Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 23:46:55 UTC
Home > List all groups > List all tools > List all groups using tool Grandoreiro
 Tool: Grandoreiro
Names Grandoreiro
Category Malware
Type Banking trojan, Credential stealer
Description
(segurancainformatica) Grandoreiro is a Latin American banking trojan targeting Brazil,
Mexico, Spain, Peru, and has now extended to Portugal.
Cybercriminals attempt to compromise computers to generate revenue by exfiltrating
information from victims’ devices, typically banking-related information. During April
and May 2020, a new Grandoreiro variant was identified. This piece of malware
includes improvements in the way it is operating. The threat has been disseminating via
malscam campaigns, as in the past, and the name of the victim is used as a part of the
malicious attachment name, as shown below.
Information https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=c4ec465b-e68f-49d7-ae46-de7f308d7723
Page 1 of 2

MITRE ATT&CK Malpedia AlienVault OTX Last change to this tool card: 21 April 2025
Download this tool card in JSON format
All groups using tool Grandoreiro
Changed Name Country Observed
Unknown groups
 _[ Interesting malware not linked to an actor yet ]_
1 group listed (0 APT, 0 other, 1 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=c4ec465b-e68f-49d7-ae46-de7f308d7723
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=c4ec465b-e68f-49d7-ae46-de7f308d7723
Page 2 of 2