Threat Intelligence / Actor / Grandoreiro operators

Grandoreiro operators

Nation: Brazil · 1 tracked threat(s) · Categories: MALWARE

Also known as: Grandoreiro gang, Grandes Origens operators, LATAM banking trojan crew

Tracked threats

Grandoreiro Banking Trojan Resurgence (May 2026) — Dual-Vector DLL Side-Loading & VBS Geofenced Campaign with SGC WebSockets/WebRTC C2 Tunneled Through Google Cloud Pub/Sub, Azure MQTT and AWS MQTT Targeting 20+ Portuguese Banks, Spain, Mexico and LATAM — HIGH

Full actor intelligence — infrastructure, IOCs, detection coverage and operator fingerprints — is available via the Threadlinqs MCP server (Purple tier). View plans →

Threadlinqs Intelligence