#ESETresearch joins Europol’s Cyber Intelligence Extension Programme (CIEP) 🤝 We are proud to announce ESET’s participation in the pilot phase of CIEP, a new initiative launched by Europol 's European Cybercrime Centre (EC3).
The program aims to strengthen public-private cooperation in the fight against cybercrime by enabling real-time collaboration and intelligence sharing. ESET Chief Research Officer Roman Kovac & Senior Malware Researcher Jakub Soucek, spent several days at Europol’s HQ.
ESET has already cooperated in EC3's Advisory Group, where we are represented by ESET Senior Research Fellow Righard Zwienenberg. ESET has also contributed to successful law enforcement operations: #Gamarue, #RedLine, #Grandoreiro, #LummaStealer #Danabot.
The new CIEP initiative elevates this collaboration further, creating opportunities for direct, real-time engagement with Europol’s operational teams. Partnerships like this one are crucial in mitigating risks within today's rapidly evolving cyber threat landscape.
Cyber threats evolve rapidly, but through these partnerships, so does our collective defense. Together we can make Europe a safer place. 🤝
Crooks are reviving the Grandoreiro banking trojan

Grandoreiro Banking Trojan resurfaces, targeting users in Latin America and Europe in new phishing campaigns.

Security Affairs

🚨 #Grandoreiro attacks LATAM
⚠️ A phishing campaign is actively targeting Latin American countries, leveraging #geofencing to filter victims. Behind it is Grandoreiro—the most persistent banking #trojan in #LATAM.
It effectively bypasses many automated security solutions, making detection and response especially challenging but not for #ANYRUN users 🚀

👨‍💻 Full execution chain: https://app.any.run/tasks/02ea5d54-4060-4d51-9466-17983fc9f79e/?utm_source=mastodon&utm_medium=post&utm_campaign=grandoreiro&utm_term=270325&utm_content=linktoservice
👾 Malware analysis: https://app.any.run/tasks/97141015-f97f-4ff0-b779-31307beafd47/?utm_source=mastodon&utm_medium=post&utm_campaign=grandoreiro&utm_term=270325&utm_content=linktoservice

📧 The execution chain begins with a phishing page luring users into downloading a fake PDF—actually an archive delivering Grandoreiro.

🌐 The malware sends the victim’s IP to ip-api to determine geolocation. Based on the result, it selects the appropriate C2 server.

Next, it queries http://dns.google and provides the C&C domain name, which Google resolves to an IP address. This approach helps the #malware avoid DNS-based blocking.

🚨 Finally, the malware sends a GET request to obtain the resolved IP.

Activity spiked between February 19 and March 14, and the campaign is still ongoing.

📌 The campaign heavily relies on the subdomain contaboserver[.]net.
Use these TI Lookup queries to find more #IOCs, streamline investigations with actionable insights, and improve the efficiency of your organization's security response:
1️⃣ https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=grandoreiro&utm_content=linktoti&utm_term=270325#%7B%22query%22:%22contaboserver%22,%22dateRange%22:180%7D
2️⃣ https://intelligence.any.run/analysis/lookup?utm_source=mastodon&utm_medium=post&utm_campaign=grandoreiro&utm_content=linktoti&utm_term=270325#%7B%2522query%2522:%2522destinationIP:%255C%2522158.247.7.206%255C%2522%2522,%2522dateRange%2522:180%7D%20

Streamline threat analysis for your SOC with #ANYRUN 🚀

#infosec #Cybersecurity

Analysis vmi2511209.contaboserver.net Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

Resumen de las últimas 24 horas en seguridad informática: "CIBERSEGURIDAD EN VUELO: DragonJAR Security Conference 2024 en Bogotá explora ciberseguridad aeroespacial. AT&T paga $370,000 para borrar registros robados. Supermicro expone vulnerabilidad crítica. Mekotio, Grandoreiro y Red Mongoose amenazan bancos en América Latina. Detalles en el próximo listado de noticias."

🗞️ ÚLTIMAS NOTICIAS EN SEGURIDAD INFORMÁTICA 🔒
====| 🔥 LO QUE DEBES SABER HOY 15/07/24 📆 |====

¡Claro que sí! Aquí tienes las noticias optimizadas de las últimas 24 horas en seguridad informática:

"""
🔒 CONFERENCE DRAGONJAR 2024

El DragonJAR Security Conference se llevará a cabo los días 26 y 27 de septiembre de 2024, en Bogotá, Colombia. ¡Descubre la charla "Explorando la ciberseguridad ofensiva en tecnologías aeroespaciales y satélites" de Romel Marin Córdoba! Inscríbete ya para explorar vulnerabilidades y técnicas de mitigación en sistemas aeroespaciales y satelitales. 👉 https://djar.co/WIKf0

🛡️ AT&T PAGÓ A UN HACKER $370,000 PARA BORRAR REGISTROS TELEFÓNICOS ROBADOS

Un investigador de seguridad reveló que la única copia de los registros de llamadas y mensajes de texto de "casi todos" los clientes de AT&T ha sido eliminada, pero aún pueden existir riesgos. No te pierdas este impactante suceso. 👉 https://djar.co/HDS2

🔐 BSIDES LAS VEGAS

BSides Las Vegas es una entidad sin fines de lucro enfocada en impulsar la industria de la seguridad de la información y fomentar la comunidad. Descubre más sobre esta importante organización. 👉 https://djar.co/zwrnKe

🔓 MOTHERBOARDS DE SUPERMICRO VULNERABLES A FALLA RCE CRÍTICA (CVE-2024-36435)

Supermicro Computer, reconocido proveedor de soluciones de servidores y placas base, ha expuesto una vulnerabilidad crítica de seguridad (CVE-2024-36435). Mantente al tanto de este relevante aviso. 👉 https://djar.co/rQKTfm

🚨 MSpy VUELVE A SER VÍCTIMA DE UNA BRECHA DE SEGURIDAD

Además: los routers Velops tienen debilidades con texto sin formato; todo apunta a un patrón oscuro; Internet Explorer resurge y más. Entérate de los detalles aquí. 👉 https://djar.co/ogN1O

🦠 TROYANOS #MEKOTIO, #GRANDOREIRO Y RED MONGOOSE AMENAZAN A BANCOS Y USUARIOS EN AMÉRICA LATINA

¡Precaución en la región! Se reporta actividad maliciosa de los troyanos #Mekotio, #Grandoreiro y Red Mongoose dirigida a bancos y usuarios en América Latina. Infórmate sobre esta amenaza latente. 👉 https://djar.co/O1LA

🌐 CLOUDFLARE BYPASS RESULTA EN RXSS EN MICROSOFT

Har Har Mahadev🔱. El investigador de seguridad Prince Roy, también conocido como royzsec, comparte su hallazgo sobre [Cross Site Scripting] en el dominio de Microsoft al evadir... Descubre más detalles sobre este intrigante descubrimiento. 👉 https://djar.co/LaEM2
"""

DragonJAR Security Conference

Grandoreiro Banking Trojan Resurfaces, Targeting Over 1,500 Banks Worldwide

Grandoreiro banking trojan is back, targeting 1,500+ banks in 60+ countries. It now uses infected Outlook to spread phishing emails.

The Hacker News

Banking #malware #Grandoreiro returns after police disruption

Malware-as-a-service (MaaS) rented by threat actors and reworked to be more evasive and effective.

#phishing methods/lures are diverse, but many entice a target to click on a link which triggers the download of an executable that triggers the Grandoreiro loader.

Remember, if it looks (or sounds) icky, then no clicky! Additionally, always login to your bank account from the official app/domain to check statements, tax documents, or view invoices.

#cybersecurity #security #infosec

https://www.bleepingcomputer.com/news/security/banking-malware-grandoreiro-returns-after-police-disruption/

Banking malware Grandoreiro returns after police disruption

The Android banking trojan "Grandoreiro" is spreading in a large-scale phishing campaign in over 60 countries, targeting customer accounts of roughly 1,500 banks.

BleepingComputer

Le cheval de Troie bancaire #Grandoreiro est de retour, ciblant plus de 1 500 #banques dans plus de 60 pays. Il utilise désormais #Outlook infecté pour diffuser des #emails de #phishing, avec un #algorithme de génération de domaine mis à jour et une capacité d'évasion anti-malware.

#Informatique #Malware #Hacking #CyberSécurité

https://thehackernews.com/2024/05/grandoreiro-banking-trojan-resurfaces.html

Grandoreiro Banking Trojan Resurfaces, Targeting Over 1,500 Banks Worldwide

Grandoreiro banking trojan is back, targeting 1,500+ banks in 60+ countries. It now uses infected Outlook to spread phishing emails.

The Hacker News
Grandoreiro Banking Trojan is back and targets banks worldwide

A new Grandoreiro banking trojan campaign has been ongoing since March 2024, following the disruption by law enforcement in January.

Security Affairs
#Podcast

#IT

#Resumen

#Noticias

#Informatica #Episodio16 #Malware #Grandoreiro
-
📌Update 206: El impacto del malware Grandoreiro
-
📆 22/04/2024
-
🔗 Fuente: Escucha el podcast completo desde su página: https://open.spotify.com/episode/5RsHWU7fq8nchJqdlkU3Md
Update 206: El impacto del malware Grandoreiro

Listen to this episode from IT Masters Update on Spotify. Troyano bancario suma más de 40 mil ataques en México | La Mexdc busca que industria de centros de datos sea declarada de misión crítica | LabHost fue cerrada por Europol | Tenable, líder en inteligencia artificial cibernética de los AI 100 de CRN | Así lo dijo la directora ejecutiva de la Mexdc, Adriana Rivera | Todavía en las nubes está la mega planta de Tesla en Nuevo León | Hoteles Pueblo Bonito es una de las historias innovadoras | Blanca Sámano, directora de Soluciones de tecnología y Productos digitales de la Bolsa Mexicana de Valores, nos da el IT Masters Insight de la semana

Spotify
In 2021, 16 people in Spain were arrested in relation to #Grandoreiro and #Mekotio by the Civil Guard. Based on #ESET telemetry, the arrests hit #Mekotio much harder than #Grandoreiro. https://twitter.com/ESETresearch/status/1415267618450296835
ESET has been closely monitoring #Grandoreiro activity following this disruption operation. So far, our data suggests that the trojan’s activity has received major blow. Time and the follow-up investigation by the police forces should reveal more. 2/2
ESET Research (@ESETresearch) on X

16 people arrested in 🇪🇸 Spain due to connections to #Mekotio and #Grandoreiro, two LATAM banking trojans operating in Europe since 2020. https://t.co/tKOT1IhVJd #ESETresearch @SCrow357 1/5

X (formerly Twitter)