DanaBot malware is back to infecting Windows after 6-month break

DanaBot has reappeared (version 669) six months after an international takedown, with a rebuilt C2 infrastructure leveraging Tor (.onion) and backconnect nodes; Zscaler researchers report new IoCs including cryptocurrency addresses. Historically a Delphi-based banking trojan that evolved into a modular infostealer and MaaS, DanaBot targets browser credentials and crypto wallets and has been used in large campaigns; organizations are advised to add the new IoCs to blocklists and update security tools.