Years of international cyber forensic work finally paid off this year for INTERPOL and its collaborators in tracking a Malware-as-a-Service syndicate

Recently, INTERPOL announced the arrest of five administrators behind banking trojan operation active across Spanish-speaking countries since 2017.

The Grandoreiro malware has been used to defraud victims and 900 financial institutions of EUR 3.5m in more than 40 countries in North and Latin America, and Europe.

Originating from Brazil, the threat groups behind Grandoreiro uses spear-phishing emails written in Spanish, Portuguese or English to steal data to use for taking over bank accounts, emptying the funds and sending the monies through a money mule network to launder the illicit proceeds.

As multiple versions of the trojan have been found, more than one organization is probably are involved in the development of Grandoreiro as a Malware-as-a-Service project.

According to Craig Jones, Director of the Cybercrime Unit, INTERPOL, the arrest of some members of the banking trojan operation “vividly underscores the importance of sharing intelligence through INTERPOL, and why we are committed to acting as a bridge between public and private sectors. It also sets the stage for further cooperation in the region.” 

Jones was referring to the collaborations of Brazilian and Spanish national cybercrime investigation teams, along with INTERPOL’s other private partners, in analyzing Grandoreiro malware samples gathered between 2020 and 2022. As a result, by August 2023, analytical reports had exploited clues in the overlaps between the samples that allowed investigators to close in on the organized crime group.

Commented Fabio Assolini, Head, Global Research and Analysis Team (Latin America), Kaspersky, one of the participating partners of the multi-year international cyber forensics effort: “Over time, the attackers regularly improve techniques, striving to stay undetected and active longer. In these circumstances, it is extremely important for financial institutions to stay vigilant while also improving their anti-fraud technologies and threat intelligence data. Greater synergy between private and public partners is also pivotal for combatting against such cybercrimes and ensuring a safer environment for users and organizations worldwide.”