The Grandoreiro banking trojan has re-emerged in a new campaign primarily targeting users in Latin America, with Mexico accounting for the largest share of detected activity. This resurgence follows a law enforcement operation in January 2024 that disrupted portions of the malware's infrastructure.
Researchers from Acronis’ Threat Research Unit (TRU) observed the renewed campaign beginning in May 2026. Telemetry data from June 2026 indicated that Mexico was the source of 40% of detected samples, followed by Spain at 17%, Peru at 13%, and Argentina at 10%. While activity remains concentrated in Latin America, smaller clusters of detections were also noted in Europe and North America.
The latest campaign leverages DLL sideloading to execute the Grandoreiro trojan. Attackers are abusing the legitimate "Duplicate Files Finder" application, renaming it and placing a malicious `mingwm10.dll` file alongside its genuine dependencies. This technique causes the trusted executable to load the malicious library, facilitating the malware's execution.
Before attempting to connect to its command-and-control (C2) infrastructure, the initial loader incorporates extensive anti-analysis checks. These checks scan for virtualization and sandbox environments, security tools, system characteristics, and specific user and machine configurations. The malware also verifies the victim's public IP address and geolocation, with traffic from certain countries being blacklisted.
While the precise initial delivery vector could not be definitively confirmed by researchers, an invoice-like ZIP filename and Grandoreiro's historical distribution patterns led to a moderate confidence assessment that spam was involved. The malware employs encrypted strings to further complicate analysis.
During the researchers' analysis, the C2 server was offline. However, static examination of the malware indicated that the loader was designed to retrieve a second-stage payload once communication with the C2 server was established.
Despite the 2024 infrastructure disruption, overall Grandoreiro activity, though below its previous peak, continues to evolve. This indicates that the operation behind the banking trojan remains active and is adapting its tactics.
