Subj : This wide-ranging trojan has returned from the dead  Grandoreiro
To   : All
From : TechnologyDaily
Date : Mon May 20 2024 16:30:05

This wide-ranging trojan has returned from the dead  Grandoreiro malware 
revives following police action

Date:
Mon, 20 May 2024 15:15:00 +0000

Description:
Two months after "dying", Grandoreiro is back with new bells and whistles.

FULL STORY
======================================================================

Grandoreiro, the banking trojan that was dismantled in January this year, is 
back with a vengeance. This is according to a new report from IBMs 
cybersecurity arm, X-Force, which claims the trojan has been updated, and is 
now targeting a much wider area. 

In late January this year, the Federal Police of Brazil, together with 
Interpol, the Spanish National Police, ESET, and Caixa Bank, dismantled the 
trojan operation, arrested five people, and made 13 search and seizure 
operations across Brazil. 

At the time, it was said that Grandoreiro existed for seven years and 
primarily targeted Spanish-speaking nations. Updates to the malware 

Now, IBMs X-Force said it spotted a new campaign, which started in March this 
year. For now, the goal is simply to deploy the trojan to as many victims as 
possible, and to that end, the attackers use a malware-as-a-service model. 
More than 1,500 banks around the world are targeted, located in 60 countries 
around the world (Central and South America, Africa, Europe, and the 
Indo-Pacific region). 

It is also worth mentioning that the malware actively avoids endpoints in 
countries such as Russia, Czechia, Poland, and the Netherlands, and that it 
doesnt run on Windows 7 devices located in the US, sporting no antivirus 
programs. 

Besides attacking more people, Gradoreiro was also updated. 

"Analysis of the malware revealed major updates within the string decryption 
and domain generating algorithm (DGA), as well as the ability to use 
Microsoft Outlook clients on infected hosts to spread further phishing 
emails," the researchers explained. 

"In order to interact with the local Outlook client, Grandoreiro uses the 
Outlook Security Manager tool, a software used to develop Outlook add-ins," 
the researchers said. "The main reason behind this is that the Outlook Object 
Model Guard triggers security alerts if it detects access on protected 
objects." 

As usual, the best way to defend against these attacks is to be vigilant with 
all incoming email messages. 

 Via The Hacker News More from TechRadar Pro Microsoft wants to take any MFA 
and 2FA worries out of your hands Here's a list of the best firewalls today 
These are the best endpoint protection tools right now



======================================================================
Link to news story:
https://www.techradar.com/pro/security/this-wide-ranging-trojan-has-returned-f
rom-the-dead-grandoreiro-malware-revives-following-police-action


--- Mystic BBS v1.12 A47 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.