Casbaneiro distributes command traffic across multiple servers
A Casbaneiro banking Trojan campaign targeting users in Latin America is using geofenced phishing, staged malware delivery and separate command-and-control servers to make malicious activity harder to detect and analyse, according to security research published this month. FortiGuard Labs said it observed the campaign in August, with activity focused on Argentina, Peru, Colombia and Mexico.…
A recent Casbaneiro banking Trojan campaign, targeting users in Latin America, utilizes geofenced phishing, staged malware delivery, and separate command-and-control servers to evade detection, according to security research. The campaign, observed in August, primarily affected Argentina, Peru, Colombia, and Mexico. Phishing emails and PDF documents, disguised as invoices, legal notices, or court-related communications, were used to trick victims into following embedded links.
The infection process begins when a user clicks a link, leading to a webpage that checks their IP address. If the user is in the targeted region, they receive a webpage containing a Base64-encoded ZIP archive embedded in JavaScript. This archive holds an HTA file that retrieves an XML-based script package, which performs environment checks before proceeding.
The malware downloads three components separately to avoid detection: a legitimate AutoIt interpreter, a compiled AutoIt script, and a compressed file with the final payload. The loader then establishes persistence and injects the payload into the RegSvcs.exe or mobsync.exe process. Casbaneiro gathers email addresses and Outlook data before sending it to attacker-controlled servers.
The malware's control traffic is divided among different servers based on the victim's location and bank association, making it harder for defenders to detect and analyze the malicious activity.
Written by urgent.news from Arabian Post's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
