Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula

FortiGuard Labs documents a high-severity campaign distributing the banking Trojan Ousaban against users in Spain and Portugal via phishing PDFs and malicious webpages; the attack chain uses a VBS downloader, steganographic image/ZIP delivery, MSI/EXE payloads, DLL side-loading or process injection for execution, daily-changing DDNS-based C2 hostnames with custom encryption, and persistence mechanisms, and the report includes domains, IPs, and file hashes as IOCs.