Do Son 
At a glance
| Malware family | Grandoreiro banking trojan |
| Threat actor | Portuguese-speaking operators (suspected) |
| Target or victims | Bank users in Mexico, Spain, Peru and Argentina |
| Delivery vector | Invoice-themed spam ZIP (moderate confidence) |
| Key capabilities | DLL sideloading, sandbox and VM evasion, C2 payload retrieval |
| Source | Acronis Threat Research Unit |
TL;DR
The Grandoreiro banking trojan is back in a fresh campaign, and researchers at Acronis tracked it in May 2026. Attackers abuse a real file-management app to load malicious code through DLL sideloading. Mexico now sits at the center of the activity, with most detections landing there.
A banking trojan that survived a takedown
Grandoreiro has targeted Latin American banks since at least 2016. In January 2024, Brazil’s Policia Federal and INTERPOL disrupted much of its infrastructure. However, the malware never fully disappeared.
Acronis says the family still runs, though at a smaller scale. According to its Threat Research Unit, Grandoreiro “remains active despite major law-enforcement disruption efforts in 2024.” As a result, defenders still need to watch for it.
Delivery
Researchers could not fully confirm the delivery method. Still, the clues point to email. The malicious archive arrived as a ZIP named like an invoice, using the word “Fac” for factura.
Because of that name and past Grandoreiro habits, Acronis assessed with moderate confidence that spam delivered the file. Inside the archive, a hidden folder held decoy PDF and XML files. These dummy documents help the payload slip past basic heuristic checks.
Infection chain
The campaign relies on a simple but effective trick. Attackers take the legitimate Duplicate Files Finder application and rename it to a random filename. When it runs, it loads a real dependency, and that file then pulls in a malicious library named mingwm10.dll.
This is DLL sideloading. A trusted, signed program loads attacker code as if it belongs there. Consequently, the malware blends into normal software activity.
Heavy anti-analysis checks
The loader stays small but guards itself well. First, it hides its own window to avoid drawing attention. Then it profiles the machine before doing anything else.
It measures system uptime and demands at least three minutes of runtime. It counts processors, checks memory and free disk space, and reads the screen resolution. Moreover, it scans for VMware and VirtualBox drivers and registry artifacts.
The malware also inspects running processes. In total, it looks for 49 tools tied to debugging, reverse engineering and network analysis. If it spots a research setup, it quits and shows a fake error in Spanish.
Command-and-control and data theft
These evasion checks all run before any network contact. That order tells us the operators care most about dodging analysis.
Only after passing every test does the loader reach its C2 server. To hide the lookup, it resolves its hardcoded domain through Google’s DNS-over-HTTPS service. Next, it sends an encrypted request to fetch a second-stage payload.
That request carries host details, such as the username, hostname and antivirus name. During the analysis, though, the C2 server was offline. Therefore, researchers could not pull the next stage directly.
Where the victims are
Telemetry from the last 30 days of June 2026 shows a clear focus. Mexico led with 40% of detections, according to reporting on the Acronis data. Spain followed at 17%, then Peru at 13% and Argentina at 10%.
Attribution here is suspected, not confirmed. The C2 strings look Portuguese, yet no victims appeared in Brazil or Portugal. This fits public reporting that the codebase forked into a lighter, Mexico-focused variant.
Defense and detection guidance
Teams can reduce risk with a few focused steps. Block invoice-themed ZIP attachments from unknown senders at the mail gateway. In addition, watch for trusted applications loading DLLs from unusual folders.
Monitor for a real GUI app that runs with no visible window. Also flag DNS-over-HTTPS requests to Google’s resolver from odd processes. Finally, treat renamed copies of Duplicate Files Finder as a strong warning sign.
Indicators exist for this campaign, including file hashes and a hardcoded domain. Acronis lists them in its full write-up for detection engineers.
Support Our Threat Intelligence
Find our zero-day alerts and CVE reports helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
PayPal
