GrandoreiroMalware
According to ESET Research, Grandoreiro is a Latin American banking trojan targeting Brazil, Mexico, Spain and Peru. As such, it shows unusual effort by its authors to evade detection and emulation, and progress towards a modular architecture.From MISP Galaxy
Last reported 23 days ago, by ESET WeLiveSecurity (ES)5 reports
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1027.016Junk Code Insertion
“Every served payload differs in variable names, function names, .NET type-name fragmentation, junk-code insertions, XOR keys, and AES-encrypted code blobs, making file-hash detection essentially impossible at population scale (Figure 5).”
- T1053.005Scheduled Task
“The script established persistence by invoking PS_ScheduledTask.ExecMethod(RegisterByUser), which registered a hidden scheduled task configured to execute powershell.exe with -WindowStyle Hidden, -ExecutionPolicy Bypass, and an encoded PowerShell command.”
- T1055Process Injection
“…or remote access trojan (RAT) that splits its capabilities across multiple Add-Type calls to build up a complex functionality like process injection, credential access, and C&C communication modules.”
- T1056.001Keylogging
“Once active, it enables operator-driven fraud through remote input control, keylogging, screen streaming, and Pix QR code interception targeting Brazilian financial institutions.”
- T1204.005Malicious Library
“… the application and placed a malicious mingwm10.dll alongside legitimate dependencies, causing the trusted executable to load the malicious library.”
- T1213.003Code Repositories
“The leak included databases for Geedge's Jira and Confluence portals, but also all its Git source code repositories, containing commit history going back to November 2024.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Panorama de ciberamenazas en América Latina: balance del primer semestre de 2026“Cepas tradicionales especializadas: Grandoreiro encabezó la actividad regional de troyanos bancarios especializados.”
-
Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall“Grandoreiro goes to Mexico: After surviving a law enforcement takedown in 2024, the Grandoreiro banking malware has now been spotted being used to target Mexican banks.”
-
Panorama de amenazas digitales en México: qué cambió en el primer semestre de 2026“…as transaccionales dirigidas: Se identificó la actividad constante de troyanos bancarios regionales especializados, incluyendo Grandoreiro (0,25% nacional), Casbaneiro y Mispadu, configurados para interactuar con sistemas de transferencias interbancarias y plataformas de b…”
-
Grandoreiro Resurfaces in Mexico With New DLL Sideloading Campaign“Grandoreiro Resurfaces in Mexico With New DLL Sideloading Campaign”
-
Inside SHADOW-WATER-063’s Banana RAT: From Build Server to Banking Fraud“Behaviorally, the operator appears to overlap with the broader Tetrade banking-trojan ecosystem (Grandoreiro, Mekotio, Casbaneiro, Guildma, CHAVECLOAK), though architectural differences suggest it may sit adjacent to rather than within that family.”
Indicators in its reports
named in the reports above- 162.141.111[.]227in 1 report
- hxxps://convitemundial2026[.]com/Consultar_NF-e.batin 1 report
- convitemundial2026[.]comin 1 report
- hxxp://24.199.90[.]58/payload.phpin 1 report
- 24.199.90[.]58in 1 report
- windowsk-cdn[.]comin 1 report
- c.windowsk-cdn[.]comin 1 report
- cdn[.]comin 1 report
- ecdc8fade561a75d…e90ecab1c47fin 1 report
- 38dfeb772afbd01c…23ad06e39d8fin 1 report
- 4912b1134e69ade7…44c6dfcf2ff1in 1 report
- d7545b6dacebdae2…9ba56a70cdaain 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.