Grandoreiro Banking Trojan with New TTPs

**Executive Summary:** Zscaler ThreatLabz observed an ongoing Grandoreiro banking trojan campaign (since June 2022) targeting organizations in Mexico and Spain across multiple sectors via Spanish-language spear-phishing; the campaign uses a Delphi-based loader with extensive anti-analysis controls (debugger/VM checks, process/window checks, Captcha), downloads a heavily padded ~400MB final payload, employs DGA and LatentBot-like C2 communications (ACTION=HELLO), and supports keylogging, web-injects, command execution and persistence. The report provides detailed infection chain analysis and numerous IOCs (URLs, domains, IPs, MD5s) useful for detection and mitigation.