Grandoreiro and BTMOB Malware Campaigns Target Financial Institutions in Europe and Latin America
Recent cybersecurity reports reveal that two distinct banking trojan campaigns, Grandoreiro and BTMOB, are actively targeting financial institutions in Europe and Latin America. These campaigns specifically aim to compromise Windows and Android devices, posing significant threats to both corporate and individual users in regions such as Spain, Portugal, Mexico, and Brazil.
Overview of the Threat Landscape
According to findings from cybersecurity firms WatchGuard and ESET, the Grandoreiro malware campaign employs sophisticated techniques to infiltrate banking systems in Portugal. The malware utilizes DLL side-loading, a method that exploits vulnerabilities in legitimate software to execute malicious code. This campaign has been operational since 2016 and has evolved to target thousands of financial institutions across 45 countries.
Phishing emails remain the primary distribution method for Grandoreiro, often leading recipients to click on dubious links that initiate the malware installation process. Despite law enforcement efforts in Brazil to dismantle its infrastructure, Grandoreiro has continued to adapt, expanding its targeting capabilities and integrating CAPTCHA checks to evade detection.
Technical Insights into Grandoreiro
The latest iteration of the Grandoreiro campaign has been identified as leveraging DLL side-loading to execute DLLs developed in Delphi 11, a programming language frequently associated with malware targeting this region. Notably, two DLLs—mingwm10.dll and libwebp.dll—incorporate sgcWebSockets, a library that facilitates real-time communication and peer-to-peer interactions.
WatchGuard researchers explain that these DLLs utilize the Session Traversal Utilities for NAT (STUN) protocol, which assists devices behind a NAT in discovering their public IP addresses. This capability enables the malware to maintain communication channels that are difficult to monitor, particularly by blending in with legitimate web conferencing traffic.
In addition to these DLLs, the campaign also employs libffi-6.dll and libpng15.dll, which utilize the Interactive Connectivity Establishment (ICE) protocol. These files specifically target banks and financial institutions in Portugal, including Abanca, Banco de Portugal, BBVA PT, Caixa Geral de Depósitos, and Santander, as well as international services like Revolut and Wise.
BTMOB: A New Threat on Android Devices
Simultaneously, ESET has reported on BTMOB, an Android remote access trojan (RAT) that emerged in February 2025. This malware is capable of unlocking devices, capturing screenshots, logging keystrokes, and automating credential theft through HTML injections when specific applications are opened. A more recent version has added functionality to capture Alipay PINs, further expanding its capabilities.
The BTMOB RAT is marketed with an APK builder interface, allowing users to generate new payloads and customize phishing lures without any coding knowledge. This ease of use significantly lowers the barrier to entry for less sophisticated threat actors, enabling rapid deployment of malicious campaigns.
BTMOB primarily spreads through social engineering tactics, directing users to counterfeit websites that mimic legitimate streaming services or cryptocurrency platforms. Victims are then misled into downloading an APK file that contains the malware. Once installed, BTMOB requests permissions to utilize Android’s accessibility services, thereby gaining additional system access without user intervention.
The Evolution of Malware-as-a-Service
The BTMOB malware operates under a malware-as-a-service (MaaS) model, which has implications for the broader cybersecurity landscape. This model allows even novice cybercriminals to launch sophisticated attacks with minimal technical expertise. Reports indicate that leaked versions of BTMOB are circulating on underground forums, increasing the risk of abuse by aspiring criminals.
ESET emphasizes that access to such tools rarely remains confined. The potential for secondary markets to emerge through resale or sharing within closed communities poses a significant risk to cybersecurity. Competing malware families may also adopt elements from BTMOB, making it easier for less skilled criminals to customize payloads and manage campaigns effectively.
Implications for Financial Institutions
The ongoing evolution of Grandoreiro and BTMOB highlights the increasing sophistication of banking malware. Financial institutions must remain vigilant, as these campaigns demonstrate a trend toward the reuse of legitimate services and the integration of advanced evasion techniques.
WatchGuard notes that the combination of phishing, DLL side-loading, and anti-analysis measures makes these malware campaigns increasingly difficult to detect with traditional defenses. The adaptability of financially motivated threat groups underscores the necessity for enhanced security measures and continuous monitoring to safeguard sensitive data.
As cyber threats continue to evolve, the need for robust cybersecurity protocols becomes more critical. Organizations must prioritize employee training on phishing awareness and invest in advanced threat detection systems to mitigate the risks posed by these sophisticated malware campaigns.
For further insights into the Grandoreiro and BTMOB malware campaigns, visit thehackernews.com.
Keep reading for the latest cybersecurity developments, threat intelligence and breaking updates from across the Middle East.
