Casbaneiro distributes command traffic across multiple servers

A Casbaneiro banking Trojan campaign targeting users in Latin America is using geofenced phishing, staged malware delivery and separate command-and-control servers to make malicious activity harder to detect and analyse, according to security research published this month.

FortiGuard Labs said it observed the campaign in August, with activity focused on Argentina, Peru, Colombia and Mexico. Victims are approached through phishing emails and PDF documents disguised as invoices, legal notices or purported court-related communications, often incorporating the recipient’s email address to make the lure appear more credible.

The infection chain begins when a victim follows a link embedded in the message or PDF. The associated webpage checks the visitor’s IP address before delivering malware. Users outside the intended country are redirected to legitimate sites such as Google or YouTube, while targets inside the selected region receive a webpage containing a Base64-encoded ZIP archive embedded in JavaScript.

The archive contains an HTA file that calls an external JavaScript resource and retrieves an XML-based script package containing JScript. That script uses Windows Management Instrumentation to perform environment checks, including sandbox detection and identification of the operating system language, before continuing execution.

Researchers found that the next stage downloads three components separately: a legitimate AutoIt interpreter, a compiled AutoIt script and a compressed file holding the final payload. Splitting the components reduces the chance that static security tools will identify their combined purpose because the individual files do not necessarily appear malicious when examined alone.

The loader establishes persistence through an LNK file in the Windows Startup folder. It then displays a window resembling a Windows service, decompresses the payload and injects it into the legitimate RegSvcs. exe process, or into mobsync. exe if the first process is unavailable.

Once active, Casbaneiro applies another language check and does not proceed on systems configured in German, French or English. It gathers email addresses from the victim’s address book and sender and recipient information stored in Microsoft Outlook, transmitting collected material to attacker-controlled infrastructure.

A distinctive feature of the campaign is the way stolen information and control traffic are divided among different servers. Casbaneiro sends Base64-encoded victim information to one server that deliberately replies with an HTTP 403 Forbidden status. The malware retries if it receives another response, meaning the 403 acts as an expected signal rather than proof that the server is inaccessible.

That behaviour can complicate automated analysis because investigators or security products may interpret the response as evidence that the infrastructure is inactive. Casbaneiro creates infection markers after receiving the expected 403 response, helping prevent repeated actions that could otherwise attract attention.

Full command-and-control communication is also conditional. The malware initiates its principal C2 exchange only when the infected user visits a website associated with one of the targeted banks. At that point, information about the compromised computer is sent to another server, linking active control traffic to a specific banking session rather than producing a constant network beacon.

Available C2 functions include keyboard control, clipboard pasting, file execution, command execution and operations involving fraudulent windows designed to imitate banking interfaces. Clipboard manipulation and fake windows are established features of Casbaneiro and related Latin American banking malware, where attackers seek to interfere with financial transactions or capture credentials.

Researchers also observed malformed HTTP requests lacking a Host header and carrying an unusually large Content-Length value, with the request body delivered incrementally through numerous small packets. Such irregular formatting may hinder traffic inspection and make malicious connections more difficult for network-based detection systems to classify reliably.

The campaign adds another layer of concealment by using different servers for different categories of stolen data and by triggering those connections at separate stages of an infection. This dispersal can make relationships between network events less obvious when defenders review logs, particularly where individual connections appear unrelated.