LATAM financial cybercrime: Competitors‑in‑crime sharing TTPs

guest · Oct 1, 2020

LATAM financial cybercrime: Competitors‑in‑crime sharing TTPs
ESET researchers discover surprisingly many indicators of close cooperation among Latin American banking trojans’ authors
October 1, 2020
https://www.welivesecurity.com/2020/10/01/latam-financial-cybercrime-competitors-crime-sharing-ttps/

ESET has published a white paper detailing its findings about interconnectivity of Latin American banking trojan families. The white paper was also published by Virus Bulletin.
Click to expand...

For a long time, Latin American banking trojans were looked upon as one group of malware. ESET researchers discovered that is not the case and that, despite having so much in common, multiple distinct malware families can be recognized among these banking trojans.
Over the past year, we have been publishing an ongoing blogpost series about Latin American banking trojan malware families.

So far, we have unmasked Amavaldo, Casbaneiro, Mispadu, Guildma, Grandoreiro and Mekotio in this series. In the pieces to come, we will continue with Krachulka, Lokorrito, Numando, Vadokrist and Zumanek.
Click to expand...

Besides that, we have observed identical distribution chains ending up distributing multiple Latin American banking trojans.
Latin American banking trojans share execution methods as well.

Since we do not believe it to be possible that independent malware authors would come up with so many common ideas and we also don’t believe one group to be responsible for maintaining all these malware families, we conclude that these are multiple threat actors closely cooperating with each other. You can find detailed information about the similarities we briefly introduced here, in the whitepaper.
Click to expand...

White paper: "LATAM financial cybercrime: Competitors‑in‑crime sharing TTPs"
(Virus Bulletin) (PDF - 3.47 MB): https://vblocalhost.com/uploads/VB2020-Soucek-Jirkal.pdf
(ESET) (PDF - 2.80 MB): https://www.welivesecurity.com/wp-content/uploads/2020/09/ESET_LATAM_financial_cybercrime.pdf

guest · Oct 27, 2021

Banking Trojan Targets 100 Organizations in Brazil
October 26, 2021
https://www.technadu.com/banking-trojan-targets-100-organizations-brazil/308783/

A banking trojan from Latin America was found targeting almost 100 Brazilian organizations and individuals.

The malware was first noticed in late August 2021, and its most recent activity was in early October.

A 2020 report showed that there are 11 Trojan gangs identified by ESET in Latin America.

Click to expand...

Symantec’s Threat Hunter has released information of a trojan targeting banking concerns in Latin America. According to the data, almost 100 organizations and individuals have already been targeted. The Cloud Analytics Technology flagged the system’s detected attempts to download a suspicious file named mpr.dll into customer devices.

The download attempt was executed by Msiexec.exe and this led researchers to five files. Out of these, four looked like signed and legitimate DLL files. However, the mpr.dll file had a 588 MB size and looked highly suspicious.
Researchers concluded this was the “Latin American banking Trojan” based on descriptions given at ESET in 2020.
Click to expand...

Based on this insight, researchers discovered the same kind of attack had been perpetrated since late August 2021 on as many as 98 BFSI entities. This trojan was also trying to infiltrate other sectors including information technology, professional services, manufacturing, financial services, and government organizations.
This trojan dll-based attack seems part of a group of 11 banking Trojan gangs based in Latin America. For banking cybersecurity officials, these groups have been covered extensively in 2020’s ESET.
Click to expand...

Symantec: Almost 100 organizations in Brazil targeted with banking Trojan

Log in or Sign up

LATAM financial cybercrime: Competitors‑in‑crime sharing TTPs

guest Guest

guest Guest

Log in or Sign up

LATAM financial cybercrime: Competitors‑in‑crime sharing TTPs

guest Guest

guest Guest

Useful Searches