Grandoreiro Outlives Its Own Takedown

Grandoreiro operators are active again more than two years after the 2024 law enforcement disruption, with a Mexico-focused campaign built on DLL sideloading. Delivery is a ZIP archive named like a commercial invoice, assessed with moderate confidence to arrive via spam. It holds a hidden folder of decoy PDF and XML files to make the archive look benign, plus a copy of Duplicate Files Finder, a legitimate cleanup utility renamed to a random string.

Execution runs through a three-link sideloading chain: the renamed executable loads legitimate dupfdll.dll, which pulls in mingwm10.dll, a malicious replacement dropped alongside the trusted binaries. The Grandoreiro payload therefore executes inside a process the operating system and most monitoring tools treat as trusted. Compilation timestamps across the chain are inconsistent, with the parent binary dated 2008 and the malicious library 2026, supporting high confidence that a benign binary is being abused as a loader. Since Duplicate Files Finder has a GUI, the implant hides the window immediately so nothing appears on the victim's desktop.

The loader then runs an unusually deep anti-analysis sequence before contacting any infrastructure. A geolocation lookup terminates execution on hosts in the Czech Republic, Russia, or the Netherlands, a choice assessed as operational rather than ideological since traffic from those countries skews toward researchers and automated analysis. Flagged systems get a Spanish-language error claiming the document failed to display, and execution stops.

Surviving hosts proceed to command-and-control. The Grandoreiro loader resolves its hardcoded C2 domain over Google's DNS-over-HTTPS service rather than the system resolver, hiding the lookup from conventional DNS monitoring, then issues an encrypted HTTP GET over TCP port 6432 for the second stage. The request opens with the token CLIENT_SOLICITA_DDS_MDL and carries geolocation, hostname, username, OS version, and installed antivirus, profiling the victim at first contact. Runtime strings are protected by a custom XOR and unpadded Base64 scheme with no public decoder.

The C2 was offline during analysis, so the second stage was never recovered and no credential harvesting, network enumeration, or lateral movement was observed. The Grandoreiro payload is documented to support keylogging, screen sharing, and remote device control, aimed at banking credentials and account access. Splitting a heavily armored loader from the full-capability payload protects the operators' long-term tooling, and points the threat at individual banking customers rather than enterprise networks.