Reports Detail New Capabilities in Manic, Grandoreiro and ToxicPanda 2.0
Summary
Researchers report Manic’s Android banking and spyware features, Grandoreiro’s ongoing campaigns and DLL sideloading, and ToxicPanda 2.0’s expanded app targeting and ADB abuse across multiple regions.
Key points
- ThreatFabric says Manic has targeted Ukraine, as well as Russian and European financial institutions, cryptocurrency and fintech services, and military-focused messaging apps.
- Manic is distributed through malicious websites and droppers; reported capabilities include keylogging, phishing screens, surveillance, and relaying collected data between nearby infected devices over Wi-Fi Direct or Bluetooth.
- Acronis reports Grandoreiro remains active, with a recent campaign focused mainly on Mexico; the malware also targets users in Europe and North America.
- Recent Grandoreiro samples reportedly use the Duplicate Files Finder application for DLL sideloading and perform extensive anti-analysis checks before contacting command-and-control infrastructure.
- Zimperium says ToxicPanda 2.0 supports 167 remote commands and targets nearly 350 financial applications, compared with 16 in previous versions.
- ToxicPanda 2.0 reportedly abuses Android Wireless Debugging through automated clicks to gain privilege escalation and shell-level access; samples were delivered through AWS-hosted buckets.
Article Details
- Event Type
- Cybersecurity reporting on the activity and updated capabilities of banking trojans.
- Impact
- Manic, Grandoreiro, and ToxicPanda 2.0 target financial institutions and users across multiple regions. Reported capabilities include credential phishing, keystroke and data theft, remote device control, and financial fraud. ToxicPanda 2.0 is delivered through AWS-hosted buckets, while Grandoreiro samples abuse Duplicate Files Finder through DLL sideloading.
MITRE ATT&CK
T1056.001 · KeyloggingManic can log keystrokes on compromised devices.T1056.003 · Web Portal CaptureManic displays phishing screens to capture banking and cryptocurrency credentials.T1497.001 · System ChecksGrandoreiro checks for sandbox and virtual-machine artifacts before contacting its C2 infrastructure.T1574.002 · DLL Side-LoadingRecent Grandoreiro samples use DLL sideloading through Duplicate Files Finder to execute malicious code.
Malware
GrandoreiroThe Acronis Threat Research Unit warned that the Grandoreiro banking trojan remains active, continuing to focus on users in Latin America.ManicThreatFabric has detailed Manic, described as an Android malware that combines banking trojan and spyware capabilities.ToxicPandaToxicPanda 2.0ToxicPanda 2.0ToxicPanda 2.0 is designed to target financial institutions across 16 countries, including Pakistan, South Africa, Mexico, Nigeria, India, Indonesia, and Panama.
Vendors
Products
AndroidThreatFabric has detailed Manic, described as an Android malware that combines banking trojan and spyware capabilities.AWSalso reveals a shift in distribution methods, with ToxicPanda 2.0 samples being delivered through Amazon AWS-hosted buckets, indicating the attackers are leveraging cloud infrastructure for malware delivery.”Duplicate Files FinderRecent samples abuse the legitimate Duplicate Files Finder (DFF) application to execute malicious code through DLL sideloading.Microsoft WindowsThe Windows malware, of Brazilian origin, has been around for a decade, and it has continued to improve despite law enforcement’s attempts to disrupt it.
Tools
Countries
IndiaToxicPanda 2.0 is designed to target financial institutions across 16 countries, including Pakistan, South Africa, Mexico, Nigeria, India, Indonesia, and Panama.IndonesiaToxicPanda 2.0 is designed to target financial institutions across 16 countries, including Pakistan, South Africa, Mexico, Nigeria, India, Indonesia, and Panama.MexicoHowever, a recent campaign monitored by Acronis saw the bulk of attacks aimed at Mexico.NigeriaToxicPanda 2.0 is designed to target financial institutions across 16 countries, including Pakistan, South Africa, Mexico, Nigeria, India, Indonesia, and Panama.PakistanToxicPanda 2.0 is designed to target financial institutions across 16 countries, including Pakistan, South Africa, Mexico, Nigeria, India, Indonesia, and Panama.PanamaToxicPanda 2.0 is designed to target financial institutions across 16 countries, including Pakistan, South Africa, Mexico, Nigeria, India, Indonesia, and Panama.South AfricaToxicPanda 2.0 is designed to target financial institutions across 16 countries, including Pakistan, South Africa, Mexico, Nigeria, India, Indonesia, and Panama.UkraineThe malware has mainly been used against Ukraine, including banks, government services, and messaging applications.
Industries
CryptocurrencyHowever, it has also been observed targeting Russian and European financial institutions, global cryptocurrency and fintech services, and military-focused messaging apps.fintechHowever, it has also been observed targeting Russian and European financial institutions, global cryptocurrency and fintech services, and military-focused messaging apps.GovernmentThe malware has mainly been used against Ukraine, including banks, government services, and messaging applications.