Threat reportMalwareTL-2026-3504
Grandoreiro Banking Trojan Targets Mexico via Duplicate Files Finder DLL Sideloading (mingwm10.dll)
Grandoreiro Banking Trojan Targets Mexico via Duplicate (TL-2026-3504) is a high-severity malware campaign, first published 2026-10-14. It has no confirmed attribution, affects Microsoft Windows, maps to 14 MITRE ATT&CK techniques (T1036.005, T1057, T1071.001), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-3504
- Threat ID
- TL-2026-3504
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, banking, general-enterprise
- Target regions
- mexico, spain, Latin America
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Grandoreiro Banking Trojan Targets Mexico via Duplicate
Malware and tooling: Grandoreiro - S0531
How Grandoreiro Banking Trojan Targets Mexico via Duplicate works
Acronis TRU reports a May 2026 Grandoreiro (Delphi-based banking trojan) campaign that sideloads a malicious mingwm10.dll through a renamed, legitimate Duplicate Files Finder executable. June 2026 telemetry shows activity concentrated in Mexico, followed by Spain and other Latin American countries; delivery is assessed with moderate confidence to be spam carrying ZIP archives.
Grandoreiro is a Delphi-based banking trojan active since 2016 and historically associated with Brazilian operators targeting Spanish- and Portuguese-speaking countries. After the January 2024 INTERPOL/Brazilian Federal Police disruption, Acronis TRU observed a renewed campaign in May 2026 with a new loader technique and heavier anti-analysis.
Infection chain: a ZIP archive (example: Fac-BH22DC0608_RevMQKSAC.zip) contains decoy PDFs and a legitimate Duplicate Files Finder executable renamed to a lure-style name (e.g. _2IH4ENJIRRNCobran_03732qyykae214BKXXN6180-Dt.exe). When run, the executable loads dupfdll.dll, which in turn loads the malicious mingwm10.dll (DLL side-loading, masquerading as the MinGW runtime library). On failure or analysis detection the malware shows a Spanish-language-themed document error message and asks the user to restart. Delivery is assessed with moderate confidence to be spam with ZIP attachments.
Anti-analysis: the loader requires system uptime of at least 180,000 ms; checks for desktop shortcuts of common applications (Chrome, CCleaner, Firefox, FileZilla, Acrobat Reader DC, Edge, Skype); evaluates physical memory, processor count, disk space and screen resolution; looks for VirtualBox/VMware drivers, BIOS registry values containing VBOX/VMWARE/VIRTUAL/QEMU/XEN/INNOTEK and VMware Tools registry keys; blocks execution when 49 analysis-tool processes are running (Procmon, Wireshark, x64dbg, Ghidra, Frida, Fiddler, etc.); blacklists known sandbox usernames/hostnames and analyst directories (e.g. C:\TOOLS\ProcessInvestigator\); and queries ip-api.com to exclude victims in CZ, RU and NL. Strings are protected with a Base64 (no padding) plus XOR scheme using an embedded key and salt.
Command and control: C2 hostnames are resolved via DNS-over-HTTPS (dns.google/resolve), after which the bot issues encrypted HTTP GET requests over TCP/6432. The protocol uses Portuguese-language tokens such as CLIENT_SOLICITA_DDS_MDL, CLIENT_ENVIA_STATUS, SOLICITADO, RECUPERADO, INFECTADO, AV_COMEU_MODULO, ERRO_EXECUCAO, ERRO_FALHA_DOWNLOAD and ERRO_EXTRACAO. The decrypted check-in carries country, city, hostname, username, OS version, installed security product, a bot identifier and date/time fields. Acronis published 6 C2 domains and 17 SHA256 hashes. No CVE is involved; severity is analyst-assigned.
MITRE ATT&CK techniques used in TL-2026-3504
Defense Evasion
T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1564.003 Hide Artifacts: Hidden Window; T1574.001 DLL
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1614 System Location Discovery
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1071.004 Application Layer Protocol: DNS; T1571 Non-Standard Port
Execution
Initial Access
stealth
Affected products and versions in Grandoreiro Banking Trojan Targets Mexico via Duplicate
- Microsoft — Windows
Vulnerable versions: Windows endpoints (user-executed malware; no vulnerability exploited)
Remediation for Grandoreiro Banking Trojan Targets Mexico via Duplicate
Immediate actions
- Block the six published C2 domains at DNS, proxy and firewall
- Block or alert on outbound HTTP over TCP/6432 from workstations
- Hunt for mingwm10.dll and dupfdll.dll loaded from user-writable or archive-extracted paths
- Quarantine ZIP attachments containing executables alongside decoy PDFs
Workarounds
- Block execution from user temp/download/archive extraction directories via application control
Longer-term hardening
- Restrict or monitor DNS-over-HTTPS to dns.google from non-browser processes
- Deploy EDR with DLL side-loading and unsigned-DLL-load detection
- Train users in Mexico/LATAM business units on invoice/collection-notice lures
Timeline of Grandoreiro Banking Trojan Targets Mexico via Duplicate
- Grandoreiro Delphi banking trojan active since 2016 (year-level precision per Acronis).
- INTERPOL, Brazilian Federal Police and Spanish National Police disrupt Grandoreiro operation; five arrests and 13 search warrants in Brazil (late January 2024).
- Renewed Grandoreiro campaign using Duplicate Files Finder DLL side-loading observed (May 2026).
- Sample C2 check-in recorded in Acronis analysis carries date 18-05-2026, showing the campaign was live by this date.
- June 2026 30-day telemetry shows concentration in Mexico, with clusters in Spain and other Latin American countries.
- Acronis Threat Research Unit publishes analysis and IOCs for the campaign.
Sources cited for Grandoreiro Banking Trojan Targets Mexico via Duplicate
- Grandoreiro goes north: from Brazil to Mexico with a new DLL sideloading campaign
- Disrupting a Grandoreiro malware operation (INTERPOL)
- Brazilian Feds Dismantle Grandoreiro Banking Trojan, Arresting Top Operatives (The Hacker News)
- Brazilian police arrest Grandoreiro gang (Risky Business)
- Grandoreiro malware revives following police action (TechRadar)
- MITRE ATT&CK T1574.002 DLL Side-Loading
Detection coverage for TL-2026-3504
As of 2026-10-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3504 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.