Loading story…
Win32/Spy.Ranbyus targeted remote banking and payment software in Ukraine and Russia, with a particular focus on BIFIT’s iBank 2 platform used in Ukraine. The malware was designed to bypass transaction signing and authentication tied to smartcard devices, enabling attackers to interfere with payment workflows inside remote banking environments.
Rather than modifying the Java Virtual Machine, the trojan evolved to patch Java code within specific banking applications, helping it evade protections while manipulating transactions. Ranbyus also collected host information for command-and-control servers, used form-grabbing techniques to steal payment data, and falsified account balance information to conceal unauthorized transfers, with Ukraine reported as the most heavily affected region.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
ESET reported that the Win32/Spy.Ranbyus banking trojan had evolved to modify Java code inside BIFIT's iBank 2 remote banking system in Ukraine, enabling theft from targeted banking and payment software while bypassing smartcard-based signing and authentication.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented **Trojan.Win32/Spy.Ranbyus**, a malware family tied to financial theft and online banking fraud, describing capabilities that included process injection, persistence through registry changes, anti-security checks, and theft of files, screenshots, commands, smartcard-related data, and banking credentials. Analysis also linked the malware to Russian banking targets, WebMoney activity, Java modification, and smartcard-enabled bot operations, while showing infrastructure used to push additional malware components and a botnet control panel associated with the campaign. A separate analysis showed Ranbyus being distributed through phishing emails that falsely warned users their Facebook account had been blocked or closed, luring them into opening a ZIP attachment containing an executable downloader. After launch, the malware displayed a fake reassurance message, installed itself under randomized names, kept two processes watching each other for resilience, and used heavy obfuscation and anti-debugging tricks before generating time-based `.net` domains through a domain-generation algorithm to fetch and run follow-on payloads from `%TEMP%`, extending the infection chain beyond the initial lure.
Aug 15, 2026
Researchers detailed **BackSwap**, a banking trojan linked to the **TinBa** malware family, that targeted online banking users by hiding inside trojanized legitimate Windows applications such as **7-Zip**, **FileZilla**, and **Notepad++**. First observed in 2018, the malware focused on Polish banks and later shifted heavily toward Spanish financial institutions, while also occasionally targeting cryptocurrency wallet users. Its operators used compromised legitimate websites as command-and-control infrastructure and repeatedly changed encryption keys, payload storage, and exfiltration methods to evade detection. BackSwap stood out for avoiding classic browser memory injection and instead manipulating browser sessions through Windows UI monitoring and simulated user actions. It delivered malicious JavaScript into active banking sessions, stole credentials, logged browser window titles and URLs, hijacked clipboard data, and replaced recipient account numbers to redirect transactions to attacker-controlled **IBANs**. Analysts said the malware stored XOR-obfuscated or encrypted web-injects in the `.rsrc` section, sometimes concealed shellcode in **BMP** images, and used position-independent code plus custom Windows API resolution to reduce its forensic footprint and bypass antivirus heuristics.
Aug 15, 2026
Research presented at PHDays detailed how banking malware undermined smartcard-based protections in remote banking systems by attacking the infected endpoint rather than the card itself. ESET highlighted **Win32/Spy.Ranbyus**, which can detect connected smartcard devices and relay attacker-issued `APDU` commands through its command-and-control channel, allowing remote manipulation of the card from an already compromised machine. The report also described **RDPdoor v4.2.x**, linked to the **Carberp** cybercrime group, which profiles smartcard devices and can enable remote smartcard access for fraud operations. The findings showed that smartcards can be effectively bypassed when malware operates at the **SmartCard API** layer on a victim system, and ESET noted related infection activity spread through blackhat SEO poisoning and **Nuclear Pack** exploits tied to Russian Google search results for Eurovision-themed queries.
Aug 14, 2026