Kaspersky helped an INTERPOL-coordinated effort leading to the arrest of five Grandoreiro banking trojan operation administrators in Brazil. The trojan operators are believed to have defrauded victims of over 3.5 million euros (more than PHP214 million)
Grandoreiro is a banking trojan from Brazil that tracks keyboard inputs, simulates mouse activity, and collects bank identifiers. Criminals use it to access victims’ bank accounts and empty them, sending funds through a money mule network to launder the proceeds. Kaspersky data showed that the organization has been active since at least 2016.
Seen more as a Malware-as-a-Service (MaaS) project, Grandoreiro has many versions, indicating the involvement of multiple operators in its development.
Kaspersky and INTERPOL analyzed Grandoreiro malware samples collected by Brazilian and Spanish cybercrime investigations. Kaspersky detected 150,000 attacks with the Grandoreiro banking trojan on 40,000 users across six countries: Brazil, Spain, Mexico, Portugal, Argentina, and the USA. Analytical reports from August 2023 identified sample overlaps, helping investigators identify the organized crime group.
“In these circumstances, it is extremely important for financial institutions to stay vigilant while also improving their anti-fraud technologies and threat intelligence data. Greater synergy between private and public partners is also pivotal for combating against such cybercrimes and ensuring a safer environment for users and organizations worldwide,” commented Fabio Assolini, head of the Latin American Global Research and Analysis Team (GReAT) at Kaspersky.
Kaspersky predicts that mobile banking trojans like Grandoreiro will be increasingly exploited as trojan families expand abroad. Brazilian banking trojans may fill the void left by desktop banking trojans, which could become one of the trends dominating the financial threat landscape in 2024.
Leave a comment