announced the malware's retirement after citing falling demand for banking malware, but security researchers report that the threat has not fully disappeared. Osiris, a descendant of **Kronos**, was sold to cybercrime groups and spread through spam campaigns to steal banking credentials, manipulate transactions on infected Windows systems, and exfiltrate data over **Tor**-based command-and-control infrastructure. Researchers also linked Osiris to rootkit features, theft of local application credentials, Outlook contact harvesting, spam-sending capability, TeamViewer deployment, and web injects aimed at **German financial institutions**. At the same time, a newer **Kronos** fork named **Ares** has emerged and appears to be developed by the same actor. Analysis shows Ares is modular and still evolving, with a stealer plugin, scheduled-task persistence, multiple hardcoded C2 URLs, and in-development **VNC** functionality, while custom packers such as **DarkCrypter** and **BMPack** are used to hinder analysis of both Ares and Osiris payloads. The Ares stealer can collect credentials, cookies, payment card data, cryptocurrency wallets, and files from browsers, VPN clients, email clients, and other applications, indicating the malware ecosystem is expanding rather than ending despite the claimed Osiris shutdown.
Aug 14, 2026
The Astaroth banking trojan has resurfaced with a new campaign that leverages GitHub repositories to host its malware configurations, significantly enhancing its resilience against takedown efforts. Security researchers from McAfee and other organizations have observed that, rather than relying solely on traditional command-and-control (C2) servers, the attackers are now using GitHub’s trusted infrastructure to store and distribute configuration files and redirection instructions. This approach allows the threat actors to dynamically update the trojan’s settings and switch to new C2 servers as needed, making it much more difficult for law enforcement and security teams to disrupt the campaign. The attack chain typically begins with phishing emails that lure victims into downloading a ZIP file, which contains a malicious LNK shortcut. When executed, this shortcut launches obfuscated JavaScript via mshta.exe, which then downloads several files, including an AutoIt script, the AutoIt interpreter, an encrypted payload, and an encrypted configuration file. The AutoIt script is responsible for building and executing shellcode in memory, which then loads a Delphi DLL. This DLL decrypts and injects the final Astaroth payload into a new RegSvc.exe process, allowing the malware to operate stealthily on the infected system. Astaroth is known for its fileless operation, anti-analysis techniques, and its ability to avoid US and English locales, focusing its attacks primarily on South American countries such as Brazil, Mexico, Uruguay, Argentina, Paraguay, Chile, Bolivia, Peru, Ecuador, Colombia, Venezuela, and Panama, with some activity also noted in Portugal and Italy. The trojan monitors foreground windows for banking and cryptocurrency sites, and when detected, it hooks the keyboard to steal credentials via keylogging. Stolen data is exfiltrated to the attackers’ infrastructure using the Ngrok reverse proxy, further complicating efforts to trace or block the communications. Persistence is achieved by dropping a LNK file in the startup folder, ensuring the malicious AutoIt script runs on system reboot. Experts warn that the use of GitHub’s high-availability and trusted reputation not only makes takedowns more challenging but also raises concerns about the potential for the campaign to expand beyond its current regional focus. The campaign’s sophistication is further underscored by its use of public repositories for configuration management, allowing for rapid adaptation and continued operation even as individual C2 nodes are neutralized. Security professionals highlight that this method of infrastructure abuse is part of a broader trend, with adversaries increasingly exploiting legitimate cloud and code-hosting platforms to evade detection and maintain operational continuity. The campaign’s reliance on phishing as the initial infection vector underscores the ongoing importance of user awareness and email security controls. The technical complexity of the infection chain, including multiple layers of obfuscation and in-memory execution, demonstrates the evolving tactics of financially motivated cybercriminals. The campaign’s focus on banking credentials and cryptocurrency accounts indicates a clear intent to monetize stolen information. The use of AutoIt scripting and the ability to update configurations on the fly make this variant of Astaroth particularly challenging to defend against. Security experts recommend heightened vigilance, robust endpoint protection, and monitoring for suspicious use of legitimate platforms like GitHub in enterprise environments. The campaign serves as a reminder of the persistent threat posed by banking trojans and the need for adaptive, multi-layered defense strategies.
Jun 29, 2026