Loading story…
Research presented at PHDays detailed how banking malware undermined smartcard-based protections in remote banking systems by attacking the infected endpoint rather than the card itself. ESET highlighted Win32/Spy.Ranbyus, which can detect connected smartcard devices and relay attacker-issued APDU commands through its command-and-control channel, allowing remote manipulation of the card from an already compromised machine.
The report also described RDPdoor v4.2.x, linked to the Carberp cybercrime group, which profiles smartcard devices and can enable remote smartcard access for fraud operations. The findings showed that smartcards can be effectively bypassed when malware operates at the SmartCard API layer on a victim system, and ESET noted related infection activity spread through blackhat SEO poisoning and Nuclear Pack exploits tied to Russian Google search results for Eurovision-themed queries.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
Aleksandr Matrosov and Eugene Rodionov presented “Smartcard vulnerabilities in modern banking malware” at the PHDays 2012 conference in Russia. Their research detailed how banking malware such as Win32/Spy.Ranbyus and RDPdoor abused smartcards through the SmartCard API layer.
Researchers observed blackhat SEO poisoning in Russian Google search results for Eurovision 2012 queries. Victims were redirected to a fake Eurovision site and then potentially to the Nuclear Pack exploit service.
At the beginning of 2012, the Carberp cybercrime group was observed using RDPdoor v4.2.x. The malware profiled infected systems and smartcard devices used in Russian remote banking systems so operators could later deploy additional modules.
A 2010 blog post titled “Dr. Zeus: the Bot in the Hat” previously described malware that manipulated APDU commands and used hidden remote channels to control a smartcard device. The 2012 article cites this as prior documentation of the technique.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kaspersky reported that the ATM malware **Skimer** continued to evolve years after its first appearance, with incident responders identifying a newer variant that gave attackers direct control over cash machines. The malware used the **Themida** packer, installed itself differently on **FAT32** and **NTFS** systems, patched the XFS service executable `SpiService.exe`, and loaded a malicious library, `netmgr.dll`, to obtain full access to ATM **XFS** functions. The malware remained dormant until an attacker inserted a specially crafted **magic card** containing hardcoded Track 2 data, then authenticated through PIN-pad command codes to trigger actions including cash dispensing, card-data collection and printing, PIN-related input logging, self-deletion, debugging, and malware updates from a card. Kaspersky said it identified **49 Skimer modifications**, including **37** aimed at ATMs from a single manufacturer, and urged banks to hunt for the hardcoded Track 2 values while strengthening controls such as application allowlisting, BIOS protection, disk encryption, and network isolation.
Aug 15, 2026
**Win32/Spy.Ranbyus** targeted remote banking and payment software in Ukraine and Russia, with a particular focus on BIFIT’s **iBank 2** platform used in Ukraine. The malware was designed to bypass transaction signing and authentication tied to smartcard devices, enabling attackers to interfere with payment workflows inside remote banking environments. Rather than modifying the Java Virtual Machine, the trojan evolved to patch **Java code within specific banking applications**, helping it evade protections while manipulating transactions. Ranbyus also collected host information for command-and-control servers, used form-grabbing techniques to steal payment data, and falsified account balance information to conceal unauthorized transfers, with Ukraine reported as the most heavily affected region.
Aug 14, 2026
New variants of **NFCShare** are targeting mobile banking customers across Europe through phishing sites and GitHub-hosted fake banking app updates that impersonate legitimate banks. Researchers said the campaign, first seen spoofing Deutsche Bank, has expanded to primarily target banking brands in **Italy and Spain**, with victims lured into installing malicious APKs after being told to enable apps from unknown sources or follow fake bank update prompts. Once installed, the malware abuses a phone’s **NFC** capability to trick victims into scanning their payment cards and entering their PINs, then exfiltrates the stolen card data and PINs to attacker-controlled infrastructure over **WebSocket** for potential NFC payment relay fraud. Investigators also reported that newer samples are rebuilt rapidly and use malformed APK packaging, including broken ZIP paths, to disrupt automated analysis and slow detection while preserving recognizable behaviors such as combined **WebView** and NFC activity.
Jul 12, 2026