/
← Voltar ao feed
high

Ousaban banking trojan campaign targets Iberian Peninsula via invoice phishing with geofencing and daily-rotating C2 domains

1 fonte(s) · 1 atualização(ões) · publicado 01/07/2026 10:00 · coletado há 4 dias

FortiGuard Labs reports an ongoing Ousaban campaign targeting the Iberian Peninsula. The actor keeps refining its delivery chain and uses geofencing and environmental checks to restrict access to the malware to the intended victims. Ousaban resolves its C2 IP through daily-changing domains and runs a traditional C2 setup as a decoy. Its long-used encryption algorithm still evades security products.

Detalhes técnicos

  • Delivery starts with phishing emails, apparently invoice-themed given the domain names (faturanova, facture-arsys, controlfacturas). The chain involves a malicious PDF, a VBS downloader and the Ousaban payload.
  • FortiGuard detection names: W32/Ousaban.EY!tr.spy, VBS/Agent.TPX!tr.dldr and PDF/Agent.STG!tr.
  • Infrastructure includes abuse of duckdns.org and pages.dev hosting.
  • The article lists network IOCs (5 domains, 4 IPs) and file hashes for the chain stages.

Remediação

  • Keep FortiGuard AntiVirus protections current on FortiGate, FortiMail, FortiClient and FortiEDR.
  • Use FortiMail and FortiSandbox anti-phishing, web filtering, and FortiGuard CDR to disarm malicious macros.
  • Use FortiGuard IP Reputation and Anti-Botnet services to block the C2 infrastructure.
  • Train users to recognize phishing, for example with Fortinet's free NSE FCF module.
  • Block the listed IOCs.

Linha do tempo

  1. feeds.fortinet.com ↗ · pub. 01/07/2026 10:00 · coletado 19/10 18:02 primeiro registro

    Ousaban banking trojan campaign targets Iberian Peninsula via invoice phishing with geofencing and daily-rotating C2 domains

    ler a análise desta fonte

    FortiGuard Labs reports an ongoing Ousaban campaign targeting the Iberian Peninsula. The actor keeps refining its delivery chain and uses geofencing and environmental checks to restrict access to the malware to the intended victims. Ousaban resolves its C2 IP through daily-changing domains and runs a traditional C2 setup as a decoy. Its long-used encryption algorithm still evades security products.

    Technical Details

    • Delivery starts with phishing emails, apparently invoice-themed given the domain names (faturanova, facture-arsys, controlfacturas). The chain involves a malicious PDF, a VBS downloader and the Ousaban payload.
    • FortiGuard detection names: W32/Ousaban.EY!tr.spy, VBS/Agent.TPX!tr.dldr and PDF/Agent.STG!tr.
    • Infrastructure includes abuse of duckdns.org and pages.dev hosting.
    • The article lists network IOCs (5 domains, 4 IPs) and file hashes for the chain stages.

    Remediation

    • Keep FortiGuard AntiVirus protections current on FortiGate, FortiMail, FortiClient and FortiEDR.
    • Use FortiMail and FortiSandbox anti-phishing, web filtering, and FortiGuard CDR to disarm malicious macros.
    • Use FortiGuard IP Reputation and Anti-Botnet services to block the C2 infrastructure.
    • Train users to recognize phishing, for example with Fortinet's free NSE FCF module.
    • Block the listed IOCs.