Grandoreiro has resurfaced in a campaign targeting Latin American users, with Mexico accounting for 40% of observed detections and attackers using DLL sideloading to execute the banking trojan through legitimate software.
The Brazilian-origin malware remains active despite a major law-enforcement operation in January 2024 that disrupted parts of its infrastructure.
Acronis’ Threat Research Unit (TRU) observed the renewed campaign in May 2026, while telemetry from the last 30 days of June showed Mexico as the largest source of detected samples.
The findings add to previous Grandoreiro campaigns targeting Mexico and the malware's earlier expansion into Spain.
Grandoreiro Abuses Legitimate Software
The latest campaign abused the legitimate Duplicate Files Finder application as part of a DLL sideloading chain. Attackers renamed the application and placed a malicious mingwm10.dll alongside legitimate dependencies, causing the trusted executable to load the malicious library.
The initial loader also used extensive anti-analysis checks. It looked for virtualization and sandbox artifacts, security and analysis tools, system characteristics and specific user and machine configurations before attempting to contact its command-and-control (C2) infrastructure.
It also checked the victim's public IP address and geolocation, while traffic from several countries was blacklisted.
Acronis said the malware's initial delivery vector could not be confirmed, although an invoice-like ZIP filename and Grandoreiro's historical distribution patterns led them to assess with moderate confidence that spam had been involved.
The malware used encrypted strings to complicate analysis and contacted its C2 infrastructure only after completing its environmental checks. The C2 server was offline during the researchers' analysis, but static examination indicated that the loader would attempt to retrieve a second-stage payload after establishing communication.
Mexico accounted for 40% of detections in the analyzed telemetry, followed by Spain at 17%, Peru at 13% and Argentina at 10%. Activity remained concentrated in Latin America, with smaller detection clusters in Europe and North America.
Acronis said overall Grandoreiro activity remained below its previous peak but continued to evolve, indicating that the 2024 disruption had not eliminated the malware operation.