Casbaneiro Banking Trojan Uses Distributed Data-Receiving Servers

Summary

Casbaneiro is a banking trojan targeting users across Latin America through phishing emails and malicious PDF files. The malware follows a multi-stage infection chain involving HTA downloaders and AutoIt loaders to evade detection. It also uses geofencing and distributed, non-standard C2 communications to conceal malicious activity and steal sensitive financial information.

Investigation

FortiGuard Labs observed the campaign in August 2026, identifying staged loaders and geofencing used to restrict delivery to selected regions. The investigation uncovered complex network behavior in which distributed servers intentionally return HTTP 403 Forbidden responses to mislead analysts. Casbaneiro also uses specialized injection techniques targeting legitimate Windows processes such as RegSvcs.exe and mobsync.exe.

Mitigation

Organizations should deploy robust email filtering to block phishing attempts and use CDR (Content Disarm and Reconstruction) services to neutralize malicious document content. Endpoint protection should remain updated with current Casbaneiro signatures. Security teams should also monitor for unusual HTA or AutoIt execution patterns that may indicate early stages of infection.

Response

If Casbaneiro activity is detected, affected Windows endpoints should be isolated immediately to prevent additional data exfiltration or lateral movement. Responders should search for infection markers such as the .Outlook file in %APPDATA% or MD5-named registry keys under HKCU\SOFTWARE. Network logs should also be reviewed for malformed HTTP requests lacking Host headers or containing unusually large Content-Length values.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to establish a foothold on a target Windows workstation by masquerading as legitimate system activity. Following the Casbaneiro playbook, the attacker has dropped an AutoIt-compiled payload. To evade detection, the attacker executes this payload by leveraging regsvcs.exe to host the malicious logic, passing the “AutoIt” identifier within the command line to execute the script. This specific method aims to exploit the trust placed in signed Microsoft binaries.

• Regression Test Script:

  # Simulation of Casbaneiro TTP: Running an AutoIt payload via regsvcs.exe
  # This command is designed to trigger the 'selection_image' and 'selection_command' conditions.
  
  $targetProcess = "C:WindowsSystem32regsvcs.exe"
  $maliciousArg = "AutoIt_Payload_Execution_Module.au3"
  
  Write-Host "[+] Starting simulation: Executing $targetProcess with $maliciousArg" -ForegroundColor Cyan
  
  # Simulate the execution
  Start-Process -FilePath $targetProcess -ArgumentList "/u $maliciousArg" -WindowStyle Hidden
  
  Write-Host "[+] Simulation command sent. Check SIEM for alerts." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup: Terminate any lingering regsvcs processes created during the test.
  Stop-Process -Name "regsvcs" -Force -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete: regsvcs processes terminated." -ForegroundColor Yellow