www.rivitmedia.comwww.rivitmedia.comwww.rivitmedia.com
  • Home
  • Tech News
    Tech NewsShow More
    Microsoft’s May 2025 Patch Tuesday: Five Actively Exploited Zero-Day Vulnerabilities Addressed
    7 Min Read
    Malicious Go Modules Unleash Disk-Wiping Chaos in Linux Supply Chain Attack
    4 Min Read
    Agentic AI: Transforming Cybersecurity in 2025
    3 Min Read
    Cybersecurity CEO Accused of Planting Malware in Hospital Systems: A Breach of Trust That Shocks the Industry
    6 Min Read
    Cloud Convenience, Criminal Opportunity: How Google Sites Became a Launchpad for Elite Phishing
    6 Min Read
  • Cyber Threats
    • Malware
    • Ransomware
    • Trojans
    • Adware
    • Browser Hijackers
    • Mac Malware
    • Android Threats
    • iPhone Threats
    • Potentially Unwanted Programs (PUPs)
    • Online Scams
  • How-To-Guides
  • Product Reviews
    • Hardware
    • Software
  • IT/Cybersecurity Best Practices
  • FREE SCAN
  • Cybersecurity for Business
Search
  • ABOUT US
  • TERMS AND SERVICES
  • SITEMAP
  • CONTACT US
© 2023 rivitMedia.com. All Rights Reserved.
Reading: Malware News Archive: When Brazil’s four banking trojan families, known collectively as Tetrade, went global
Share
Notification Show More
Font ResizerAa
www.rivitmedia.comwww.rivitmedia.com
Font ResizerAa
  • Online Scams
  • Tech News
  • Cyber Threats
  • Mac Malware
  • Cybersecurity for Business
  • FREE SCAN
Search
  • Home
  • Tech News
  • Cyber Threats
    • Malware
    • Ransomware
    • Trojans
    • Adware
    • Browser Hijackers
    • Mac Malware
    • Android Threats
    • iPhone Threats
    • Potentially Unwanted Programs (PUPs)
    • Online Scams
  • How-To-Guides
  • Product Reviews
    • Hardware
    • Software
  • IT/Cybersecurity Best Practices
    • Cybersecurity for Business
  • FREE SCAN
  • Sitemap
Follow US
  • ABOUT US
  • TERMS AND SERVICES
  • SITEMAP
  • CONTACT US
© 2022 Foxiz News Network. Ruby Design Company. All Rights Reserved.
www.rivitmedia.com > Blog > Cyber Threats > Trojans > Malware News Archive: When Brazil’s four banking trojan families, known collectively as Tetrade, went global
Trojans

Malware News Archive: When Brazil’s four banking trojan families, known collectively as Tetrade, went global

riviTMedia Research
Last updated: October 24, 2023 4:22 pm
riviTMedia Research
Share
Malware News Archive: When Brazil's four banking trojan families, known collectively as Tetrade, went global
SHARE

In 2020, four sophisticated Brazilian malware families sharpened their techniques and actively expanded their geographic reach, targeting users in North America, Europe, and elsewhere in Latin America.

Banking trojans, which steal banking logins and other financial info from unsuspecting victims, are common, but more sophisticated examples were pioneered in Brazil. According to Kaspersky Labs researchers, four major Brazilian banking-trojan families (Guildma, Javali, Melcoz and Grandoreiro, collectively known as Tetrade) went global in 2020.

A report from Kaspersky stated: “In the past, Brazilian criminals primarily targeted customers of local financial institutions. That changed at the beginning of 2011 when a few groups began experimenting with exporting basic trojans abroad. This year, four families known as Tetrade have implemented the necessary innovations to take their distribution worldwide.”

The Guildma hacking group, which has been around since 2015, likes to use phishing emails disguised as legitimate business notifications, according to the report.

“Most of the phishing messages emulate business requests, packages sent over courier services or any other regular corporate subjects, including the COVID-19 pandemic, but always with a corporate appearance.” 

A unique trait of this group is its use of innovative evasion techniques, making its malware difficult to detect. In 2019, Guildma started hiding its malware payload inside the victim’s system using a special format. It also stores its communication with the control server in an encrypted format on Facebook and YouTube pages. Subsequently, communication traffic is next to impossible to detect as malicious.

The Javali malware group, which has been active since 2017, has recently spread to Mexico. Like Guildma, it also spreads through phishing emails with corrupted attachments and has begun using YouTube to host its command-and-control (C2) communications.

The third family, Melcoz, has been active since 2018. Melcoz steals passwords from browsers and the computer’s memory and includes a module for stealing Bitcoin wallets. It replaces the original wallet information with the cybercriminal’s credentials.

The last family, Grandoreiro, has been around since 2016 and has recently been targeting users across Latin America and Europe. Its malware is offered in an as-a-service model, and as a result, it has become the commonly seen of the four families. Their malware is distributed via compromised websites and phishing campaigns. Like Guildma and Javali, it hides its C2 communications on legitimate third-party websites.

You Might Also Like

Cerberus: The Banking Trojan
Ducktail Trojan Horse Malware: The Growing Threat of Trojans
What Is Trojan:BAT/Starter.G!Ink?
Agedown Trojan Horse Malware: A Deep Dive into Trojan Threats
CHAVECLOAK: The Stealthy Banking Trojan Targeting Brazil
TAGGED:Trojans

Sign Up For Daily Newsletter

Be keep up! Get the latest breaking news delivered straight to your inbox.
By signing up, you agree to our Terms of Use and acknowledge the data practices in our Privacy Policy. You may unsubscribe at any time.
Share This Article
Facebook Copy Link Print
Share
Previous Article A Brief History of CryptoJacking
Next Article malware Bazar malware is now being linked to Trickbot banking trojan campaigns
Leave a Comment

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Scan Your System for Free

✅ Free Scan Available 

✅ 13M Scans/Month

✅ Instant Detection

Download SpyHunter

//

Check in Daily for the best technology and Cybersecurity based content on the internet.

Quick Link

  • ABOUT US
  • TERMS AND SERVICES
  • SITEMAP
  • CONTACT US

Sign Up for Our Newsletter

Subscribe to our newsletter to get our newest articles instantly!

www.rivitmedia.comwww.rivitmedia.com
© 2023 • rivitmedia.com All Rights Reserved.
  • ABOUT US
  • TERMS AND SERVICES
  • SITEMAP
  • CONTACT US