Loading story…
Researchers documented Trojan.Win32/Spy.Ranbyus, a malware family tied to financial theft and online banking fraud, describing capabilities that included process injection, persistence through registry changes, anti-security checks, and theft of files, screenshots, commands, smartcard-related data, and banking credentials. Analysis also linked the malware to Russian banking targets, WebMoney activity, Java modification, and smartcard-enabled bot operations, while showing infrastructure used to push additional malware components and a botnet control panel associated with the campaign.
A separate analysis showed Ranbyus being distributed through phishing emails that falsely warned users their Facebook account had been blocked or closed, luring them into opening a ZIP attachment containing an executable downloader. After launch, the malware displayed a fake reassurance message, installed itself under randomized names, kept two processes watching each other for resilience, and used heavy obfuscation and anti-debugging tricks before generating time-based .net domains through a domain-generation algorithm to fetch and run follow-on payloads from %TEMP%, extending the infection chain beyond the initial lure.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
On 2013-06-18, Avast published an analysis of a phishing campaign using fake Facebook account closure or blocking emails with ZIP attachments carrying a downloader executable. The analysis detailed the malware's obfuscation, dual watchdog processes, domain-generation algorithm, and payload download-and-execute behavior.
On 2013-01-27, XyliBox published reverse-engineering details on Trojan.Win32/Spy.Ranbyus, describing its banking-focused theft capabilities, persistence mechanisms, anti-security checks, and botnet control panel features. The post also linked the malware to a Russian carding group that allegedly called it "triton" and listed payload distribution URLs.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 60 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Win32/Spy.Ranbyus** targeted remote banking and payment software in Ukraine and Russia, with a particular focus on BIFIT’s **iBank 2** platform used in Ukraine. The malware was designed to bypass transaction signing and authentication tied to smartcard devices, enabling attackers to interfere with payment workflows inside remote banking environments. Rather than modifying the Java Virtual Machine, the trojan evolved to patch **Java code within specific banking applications**, helping it evade protections while manipulating transactions. Ranbyus also collected host information for command-and-control servers, used form-grabbing techniques to steal payment data, and falsified account balance information to conceal unauthorized transfers, with Ukraine reported as the most heavily affected region.
Aug 14, 2026
Researchers detailed how the **Seamless** drive-by download campaign delivered the **Ramnit** banking trojan after filtering victims by time zone and geolocation, then redirecting selected targets to a **RIG Exploit Kit** landing page. The malware used a custom command-and-control protocol over TCP port `443` that mimicked secure traffic but was **not HTTPS**, with RC4-encrypted data chunks reportedly decodable using a stable key observed in the analyzed environment. The analysis found that Ramnit registered infected hosts by sending two MD5 values to its command server before retrieving region-specific modules and web-inject configurations. Japan-focused infections received localized credit-card-themed web injects, while downloaded components supported antivirus interference, cookie theft, browser injection, and browser communication hooks; U.S.-targeted infections used a similar module set but could also fetch tools such as an FTP grabber and **AZORult**.
Aug 15, 2026
The **Gozi/Ursnif/ISFB** banking trojan remained an active cybercrime threat across Europe and Japan, spreading mainly through targeted malspam and phishing emails carrying weaponized Word, XLS, ZIP, JavaScript, HTA, and macro-enabled attachments. Multiple campaigns used staged infection chains involving VBA macros, PowerShell, `rundll32`, HTA downloaders, and side-loaded DLLs, with distribution tied in some cases to the **Dark Cloud** botnet and other spam infrastructure. Researchers also observed related delivery through Shiotob downloaders and compromised web servers, with operators rotating domains, IPs, and lure content to reduce detection while targeting both retail and corporate banking users.
Aug 15, 2026