Do Son 
Infection chain diagram | Image: Elastic Security Labs
At a Glance
| Attribute | Details |
|---|---|
| Malware Family | KREMLIN (also tracked as CHROMEBALLRAT) |
| Threat Actor | REF9334 (alias Kr3mlin4rt1st; suspected Brazilian operators) |
| Target Victims | Brazilian banking customers and financial services users |
| Delivery Vector | Phishing emails containing JavaScript loaders disguised as bank receipts |
| Key Capabilities | Browser extension injection, App-Bound key extraction, Ethereum C2 dead-drops |
| Source | Elastic Security Labs |
Executive Summary
Security researchers identified an active financial attack campaign named REF9334 that spreads the KREMLIN banking malware across Brazil. The operation installs unauthorized browser extensions to capture payment credentials and bypass browser integrity protections. Additionally, threat researchers recently disrupted more than 1,500 active infections by registering an abandoned canary domain.
Delivery and Phishing Operations
The cybercrime campaign began in May 2025 and focuses heavily on South American banking consumers. Attackers distribute malicious JavaScript files through targeted phishing emails disguised as invoices and payment confirmations. Specifically, these malicious files mimic twelve major Brazilian financial institutions, including Banco do Brasil, Bradesco, and Caixa. The lure files adopt common business themes such as bank statements, payment receipts, and tax clearances.
When a recipient opens the lure document, a multi-stage script loader initiates execution. The initial script immediately presents a fake error dialog stating that the document failed to open. Meanwhile, the script executes background discovery commands to inspect the local system environment. It counts active processes via Windows Management Instrumentation and counts desktop files to detect sandbox environments. If the system has fewer than 50 processes or fewer than five desktop files, the loader terminates immediately.
Infection Chain Architecture
After passing initial sandbox checks, the loader fetches an external Node.js runtime to execute secondary scripts. The attackers establish persistence by scheduling a Windows task named MicrosoftNodeRuntimeUpdater. Consequently, the task runs every time the user logs into the machine.
Ethereum Smart Contracts as Resolvers
The loader resolves payload locations through public Ethereum blockchain contracts. In their analysis, Elastic Security Labs observed smart contracts acting as decentralized dead-drop resolvers. As Elastic Security Labs highlighted, ‘In these newer campaigns, actors use the Ethereum blockchain as a dead drop, with smart contracts storing configuration that different components of the infection chain consume.’
Therefore, the threat actors update payload URLs on-chain without altering local script code. The smart contracts point victim systems to staging repositories hosted on public archives and private domains. Furthermore, the operators frequently rotate these staging URLs across separate hosting servers.
DLL Sideloading and Process Evasion
To execute core modules, the infection chain deploys a legitimate, digitally signed SentinelOne executable. The binary sideloads an unsigned library named SentinelAgentCore.dll. Symantec previously documented this sideloading pattern during investigations into Seedworm intrusions.
Furthermore, the malware modifies Windows loader critical sections to avoid deadlocks during worker thread creation. The main installer binary also performs system service number lookups to invoke indirect system calls directly. This approach bypasses user-mode endpoint monitoring hooks without triggering alert flags.
Command-and-Control and Data Exfiltration
The installer deploys a malicious browser extension into Google Chrome and Microsoft Edge profile directories. Under normal conditions, modern Chromium browsers enforce strict integrity protections over user profiles. However, Brazilian KREMLIN banking malware bypasses these safeguards by modifying the Secure Preferences file.
Bypassing Chromium Browser Protections
According to the primary report, ‘Malicious browser extensions bypass Chromium integrity mechanisms by manipulating Secure Preferences and regenerating required HMACs and App-Bound encrypted hashes.’ Synacktiv documented this exact attack mechanism in their research paper on backdooring Chromium browsers.
To calculate valid checksums, the installer launches a background browser process under a debugger. Next, it extracts the App-Bound encryption key directly from process memory. The installer also reads the legacy OSCrypt key from the Local State file. Subsequently, it computes fresh message authentication codes and writes modified preferences to disk.
Credential Theft and Real-Time Interception
Once installed, the rogue extension exfiltrates stored cookies, session tokens, and saved login databases. It compresses these files into archives and transmits them to external collection servers. Furthermore, the extension establishes WebSocket channels to receive real-time instructions from remote operators.
When victims visit targeted banking portals, the extension injects deceptive overlays. For example, some campaign variants inject fake QR codes that prompt victims to reauthenticate mobile banking applications. In addition, the extension monitors Document Object Model modifications to capture keystrokes on login forms.
Threat Actor Attribution Analysis
Investigators classify the attribution to Brazilian operators as suspected rather than confirmed. Nevertheless, technical evidence strongly links the activity to South America. As Elastic Security Labs noted, ‘Lures impersonate twelve Brazilian banks; error messages and code comments are written in Portuguese, and the operators’ Ethereum transactions cluster during Sao Paulo working hours.’
Moreover, financial analysis of the deployment wallet reveals consistent activity during Brazilian working hours. In addition, the developer left Portuguese comments across several script files. The toolkit author also references the alias Kr3mlin4rt1st in code comments.
Defense and Detection Guidance
Defenders must apply layered security measures to counter the KREMLIN banking malware. Because initial delivery relies on email lures, organizations should block standalone script attachments at secure email gateways. Administrators should also configure endpoint controls to block Node.js executables running from temporary directories.
Canary Disruption and Remediation
Threat Command researchers discovered an anti-analysis canary check inside the installer binary. The malware routinely queried an unregistered web domain before deploying malicious components. If the network query succeeded, the program assumed an analysis environment and terminated itself.
Elastic Security Labs registered this canary domain to evaluate active infection rates. The report stated: ‘Now that the domain can be reached, the loader assumes it is in a sandbox and crashes itself to prevent analysis.’ As a result, this intervention disrupted active payloads across 1,515 infected systems. Telemetry showed that 98.75% of these affected hosts were in Brazil.
Security teams should monitor Chromium profile folders for unauthorized extension directories and modified preference files. Furthermore, network administrators can inspect DNS queries for unusual blockchain RPC endpoints. According to the Elastic Security Labs analysis of KREMLIN banking malware, tracking decentralized dead-drop resolvers helps identify emerging campaign infrastructure. Finally, security operations teams should audit scheduled tasks to eliminate rogue runtime updaters.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
