{"id":22185,"date":"2024-10-24T10:00:37","date_gmt":"2024-10-24T10:00:37","guid":{"rendered":"https:\/\/techandbiz.com.ng\/tab-backup\/?p=22185"},"modified":"2024-10-24T10:01:25","modified_gmt":"2024-10-24T10:01:25","slug":"kaspersky-uncovers-new-grandoreiro-light-variant-the-threat-also-expands-to-asia-and-africa","status":"publish","type":"post","link":"https:\/\/techandbiz.com.ng\/tab-backup\/2024\/10\/24\/kaspersky-uncovers-new-grandoreiro-light-variant-the-threat-also-expands-to-asia-and-africa\/","title":{"rendered":"Kaspersky uncovers new Grandoreiro light variant, the threat also expands to Asia and Africa"},"content":{"rendered":"

Despite the arrest of important operators in early 2024, Grandoreiro continues to be used by its partners in new campaigns. Kaspersky Global Research and Analysis team (GReAT) (www.Kaspersky.co.za<\/a>) has discovered a new light version focused on Mexico targeting around 30 banks. These findings are to be highlighted at the Security Analyst Summit (SAS) 2024. Remaining one of the most active threats globally and targeting users of more than 1,700 banks, Grandoreiro variants account for around five percent of banking trojan attacks this year.\u00a0 Mexico is one of the most targeted countries by various Grandoreiro strains, including the new light version, seeing 51,000 recorded incidents this year.<\/p>\n

 <\/p>\n

Kaspersky data indicates Grandoreiro has been active since 2016. In 2024, the threat targets more than 1,700 financial institutions and 276 cryptocurrency wallets across 45 countries and territories, lastly adding Asia and Africa to the list of its targets, making it a truly global financial threat. Among countries affected in Africa are Algeria, Angola, Ethiopia, Ghana, Ivory Coast, Kenya, Mozambique, Nigeria, South Africa, Tanzania, Uganda.<\/p>\n

After assisting an INTERPOL-coordinated action, which has led to Brazilian authorities arresting (http:\/\/apo-opa.co\/3BUqgrb<\/a>) operators behind a Grandoreiro banking trojan operation, Kaspersky discovered that the group\u2019s codebase has been split into lighter, fragmented versions of the trojan, to continue its attacks. Recent analysis has identified a specific light version focused primarily on Mexico, which has been used to target approximately 30 financial institutions. The creators likely have access to the source code and are launching new campaigns using the simplified legacy malware.<\/p>\n

\u201cAll the recent developments underscore the evolving nature of the threat. Fragmented and lighter versions may represent a trend that could extend beyond Mexico and into other regions, including beyond Latin America. However, we believe that only some trusted affiliates have access to the malware source code to develop such lighter versions. Grandoreiro operates differently from the traditional \u2018Malware-as-a-Service\u2019 model we are accustomed to. You won\u2019t find announcements on underground forums selling the Grandoreiro package; instead, access to it appears to be limited,\u201d explains Fabio Assolini, head of the Latin American (GReAT) at Kaspersky.<\/p>\n

\n

Grandoreiro has a large and complex structure, which would make it easier for security tools or analysts to detect if its strings were not encrypted<\/p><\/blockquote>\n<\/div>\n

Multiple variants of Grandoreiro, including the new light version and the primary malware, accounted for approximately five percent of global banking trojan attacks detected by Kaspersky in 2024, making it one of the most active threats worldwide. Kaspersky has also analysed the newer samples of the primary Grandoreiro from 2024, and observed new tactics. It records mouse activity to mimic real user patterns, aiming to evade detection by machine learning-based security systems that analyse behaviour. By replaying natural mouse movements, the malware aims to trick anti-fraud tools into seeing the activity as legitimate.<\/p>\n

Additionally, Grandoreiro has adopted a cryptographic technique known as Ciphertext Stealing (CTS), which Kaspersky has never seen being used in malware. In this case, its aim is to encrypt the malicious code strings. \u201cGrandoreiro has a large and complex structure, which would make it easier for security tools or analysts to detect if its strings were not encrypted. This is likely why they introduced this new technique \u2013 to complicate the detection and analysis of their attacks,\u201d Fabio Assolini elaborated.<\/p>\n

To protect from financial malware, Kaspersky security experts recommend organisations to:<\/p>\n