Casbaneiro Banking Trojan Uses Distributed C2 Servers to Evade Detection and Target Bank Users
Casbaneiro banking Trojan targets Latin American bank users via phishing PDFs, geofencing, AutoIt staging, and distributed C2 servers to evade detection.
FortiGuard Labs detailed a Casbaneiro banking Trojan campaign observed in August 2026 targeting users in Argentina, Peru, Colombia, and Mexico via fake invoice and legal-notice emails. The operation uses geofenced landing pages, an HTA downloader with WMI-based sandbox checks, a legitimate AutoIt interpreter, and process injection into RegSvcs.exe (fallback mobsync.exe). C2 activation is conditional on victims visiting banking websites, enabling keyboard control, clipboard manipulation, and fake overlay windows for bank-focused fraud, while distributed exfiltration servers and unusual HTTP 403-based signaling hinder analyst correlation.
- Targets bank users in Argentina, Peru, Colombia, Mexico via fake invoice and legal-notice phishing emails
- Geofenced landing pages redirect non-targeted regions to benign sites like Google or YouTube
- AutoIt staging injects Casbaneiro payload into RegSvcs.exe or mobsync.exe
- C2 only activates when victim visits a banking website; supports keyboard, clipboard, and file/command execution
- HTTP 403 responses used as expected workflow signal to create infection markers and reduce duplicate traffic
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 209.99.188.28 | secureserver[.]net IP address 72[.]167[.]48[.]63 IP address 209[.]99[.]188[.]28 Note: IP addresses and domains are intentionally defa |
| ipv4 | 72.167.48.63 | 13[.]189[.]202[.]64[.]host[.]secureserver[.]net IP address 72[.]167[.]48[.]63 IP address 209[.]99[.]188[.]28 Note: IP addresses and |
| sha256 | 40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd | 76409f69d445a93910964f8db457bafafb97a011da59e73 PDF SHA-256 40d253480f752805e58c21266e40afe99afc96feea0d355732af5bea459db1dd Email SHA-256 debe871710268e7bb770b72c6772f2e0b8bd40a22b2ea |
| sha256 | 6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73 | o financial websites. IOCs Indicator type Value PDF SHA-256 6bb4372d0d02ec87b76409f69d445a93910964f8db457bafafb97a011da59e73 PDF SHA-256 40d253480f752805e58c21266e40afe99afc96feea0d355 |
| sha256 | debe871710268e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057 | c21266e40afe99afc96feea0d355732af5bea459db1dd Email SHA-256 debe871710268e7bb770b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057 Email SHA-256 eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc6 |
| sha256 | eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc67015af7ca6057244390 | 0b72c6772f2e0b8bd40a22b2eabf4b6556eaba2d71057 Email SHA-256 eaec8c6950f394ad5dcd271aa86f08cb2b8374203ecc67015af7ca6057244390 Domain 128[.]200[.]178[.]68[.]host[.]secureserver[.]net Dom |
From the original article
4 min read at gbhackers.com
A Casbaneiro banking Trojan campaign targeting users across Latin America, using phishing lures, geofenced delivery infrastructure, and distributed command-and-control (C2) servers to obscure malicious activity. The operation, observed in August 2026, primarily targets victims in Argentina, Peru, Colombia, and Mexico through fake invoice and legal-notice emails carrying links to malicious PDF files.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.