S0531: Grandoreiro
Grandoreiro is a banking trojan written in Delphi that was first observed in 2016 and uses a Malware-as-a-Service (MaaS) business model. Grandoreiro has confirmed victims in Brazil, Mexico, Portugal, and Spain.CitationSecurelist Brazilian Banking Malware July 2020CitationESET Grandoreiro April 2020
Security context for executives and security teams
Grandoreiro matters because ATT&CK describes it as a Windows banking trojan, written in Delphi, operating under a Malware-as-a-Service model, with confirmed victims in Brazil, Mexico, Portugal, and Spain. The relationship set shows more than simple credential theft: it includes discovery of users, processes, windows, network settings, system information, email accounts, clipboard and keystroke collection, registry modification, browser extension persistence, obfuscation, file deletion, tool transfer, web-based command and control, and exfiltration over C2. For leaders, the decision value is whether Windows endpoint, identity, web proxy, and incident response controls can prove visibility across that chain rather than only blocking known hashes.
Executive priority
Treat this as a coverage-validation case for financially motivated malware behavior on Windows, especially where banking, finance operations, or users handling sensitive credentials are in scope. Because no official ATT&CK detection text is provided, executives should ask for evidence that controls cover the behaviors linked to Grandoreiro: credential collection, persistence, C2 over web protocols and legitimate web services, registry changes, browser extension abuse, and exfiltration over the same C2 channel. This is also useful for audit and resilience discussions: can the organization show endpoint, network, and identity evidence sufficient to investigate suspected credential theft and data movement?
Technical view
SOC and IR teams should build validation around the ATT&CK relationships rather than a single malware signature. On Windows endpoints, confirm visibility into process discovery, user and system discovery, application window enumeration, registry modification, file creation/deletion, suspicious binary characteristics such as padding or encoded content, and execution through Visual Basic or native APIs where logged. Collection coverage should include clipboard access and keylogging-related detections where available. Network teams should validate HTTP/S or other web-protocol C2 monitoring, connections to external web services that may act as dead drop resolvers or bidirectional C2 channels, inbound tool transfer, and data leaving through the same channel. Because the object has no MITRE-provided detection guidance, local baselining and correlation across host, network, and identity telemetry are essential.
Likely telemetry
- Windows endpoint process execution and parent/child process telemetry
- Process, user, system, network configuration, and application window discovery events where available
- Windows Registry modification events
- File creation, deletion, rename, and metadata telemetry, including unusually large or encoded/obfuscated binaries
- Script and Visual Basic execution telemetry where collected
Detection direction
- Do not rely only on hash or static malware detection; Binary Padding and Encrypted/Encoded File relationships indicate that static signatures can be weakened by altered file representation.
- Correlate discovery behaviors in short time windows: process discovery, system/user discovery, network configuration discovery, system time discovery, application window discovery, and email account discovery are more meaningful together than individually.
- Tune for Windows registry changes that support persistence or defense evasion, especially when paired with new executable activity, fileless storage patterns, or unusual browser extension changes.
- Review outbound web traffic for unusual client behavior, repeated contact with external web services, web-based C2 patterns, tool transfer, and exfiltration over the same channel; expect false positives from legitimate web and SaaS use.
- Validate alert paths for collection behaviors such as keylogging and clipboard access, but document blind spots because many environments do not log these actions with high fidelity.
Mitigation priorities
- Prioritize Windows endpoint detection and response coverage for execution, discovery, registry, file, browser extension, and collection behaviors.
- Harden identity and credential use for high-risk users and finance-related workflows, including strong authentication and rapid credential reset procedures after suspected keylogging or clipboard collection.
- Apply controlled browser extension governance and monitor extension installation or modification on managed endpoints.
- Restrict and monitor unnecessary script execution, Visual Basic usage, and suspicious native API-driven behavior where practical without disrupting business operations.
- Use egress filtering, proxy logging, and network monitoring to limit and investigate unauthorized web-protocol C2, external web service abuse, tool transfer, and exfiltration over C2.
Additional notes and limits
The object is a malware entry for Grandoreiro, ATT&CK S0531, in enterprise-attack, with Windows as the supplied platform. MITRE’s description states it is a Delphi banking trojan first observed in 2016, uses a MaaS business model, and has confirmed victims in Brazil, Mexico, Portugal, and Spain. The practical defensive picture comes mainly from the listed uses relationships to ATT&CK techniques across discovery, execution, persistence, defense evasion/stealth, collection, credential access, command and control, exfiltration, and defense impairment.
Official detection guidance is not provided for this object, and tactics are not specified on the malware object itself. This take is therefore based on the official description, external references, platform field, and supplied relationship context. Local telemetry, business geography, user roles, financial workflows, and control architecture are required to assess actual exposure or detection coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Grandoreiro
Grandoreiro is a banking trojan written in Delphi that was first observed in 2016 and uses a Malware-as-a-Service (MaaS) business model. Grandoreiro has confirmed victims in Brazil, Mexico, Portugal, and Spain.CitationSecurelist Brazilian Banking Malware July 2020CitationESET Grandoreiro April 2020
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.