# Casbaneiro Banking Trojan Campaign Using Distributed Data-Receiving Servers Against Latin America

> FortiGuard Labs reports a Casbaneiro banking trojan campaign targeting Argentina, Peru, Colombia and Mexico on Windows. Phishing PDFs lead to a geofenced ZIP download, an HTA downloader and an AutoIt loader that injects into RegSvcs.exe or mobsync.exe. Stolen data goes to multiple distributed servers, some of which deliberately return HTTP 403 to mislead analysts.

- **Published:** 2026-10-30T22:07:35Z
- **Last reviewed:** 2026-10-30T22:07:35Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4859
- **ID:** TL-2026-4859
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Casbaneiro (also tracked as Metamorfo) is a Latin American banking trojan first documented by ESET in 2019, which linked it to Amavaldo through a shared, uncommon cryptographic algorithm in the injector component. Fortinet FortiGuard Labs (Rachael Liao, 2026-09-10) describes a campaign with new delivery and infrastructure tradecraft. Victims receive phishing emails and PDFs themed as fake invoices and legal notices, personalized with the recipient's email address and using country-code TLDs matching the target country (Argentina, Peru, Colombia, Mexico).

The PDF link leads to a geofenced webpage. Visitors outside the target regions are redirected to Google/YouTube. Visitors in target regions receive a Base64-encoded ZIP archive embedded in JavaScript, which the script saves programmatically so the browser shows a native download notification, then redirects to a blank page. The ZIP holds an HTA file that loads external JavaScript, which retrieves an XML-based script package with embedded JScript. The HTA performs WMI-based sandbox detection and checks the OS language against a whitelist. It then downloads three separate components to C:\{random name}: a legitimate AutoIt interpreter, a compiled AutoIt script, and a compressed binary with a 'crT' suffix. Fetching the components separately means no single file looks malicious on its own. Persistence is an LNK file in the Startup folder that runs the AutoIt script through the interpreter. An infection-marker folder named {ComputerName}@4{UserName} is created in %PUBLIC%.

The AutoIt loader shows a window that mimics a Windows service, then locates and decompresses the crT file and injects the Casbaneiro payload into RegSvcs.exe, falling back to mobsync.exe. The payload creates the mutex GlobolID-4465173{Username}, runs only if the system default language is not German, French or English, and builds a victim ID as the MD5 of computer name, username and executable name. It harvests email addresses from the address book and sender/recipient data from Microsoft Outlook, sends them unencrypted to an exfiltration URL, and records progress in a .Outlook file in %APPDATA%. Strings (cryptocurrency addresses, global ID, exfiltration URLs) are encrypted with the same algorithm as Ousaban. The key and ciphertext are split into fragments that are concatenated at runtime.

The campaign's notable feature is its distributed data-receiving servers. The malware sends Base64-encoded victim information to a secondary server and expects HTTP 403 Forbidden, retrying on any other status. Only after a 403 does it create two infection markers: an MD5-named folder in %TEMP% and an MD5-named registry key under HKCU\SOFTWARE. Fortinet notes this may mislead analysts into thinking the C2 is down so they overlook the real server. C2 communication starts only when the victim visits a webpage of a targeted bank. C2 tasks include keyboard control, clipboard pasting, file and command execution, and fake windows for specified banks. Observed HTTP anomalies (no Host header, unusually large Content-Length, request bodies sent in many small packets) may be intentional evasion of network inspection. Spreading stolen data across several servers at different times obscures the relationship between network connections. The report names no threat actor and no CVEs. Severity HIGH is an analyst judgment, not a vendor rating.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1566.001 Spearphishing Attachment
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1047 Windows Management Instrumentation
- T1140 Deobfuscate/Decode Files or Information
- T1112 Modify Registry
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1056.002 GUI Input Capture
- T1059.007 JavaScript
- T1059.010 AutoHotKey & AutoIT
- T1218.005 Mshta
- T1055 Process Injection
- T1497.001 System Checks
- T1480 Execution Guardrails
- T1027 Obfuscated Files or Information
- T1547.009 Shortcut Modification
- T1614.001 System Language Discovery
- T1114.001 Local Email Collection
- T1071.001 Web Protocols
- T1132.001 Standard Encoding

## Sources

- [Casbaneiro: A Banking Trojan with Distributed Data-Receiving Servers (Fortinet FortiGuard Labs, Rachael Liao)](https://www.fortinet.com/blog/threat-research/casbaneiro-a-banking-trojan-with-distributed-data-receiving-servers)
- [Casbaneiro: Trojan Dangerous Cooking (ESET WeLiveSecurity)](https://welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking)
- [MITRE ATT&CK Software S0455: Metamorfo](https://attack.mitre.org/software/S0455)
- [Casbaneiro Banking Malware (The Hacker News)](https://thehackernews.com/2023/07/casbaneiro-banking-malware-goes-under.html)
- [Breaking Down the Casbaneiro Infection Chain - Part II (Sygnia)](https://sygnia.co/?p=612)
- [Metamorfo Banking Trojan Targets the Americas (Hive Pro)](https://www.hivepro.com/threat-advisory/metamorfo-banking-trojan-targets-the-americas/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4859