Grandoreiro

Grandoreiro is a malicious software, or malware, specifically a banking Trojan that targets banks worldwide. Initially originating from a Brazilian banking group, Grandoreiro has expanded its reach to other countries, becoming a significant threat in the cyber landscape. It operates by infiltrating systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it steals personal information and disrupts operations. Grandoreiro is part of a larger group of similar banking Trojans, including Mekotio, BBTok, Guildma, Javali, and Melcoz, collectively known as the Tetrade group. Despite efforts to curb its activities, including the arrest of several gang members, Grandoreiro continues to pose a significant threat. It has evolved to target more than 1700 banks in 45 countries across every continent. The most affected countries include Mexico, Brazil, Spain, and Argentina. However, it doesn't necessarily mean that Grandoreiro will target a specific bank from its list; it only acts if there is a local partner or money mule who can operationalize and complete the action. Researchers, including those from Kaspersky, have been studying Grandoreiro to understand its tactics and devise ways to counteract it. They have found that the threat actors behind Grandoreiro continuously evolve their tactics and malware to successfully carry out attacks against their targets and evade security solutions. Kaspersky continues to cooperate with INTERPOL and other agencies around the world to fight the Grandoreiro threat among internet banking users. The Grandoreiro banking trojan is primed to steal credentials accounts for 1,700 financial institutions, indicating its widespread and severe potential impact.