/
← Voltar ao feed
high finance banking

Casbaneiro banking trojan campaign targets Latin America with analysis evasion and split exfiltration servers

1 fonte(s) · 1 atualização(ões) · publicado 10/09/2026 10:00 · coletado há 4 dias

FortiGuard Labs analyzed a Casbaneiro banking trojan campaign targeting users in Latin America. The campaign applies access restrictions at several stages to keep the malware away from analysis tools: the download page, the HTA downloader and Casbaneiro itself. Casbaneiro sends different types of stolen data to separate servers and uses an endpoint that deliberately returns HTTP 403 responses. It also has a targeted activation mechanism. Only when the victim visits websites of targeted banks in a browser does it send host information to the server and start C2 communication. Together these behaviors make the infrastructure look inactive or inaccessible to automated analysis.

Detalhes técnicos

  • The delivery chain uses a phishing email, a restricted download page and an HTA downloader before the Casbaneiro payload. The article mentions malicious macros in documents.
  • Stolen data is distributed across separate data-receiving servers, and a decoy endpoint returns HTTP 403.
  • C2 communication is triggered only when the victim browses to targeted bank sites.
  • The IOCs listed include many SHA-256 hashes, secureserver[.]net hostnames, the dynamic DNS domain x-wolverine[.]servebbs[.]com, and two cryptocurrency wallet addresses (one Ethereum-style, one Bitcoin bech32).

Remediação

  • Keep FortiGuard AntiVirus protections current on FortiGate, FortiMail, FortiClient and FortiEDR, which detect and block the malware.
  • Use FortiMail and FortiSandbox anti-phishing, web filtering, and CDR to disarm malicious macros.
  • Use FortiGuard IP Reputation and Anti-Botnet Security Service to block malicious sources.
  • Run phishing awareness training and simulations, and contact the FortiGuard Incident Response Team if impacted.

Linha do tempo

  1. feeds.fortinet.com ↗ · pub. 10/09/2026 10:00 · coletado 19/10 18:02 primeiro registro

    Casbaneiro banking trojan campaign targets Latin America with analysis evasion and split exfiltration servers

    ler a análise desta fonte

    FortiGuard Labs analyzed a Casbaneiro banking trojan campaign targeting users in Latin America. The campaign applies access restrictions at several stages to keep the malware away from analysis tools: the download page, the HTA downloader and Casbaneiro itself. Casbaneiro sends different types of stolen data to separate servers and uses an endpoint that deliberately returns HTTP 403 responses. It also has a targeted activation mechanism. Only when the victim visits websites of targeted banks in a browser does it send host information to the server and start C2 communication. Together these behaviors make the infrastructure look inactive or inaccessible to automated analysis.

    Technical Details

    • The delivery chain uses a phishing email, a restricted download page and an HTA downloader before the Casbaneiro payload. The article mentions malicious macros in documents.
    • Stolen data is distributed across separate data-receiving servers, and a decoy endpoint returns HTTP 403.
    • C2 communication is triggered only when the victim browses to targeted bank sites.
    • The IOCs listed include many SHA-256 hashes, secureserver[.]net hostnames, the dynamic DNS domain x-wolverine[.]servebbs[.]com, and two cryptocurrency wallet addresses (one Ethereum-style, one Bitcoin bech32).

    Remediation

    • Keep FortiGuard AntiVirus protections current on FortiGate, FortiMail, FortiClient and FortiEDR, which detect and block the malware.
    • Use FortiMail and FortiSandbox anti-phishing, web filtering, and CDR to disarm malicious macros.
    • Use FortiGuard IP Reputation and Anti-Botnet Security Service to block malicious sources.
    • Run phishing awareness training and simulations, and contact the FortiGuard Incident Response Team if impacted.