Grandoreiro Banking Trojan Resurgence (May 2026) — Dual-Vector DLL Side-Loading & VBS Geofenced Campaign with SGC WebSockets/WebRTC C2 Tunneled Through Google Cloud Pub/Sub, Azure MQTT and AWS MQTT Targeting 20+ Portuguese Banks, Spain, Mexico and LATAM — Threadlinqs Intelligence
As of 2026-05-30, Grandoreiro Banking Trojan Resurgence (May 2026) — Dual-Vector DLL Side-Loading & VBS Geofenced Campaign with SGC WebSockets/WebRTC C2 Tunneled Through Google Cloud Pub/Sub, Azure MQTT and AWS MQTT Targeting 20+ Portuguese Banks, Spain, Mexico and LATAM is a high-severity malware threat attributed to Grandoreiro operators (Brazil), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-0609 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Grandoreiro operators · Brazil · FINANCIAL
Two concurrent Grandoreiro banking-trojan campaigns disclosed by WatchGuard in May 2026 target 20+ Portuguese banks (Caixa Geral de Depositos, Millennium, Novobanco, Santander) plus Revolut and Wise,
OVERVIEW
Grandoreiro is one of the most prolific and long-running banking trojan families in the world, operating continuously since 2016 and originating from Brazilian-speaking cybercrime ecosystems before expanding to target Spanish- and Portuguese-language financial institutions across Europe and the Americas. Despite multiple INTERPOL-coordinated takedowns in Spain, Brazil and Argentina (2021 and 2024) that resulted in numerous arrests, the remaining operators have continued to evolve the malware. In May 2026 WatchGuard Threat Lab telemetry surfaced two concurrent, freshly-tooled Grandoreiro campaigns targeting 20+ Portuguese banks, with secondary impact across Spain, Mexico and Latin America. Both campaigns introduce significant tradecraft refinements compared with prior Grandoreiro generations, most notably the use of SGC (Secure Group Chat) WebSockets and WebRTC components embedded in Delphi 11 binaries to tunnel command-and-control traffic over Google Cloud Pub/Sub, Microsoft Azure MQTT and Amazon MQTT broker infrastructure so that malicious C2 sessions appear to enterprise monitoring as legitimate video-conferencing traffic.
CAMPAIGN 1 — DLL SIDE-LOADING WITH CLOUD-DISGUISED C2
Campaign 1 is delivered through targeted phishing emails containing links that redirect victims to attacker-controlled URLs which in turn pull a ZIP archive from dropbox.com / dropboxusercontent.com. The ZIP contains a legitimate signed binary (FastStone Image Viewer, MinGW gcc, FreeMat, or AbiWord) paired with a malicious DLL whose filename matches a legitimate import expected by the carrier executable: libwebp.dll (FastStone Image Viewer), mingw10.dll (MinGW), libffi-6.dll (FreeMat), and libpng15.dll (AbiWord). When the user double-clicks the legitimate executable, Windows resolves the malicious DLL from the application directory before the legitimate system copy, satisfying the classic DLL side-loading primitive (MITRE T1574.002). Each malicious DLL is built in Delphi 11 and statically embeds the SGC (Secure Group Chat) WebSockets / WebRTC component suite — a commercial Indy-based VCL library normally used to build legitimate real-time video and chat applications. Once side-loaded, the DLL initialises an SGC WebSocket / WebRTC client and establishes an encrypted persistent session to one of three cloud broker backends: mingw10.dll uses Google Cloud Pub/Sub, libwebp.dll uses Microsoft Azure with the MQTT protocol, and libffi-6.dll uses Amazon Web Services brokers also over MQTT. By tunnelling C2 over WebSocket/WebRTC framing on common HTTPS/TLS ports to high-reputation cloud SaaS endpoints, the operators trivially bypass IP/domain blocklists, defeat SNI-based filters, and produce network telemetry that is statistically indistinguishable from a Teams, Zoom, Webex or Meet conference. The decision to ship three independent cloud transports across the DLL set also provides resilience: if one cloud provider terminates the abused tenant, the other two channels continue to operate.
Each Delphi 11 DLL carries a substantial anti-analysis layer. Before contacting C2 the loader enumerates installed antivirus and EDR products via WMI queries against root\SecurityCenter2 (SELECT * FROM AntiVirusProduct), checks the computer name and current working directory against a denylist of common sandbox and analyst hostnames (e.g. SANDBOX, MALWARE, VMUSER, JOHN-PC), inspects for the presence of debuggers via IsDebuggerPresent and CheckRemoteDebuggerPresent, queries CPUID and registry keys to detect VMware, VirtualBox, QEMU and Hyper-V environments, and tests for hooked APIs and analyst tooling such as Procmon, Wireshark, Fiddler, x64dbg, OllyDbg and IDA. If any heuristic matches, the loader either silently terminates or executes a benign decoy code path so that automated sandboxes record clean behaviour. When checks pass the malware proceeds to credential theft, keylogging, clipboard monitoring, and the deployment of fake-banking HTML overlays specific to each
Weaknesses (CWE)
CWE-427, CWE-829, CWE-94
Target sectors: financial-services, banking, fintech, retail-banking-customers, sme-banking
Target regions: Portugal, Spain, Mexico, Latin America, Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1583.003, T1608.001, T1566.002, T1189, T1204.002, T1059.005, T1106, T1547.001, T1053.005