Crooks behind Ghimob banking trojan have ambitions far beyond Brazil, researchers say

It's a “full-fledged spy in your pocket.”

Cybercriminals have used a new malicious software kit to target banking customers in Brazil, but harbor ambitions far beyond the Latin American country, security researchers said Monday.

The data that anti-virus company Kaspersky released shows how an enterprising group of crooks has used Brazil to fine-tune their banking trojan, as the financially-focused malware is called. After successfully infecting numerous victims in Brazil, the campaign has expanded to target users in other Portuguese-speaking countries, from Angola to Mozambique to Portugal.

Ghimob, as the newly discovered trojan is known, has a series of features that could make it more effective than previous attempts by Brazilian malware developers to target users abroad, according to the researchers.

It is a “full-fledged spy in your pocket” that siphons off data through a number of means, Kaspersky researcher Fabio Assolini and his colleagues wrote in a blog post. It’s a fraudulent app, hosted outside of the Google Play Store, that once installed allows the attacker to swipe login credentials for a user’s bank. As part of the ruse, the attackers send emails posing as creditors telling recipients to follow a malicious link to learn more. From there, the app is downloaded and the theft begins.

The crooks have targeted not only banking customers, but also cryptocurrency exchanges and fin-tech companies, the researchers said.

“Latin American cybercriminals’ desire for a mobile-banking trojan with a worldwide reach has a long history,” Assolini said. For example, crooks previously used a different hacking tool that emerged from the Brazilian cybercriminal scene to target customers at several banks in Spain.

Whoever is behind Ghimob could be affiliated with another notorious banking trojan known as Guildma, the researchers said. Guildma has been used in prolific spamming operations, accounting for 10 times as many victims as other Latin American trojans, security experts at anti-virus company ESET said in March.

Cybercrime has long dogged the financial sector in Brazil, South America’s largest economy. A surge in coronavirus cases in Brazil was accompanied by hundreds of malicious COVID-19-related websites looking to rip people off.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure