Dismantling Grandoreiro: ESET and the fight against the banking Trojan

Company ESET cybersecurity has achieved a significant milestone by helping to take down Grandoreiro, an extremely dangerous banking Trojan. This malware, capable of stealing banking data through keyloggers and screenshots, has affected users in Brazil, Spain, Mexico and Argentina.

ESET's intervention and the identification of those responsible mark progress in the fight against this type of threats.

International collaboration in the fight against Grandoreiro

In a recent statement, ESET revealed that it partnered with the Brazilian Federal Police in a joint operation to dismantle Grandoreiro. This international collaboration was also supported by Interpol, the Spanish National Police and the direct support of Caixabank, which had suffered significant losses due to this malware.

The collaboration between ESET, the Brazilian Federal Police, Interpol, the Spanish National Police and Caixabank has been essential in addressing the threat posed by Grandoreiro. This union of efforts allowed us to combine resources and specialized experiences to confront a sophisticated criminal operation at an international level.

The active participation of government entities, international organizations and private sector companies underlines the importance of collaboration in the fight against cybercrime. Joint work not only made it possible to dismantle this criminal network, but also set a precedent for the prevailing need for continuous cooperation between different actors to protect users and financial institutions from threats as pernicious as Grandoreiro.

This shows clear skill in handling complex situations where international law enforcement agencies share information and intelligence to disrupt cyber criminal activities. This case exemplifies the power behind global synergy to combat increasingly sophisticated and dangerous cybercrimes.

Grandoreiro's modus operandi

Grandoreiro is an extremely dangerous banking Trojan that has caused million-dollar losses to financial institutions, such as Caixabank, which reported losses of USD 120 million. This malware stands out for its ability to be controlled remotely by an attacker, focusing on stealing banking login data through overlays on predefined sites. To achieve this goal, Grandoreiro uses various sophisticated techniques:

Keyloggers and screenshots

The malware uses keyloggers to record all keystrokes and capture passwords and other sensitive information while the user enters their banking credentials. Additionally, it takes screenshots in order to obtain additional information about the user's financial activities.

Fake pop-ups

Grandoreiro uses fake pop-ups that simulate the mouse and keyboard input, allowing the attacker to perform actions on behalf of the user without their knowledge. These pop-ups also send live streams of the user's screen and block local viewing to make it difficult for the user to detect.

Botnet and remote control

Operating as a botnet, Grandoreiro allows attackers to remotely control infected computers. This gives them the ability to actively manipulate the user's banking activities and online interactions.

Identification and arrest

ESET has played a crucial role in providing crucial data that led to the identification and arrest of the individuals controlling the Grandoreiro botnet. The international collaboration between ESET, the Brazilian Federal Police, Interpol, the Spanish National Police and the direct support of Caixabank was essential to dismantle this cybercriminal operation.

The intervention of ESET and the identification of those responsible

ESET played a crucial role in identifying and arresting those responsible behind the Grandoreiro botnet. ESET researcher Jakub Souek coordinated the team in charge of analyzing the operation of the Trojan. He highlighted the importance of the DGA (Domain Generation Algorithm) algorithm used by the malware since October 2020. This algorithm is essential for establishing connections with the command and control servers that operate Grandoreiro.

ESET's active participation not only allowed the collection of crucial data for the identification of the individuals involved in controlling the botnet, but also contributed significantly to its dismantling. The international collaboration between ESET, the Federal Police of Brazil, Interpol and the National Police of Spain was decisive in achieving this important advance in the fight against cybercrime.

Technical capacity and ethical commitment are fundamental aspects that allowed ESET to play a prominent role in this process. The company demonstrated its expertise and leadership by providing crucial information that directly contributed to the identification and arrest of those responsible behind the Grandoreiro Trojan.

In the words of Jakub Souek: “The exhaustive analysis carried out by our team allowed us to fully understand the operational complexities of Grandoreiro, which was essential to carry out concrete actions against this threat.”

ESET's proactive and effective intervention demonstrates its continued commitment to fighting the most dangerous cyber threats, protecting both individual users and financial institutions around the world.

With this we expand relevant information on how ESET contributed significantly to the dismantling of Grandoreiro through its technical capabilities and international collaborations with key law enforcement agencies.

Protecting against Grandoreiro

Grandoreiro poses a significant threat to the financial security of users, which is why it is crucial to take preventive measures. Here are some key recommendations to protect yourself against this banking Trojan:

1. Avoid clicking on suspicious websites and emails

Prevention is the first line of defense against Grandoreiro. It is recommended to avoid clicking on videos coming from suspicious websites, as these may contain malicious links that lead to malware. Likewise, it is important to be cautious with unknown emails, as they could contain infected attachments or links to fraudulent pages.

2. Install and maintain up-to-date security software

It is essential to have updated security software that is capable of detecting and blocking threats like Grandoreiro. Up-to-date antivirus and firewalls are an integral part of cyber defense and can help prevent infection by this type of malware.

3. Promote cybersecurity awareness

Cybersecurity education and awareness are vital to protect against threats like Grandoreiro. Users should be alert and informed about the latest techniques used by cybercriminals to deceive people and steal their financial information.

In the words of [Relevant quote or expert], “The fight against bank fraud continues to evolve, which is why collaboration between cybersecurity companies and law enforcement is crucial to confront threats like Grandoreiro.”

By following these best practices, individuals can significantly reduce the risk of falling victim to the Grandoreiro banking Trojan and contribute to the fight against online banking fraud.

Cybersecurity Triumph: ESET Dismantles Grandoreiro and Highlights the Importance of International Collaboration

With the dismantling of Grandoreiro, ESET has proven to be a key player in the fight against cybercrime, highlighting the importance of international collaboration in cybersecurity. The successful joint operation with the Brazilian Federal Police, Interpol, the Spanish National Police and the support of Caixabank underlines the prevailing need for global synergy to address increasingly sophisticated cyber threats.

Grandoreiro's modus operandi, with its ability to steal banking data through keyloggers, screenshots and fake pop-ups, highlights the complexity of online threats. ESET's proactive intervention, led by Jakub Souek, not only allowed the identification and arrest of those responsible, but also underlined the importance of technical capacity and ethical commitment in cybersecurity.

The collaboration between government entities, international organizations and private sector companies not only led to the dismantling of the criminal network but established a clear precedent on the continued need for cooperation to protect users and financial institutions. Grandoreiro's ability to cause millions in losses highlights the importance of following security practices, such as avoiding clicking on suspicious sites, keeping security software up to date, and promoting cybersecurity awareness.

Ultimately, the takedown of Grandoreiro not only represents a victory in the fight against online banking fraud, but also highlights the importance of collaboration, education and constant innovation in safeguarding the digital world against increasingly sophisticated threats. .