Authorities Dismantle Grandoreiro Banking Malware Operation

Group-IB, INTERPOL, and Brazilian and Spanish law enforcement collaborated to analyze and dismantle the Grandoreiro banking trojan operation, using collected malware samples (2020–2022) to track shifting command-and-control infrastructure and identify an active C2 server that enabled arrests of five administrators in January 2024; the trojan used phishing, keystroke logging, screen sharing, simulated clicks and deceptive pop-ups to steal banking credentials and siphon funds through money mule networks, with documented losses around EUR 3.5M and potential larger impact.