

Metabase Q also discovered several new techniques that were added in this massive infection that enabled the cyber criminals to access thousands of credentials:įake certificates to obfuscate initial stage malwareĪ new. Multiple Spanish words found in their malware suggest that several of the programmers may be Latinos, and specifically may be from Chile based on the slang utilized in the comments. They accomplish this by searching for and compromising websites with vulnerable versions of Content Management Systems, like WordPress.įrom there, they leverage these websites to spread malware in a customized manner, such as filtering out countries that they do not wish to infect, dropping different types of malware based on the country being infected and even deploying a unique malicious RAT (Remote Administration Tool) when they detect an interesting device, like a computer from a bank’s employee.ĭuring these campaigns, the group discard any victim with the following system languages:īecause the cyber criminals have a payload building process automated, they can deliver new variants of malware rapidly and thus scale and support multiple campaigns in parallel.īased on analysis of the malware, it is clear that the group is very familiar with the main banks and institutions in the targeted Latin American countries. One of their main strategies is to compromise legitimate websites and use them as Command & Control Servers to further spread malware.


It is an important group to monitor given it’s high level of activity in the region along with its malware-as-a-service modus operandi.Īs a result, the group has constantly launched new types of campaigns, containing different layers of obfuscation and new techniques, making it difficult to fully protect systems against it. Mispadu was discovered by ESET and is known to target Latin American countries via spamming and malvertising campaigns. The techniques, tactics and procedures (TTPs) used during these campaigns resembles the banking trojan Mispadu, however contains new components that have not been seen before.Īnalysts will go into further detail in this blog. For the initial infection, the attackers tried to lure the victims into opening different types of fake bills via HTML pages or PDF password-protected files.
