Grandoreiro

malware · malware:grandoreiro single-source

Latin American banking trojan family, targeted at financial institutions and their customers, partially disrupted by a January 2024 law-enforcement operation and still active. Acronis documented an August 2026 wave delivered by sideloading a malicious library through a renamed copy of a legitimate file-management utility, gated behind an inverted sandbox check. Distinct from the separately tracked 2026 Iberian campaign record; no cited source links the two waves.

Coverage

1 about it · 1 mention · first 2026-05-29 → last 2026-08-20

Latest activity

2026-08-20

The evasion logic is backwards on purpose: a clean, well-stocked desktop is what makes this malware quit

Peak priority

notable

1 notable

Targets

finance

sectors: finance · regions: latam, europe

Sources cited

4 hosts

Defender insights

What each entry about Grandoreiro tells a defender to do, newest first.

2026-08-20NOTABLEThe evasion logic is backwards on purpose: a clean, well-stocked desktop is what makes this malware quit

Defender takeaway

This is a banking trojan aimed primarily at Latin America (Acronis's telemetry puts the largest share of samples in Mexico, with Spain and several Latin American countries as a secondary cluster and European presence characterised as limited but notable, mostly Spain) and it reports no targets at all in Brazil or Portugal despite the malware's Portuguese-speaking authorship (Acronis TRU, 2026-08-19). For European defenders the transferable content is the tradecraft rather than the targeting: a two-hop sideload that puts the malicious module behind a legitimate intermediate dependency, and an environment gate that reasons about the absence of a too-perfect software set. Both are portable to any family, and the second one quietly degrades the confidence a team can place in a negative sandbox result.

Triage

Story timeline

Every entry that names Grandoreiro, newest first. Rows tagged mention only name it in passing: they are listed for completeness and add nothing to the action items, pivots or ATT&CK profile on this page.

2026-08-20Grandoreiro's loader decides it is in a sandbox when it finds seven ordinary desktop shortcuts, an inverted environment check, behind a two-hop DLL sideload
active-threatsThe evasion logic is backwards on purpose: a clean, well-stocked desktop is what makes this malware quit
2026-05-29WatchGuard documents Grandoreiro's Delphi-DLL-side-loading + WebSocket/STUN C2 against Portuguese & Spanish banks; ESET maps parallel Android BTMOB MaaS
mentionresearch

Hunting pivots

Execution TA0002

T1574.001Hijack Execution Flow: DLL×1

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-08-20/grandoreiro-dll-sideload-inverted-sandbox-check · ATT&CK page ↗

Stealth TA0005

T1036.005Masquerading: Match Legitimate Resource Name or Location×1

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-08-20/grandoreiro-dll-sideload-inverted-sandbox-check · ATT&CK page ↗

T1140Deobfuscate/Decode Files or Information×1

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

Evidence: 2026-08-20/grandoreiro-dll-sideload-inverted-sandbox-check · ATT&CK page ↗

T1497.001Virtualization/Sandbox Evasion: System Checks×1

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Evidence: 2026-08-20/grandoreiro-dll-sideload-inverted-sandbox-check · ATT&CK page ↗

T1564.003Hide Artifacts: Hidden Window×1

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.

Evidence: 2026-08-20/grandoreiro-dll-sideload-inverted-sandbox-check · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×1

Evidence: 2026-08-20/grandoreiro-dll-sideload-inverted-sandbox-check · ATT&CK page ↗

Discovery TA0007

T1016System Network Configuration Discovery×1

Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp, ipconfig/ifconfig, nbtstat, and route.

Evidence: 2026-08-20/grandoreiro-dll-sideload-inverted-sandbox-check · ATT&CK page ↗

T1057Process Discovery×1

Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-08-20/grandoreiro-dll-sideload-inverted-sandbox-check · ATT&CK page ↗

T1082System Information Discovery×1

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.

Evidence: 2026-08-20/grandoreiro-dll-sideload-inverted-sandbox-check · ATT&CK page ↗

T1497.001Virtualization/Sandbox Evasion: System Checks×1

Evidence: 2026-08-20/grandoreiro-dll-sideload-inverted-sandbox-check · ATT&CK page ↗

T1614System Location Discovery×1

Adversaries may gather information in an attempt to calculate the geographical location of a victim host. Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-08-20/grandoreiro-dll-sideload-inverted-sandbox-check · ATT&CK page ↗

Command and Control TA0011

T1071.001Application Layer Protocol: Web Protocols×1

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-08-20/grandoreiro-dll-sideload-inverted-sandbox-check · ATT&CK page ↗

Entries about Grandoreiro (1)

2026-08-20 · view entry permalink →

NOTABLENATOB2

Grandoreiro's loader decides it is in a sandbox when it finds seven ordinary desktop shortcuts, an inverted environment check, behind a two-hop DLL sideload

Acronis's Threat Research Unit has published a teardown of a Grandoreiro wave whose loader chain is worth reading even for defenders with no Latin American exposure, because the evasion logic runs opposite to the assumption most sandbox-detection countermeasures are built on. Delivery is an archive carrying a renamed copy of Duplicate Files Finder, a legitimate Windows utility. On execution that binary loads its own genuine dependency, and the genuine dependency in turn attempts to load a further library, and it is that second-hop dependency, carrying the ordinary filename of a MinGW runtime component, which has been replaced with the malicious payload (Acronis TRU, 2026-08-19). The camouflage works because a defender or an endpoint product inspecting loaded modules sees a runtime library name with no obvious reason for suspicion, two hops away from the executable that was actually launched. Acronis notes the compile timestamps disagree (the parent utility carries a 2008 timestamp against the implant's 2026 one) while caveating that PE timestamps are trivially forgeable and are corroboration rather than proof. Because the host utility is a windowed application, the implant's first action is to hide the window it would otherwise show.

The environment gate that follows is staged, and one stage is the interesting one. The loader checks that the machine has been up for at least three minutes, profiles memory, processor count, free disk, screen resolution and recently-opened-document history, looks for virtualization driver files and BIOS registry strings, walks a 49-entry blacklist of debuggers, disassemblers and network-analysis processes, performs an IP-geolocation lookup against a short country blacklist, and compares the username and hostname against known default sandbox identifiers. Sitting inside that sequence is a check that inverts the usual reasoning: the loader looks for desktop shortcuts to seven named mainstream applications (a browser set, a cleanup utility, an FTP client, a PDF reader and a messaging client) and if all seven are present simultaneously, it treats the machine as an analysis environment and stops, on the assessment (Acronis's, at moderate confidence) that this exact software bundle fingerprints a particular automated sandbox image rather than a real user's desktop (Acronis TRU, 2026-08-19). A machine that fails the gate is shown a Spanish-language error dialog instead of the payload. Only a host that passes every stage sees the malware resolve its command-and-control address through a public DNS-over-HTTPS resolver rather than the operating system's own resolver, and fetch its next stage over an HTTP request to TCP port 6432, behaviour Acronis reconstructed from the binary, because the server was offline when it looked.

The hunting value is in the sequence rather than in any single artefact. Acronis's own leads are a renamed copy of that utility loading the runtime-library name from its own directory, and a graphical process that suppresses its own window and then, within moments of launch, queries a public IP-geolocation service and reads the BIOS description keys out of the registry. Triage: the individual actions are all things ordinary software does (installers read hardware information, updaters check geography, plenty of applications ship MinGW runtimes) so no one of them separates malicious from benign. What does is the ordering and the compression: a windowed application that never draws its window, followed inside a few seconds by hardware profiling, a geolocation call and a BIOS registry read, is not doing what the utility whose name it wears is for. The inverted shortcut check is also a warning about analysis tooling itself: a standard, well-stocked analysis image is exactly the fingerprint this family quits on, so a silent non-execution in a sandbox is a result to interpret rather than a clean verdict.

Defender takeaway

In this campaign, the authors use the legitimate Duplicate Files Finder application but rename it to a randomly generated filename to obscure its purpose. When executed, it first loads another legitimate dependency, dupfdll.dll. This DLL then attempts to load its next dependency, mingwm10.dll, which is not legitimate. In this case, it is a malicious replacement version.

Interestingly, the presence of all of these applications is treated as an indicator of an analysis environment rather than a legitimate user system. If shortcuts for all seven applications are present on the desktop, the malware classifies the system as a sandbox environment and terminates execution.

Unfortunately, the server was offline at the time of our analysis, preventing direct interaction with the C2 infrastructure.

Acronis Threat Research Unit 2026-08-19

Builds on: WatchGuard documents Grandoreiro's Delphi-DLL-side-loading + WebSocket/STUN C2 against…

threat20 Aug 04:56Zsingle-sourceOpen finding →

Sources: Acronis Threat Research Unit

explore in graph

Where this entity is cited

Research1
Threats1

Source distribution

acronis.com1 (25%)
thehackernews.com1 (25%)
watchguard.com1 (25%)
welivesecurity.com1 (25%)

All cited sources (4)