Loading story…
Proofpoint reported that the Kronos banking Trojan resurfaced in multiple campaigns after a period of inactivity, with operations aimed at users in Germany, Japan, and Poland and a fourth campaign that appeared to still be in testing. The malware preserved core banking-Trojan capabilities including man-in-the-browser webinjects, keylogging, hidden VNC, and Zeus-formatted injects, while shifting command-and-control traffic to Tor .onion services. Researchers observed targeting of five German financial institutions and thirteen Japanese financial institutions, while the Polish sample had no active webinjects during analysis.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
On July 13, 2018, researchers observed a Japan-focused campaign in which a malvertising chain redirected victims to the RIG exploit kit. RIG delivered SmokeLoader, which then installed the new Kronos variant targeting thirteen Japanese financial institutions.
On July 15 and July 16, 2018, attackers used fake invoice lures in a Poland-focused email campaign to distribute a malicious Word document. The document exploited CVE-2017-11882 to download and execute the new Kronos variant.
From June 27 to June 30, 2018, attackers ran a Germany-focused email campaign using macro-enabled Word documents themed as messages from German financial companies. The campaign delivered the new Kronos variant, in some cases via SmokeLoader, and targeted five German financial institutions with webinjects.
A new Kronos variant appeared in the wild in April 2018. The variant retained core Kronos functionality while introducing Tor .onion command-and-control infrastructure.
The Kronos banking Trojan was first discovered in 2014. It was identified as a banking malware family with credential theft and fraud-enabling capabilities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 36 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Gozi/Ursnif/ISFB** banking trojan remained an active cybercrime threat across Europe and Japan, spreading mainly through targeted malspam and phishing emails carrying weaponized Word, XLS, ZIP, JavaScript, HTA, and macro-enabled attachments. Multiple campaigns used staged infection chains involving VBA macros, PowerShell, `rundll32`, HTA downloaders, and side-loaded DLLs, with distribution tied in some cases to the **Dark Cloud** botnet and other spam infrastructure. Researchers also observed related delivery through Shiotob downloaders and compromised web servers, with operators rotating domains, IPs, and lure content to reduce detection while targeting both retail and corporate banking users.
Aug 15, 2026
Proofpoint reported a renewed **Retefe** banking Trojan campaign targeting online banking users in Switzerland, Germany, and Liechtenstein, with operators shifting tactics to improve stealth and credential theft. Rather than relying mainly on web injects, Retefe redirected victim banking traffic through a proxy, and in one observed Switzerland-focused campaign an **OLE-based lure document** delivered **Smoke Loader**, which then fetched the banking malware. Researchers also noted infrastructure and tooling changes, including the replacement of **Tor** with **stunnel** for encrypted tunneling and the use of a shareware application, **Convert PDF to Word Plus 1.0**, in the infection chain. The campaign also expanded its reach to **macOS** users by distributing fake Adobe installer applications signed with a developer certificate, a technique designed to help the malware pass Apple **Gatekeeper** checks and appear trustworthy when opened on a Mac. The activity showed that Retefe operators were actively refining cross-platform delivery, downloader selection, and trust-abuse methods to sustain banking credential theft against regional financial institutions and their customers.
Aug 14, 2026
ESET reported that the **DanaBot** banking Trojan broadened its operations from earlier campaigns in Australia and Poland to additional targets in **Italy, Germany, Austria, and Ukraine**. The largest activity remained focused on Poland, where attackers used invoice-themed spam emails to deliver the malware through the **Brushaloader** infection chain, combining **PowerShell** and **VBS** scripts to compromise victims. Researchers said DanaBot’s operators also continued to enhance the malware’s modular capabilities, adding **TOR-based C2 list updates**, a new **64-bit stealer** plug-in, and an **RDP** plug-in based on **RDPWrap** to strengthen remote access and reconnaissance. The malware was observed targeting **banking portals, webmail services, cryptocurrency wallets, and corporate banking and remote access software**, with the Ukrainian campaign showing particular interest in enterprise financial and remote administration tools.
Jun 29, 2026