{"id":7418,"date":"2026-09-15T21:03:17","date_gmt":"2026-09-15T21:03:17","guid":{"rendered":"https:\/\/lockitsoft.com\/?p=7418"},"modified":"2026-09-15T21:03:17","modified_gmt":"2026-09-15T21:03:17","slug":"new-stealthy-kremlin-banking-malware-operation-in-brazil-leverages-ethereum-smart-contracts-and-malicious-browser-extensions","status":"publish","type":"post","link":"https:\/\/lockitsoft.com\/?p=7418","title":{"rendered":"New Stealthy KREMLIN Banking Malware Operation in Brazil Leverages Ethereum Smart Contracts and Malicious Browser Extensions"},"content":{"rendered":"

Cybersecurity researchers have uncovered a sophisticated and previously undocumented financial malware campaign targeting financial institutions and corporate entities across Brazil. Monitored under the tracking identifier REF9334 by threat intelligence analysts at Elastic Security Labs, the operation relies on a versatile and stealthy malware toolkit known as KREMLIN. Active since at least May 2025, the threat group behind this campaign has engineered a multi-tiered cyberattack strategy designed to harvest sensitive user credentials, session tokens, and financial data by weaponizing mainstream web browsers, specifically Google Chrome and Microsoft Edge. <\/p>\n

What distinguishes the KREMLIN operation from conventional banking Trojans is its sophisticated infrastructure design. Rather than relying on static command-and-control (C2) servers that can be easily seized or blocked by law enforcement and network defenders, the operators utilize decentralized blockchain technology. Specifically, they employ Ethereum smart contracts as "dead drop resolvers" to dynamically update their infrastructure endpoints and payload hosting directories. This decentralized methodology ensures that the campaign remains resilient against takedown efforts, posing a complex challenge for incident responders and corporate security teams alike.<\/p>\n

Anatomy of an Infection: Multi-Stage Delivery and Evasion<\/p>\n

The attack chain typically begins with a social engineering lure. Victims receive deceptive JavaScript files disguised as routine corporate documents, financial invoices, or legitimate banking notices. When an unsuspecting user manually executes the file, it triggers a complex, multi-stage loading mechanism engineered to evaluate the security posture of the host machine before deploying the primary payload.<\/p>\n

During the initial execution phase, the malware performs aggressive environment checks. It searches for indicators that it is operating inside a sandboxed environment, a security research workstation, or a virtual machine. By analyzing active process lists and evaluating hardware characteristics\u2014such as checking whether the system has fewer than two CPU cores or less than three gigabytes of RAM\u2014the malicious loader ensures it is running on a genuine victim’s machine. <\/p>\n

Furthermore, the malware incorporates a specialized network canary mechanism. It attempts to resolve or download a webpage from a deliberately unregistered domain. If the environment responds with a valid connection, the malware infers that a sandbox or automated analysis tool is artificially simulating internet connectivity. Upon detecting this anomaly, the malware immediately terminates its own execution to thwart automated detection pipelines.<\/p>\n

\"KREMLIN<\/figure>\n

Transitioning to the Second and Third Stages<\/p>\n

Once the preliminary environment checks are successfully passed, the loader proceeds to the second stage of the attack. This phase accomplishes four critical objectives: establishing persistence via scheduled tasks on the Windows operating system, querying the Ethereum smart contract to acquire updated payload download locations, fetching the required binaries, and initializing the third stage.<\/p>\n

The third stage leverages a custom C++ installer that cleverly abuses a legitimate component\u2014specifically, a SentinelOne binary\u2014to sideload an unsigned main payload disguised under the benign-looking filename "SentinelAgentCore.dll." This dynamic-link library executes secondary sandbox and hardware checks, mirroring the caution exhibited by the initial JavaScript loader. <\/p>\n

Upon verifying the environment, the payload queries the Ethereum smart contract to fetch remote infrastructure domains, namely volmira[.]site and zaviro[.]online. From these endpoints, it queries the former domain to retrieve specific configuration parameters for a malicious browser extension, identifying version "1.0.0" and extension ID "ndpbidppejfanjbhfgjlohfanbfbklff," marketed under the deceptive name "AVSync System Inc." The installer checks the host system to determine if the extension is already present; if absent or outdated, it downloads the extension package as a ZIP archive.<\/p>\n

Bypassing Chromium Integrity via Advanced Techniques<\/p>\n

One of the most technically advanced components of the KREMLIN toolkit is its method of deploying the browser extension on Chromium-based browsers without alerting the user or tripping native security controls. Modern web browsers like Google Chrome and Microsoft Edge implement strict integrity mechanisms designed to prevent unauthorized or sideloaded extensions from being installed silently.<\/p>\n

To circumvent these protections, the KREMLIN operators abuse a sophisticated technique known in the cybersecurity community as the "Phantom Extension" method, which shares conceptual similarities with the GhostChrome-X framework. The installer modifies the browser’s "Secure Preferences" file, temporarily enables developer mode, and recalculates or forges the necessary metadata objects\u2014including the required HMACs and App-Bound encrypted hashes stored within the "protection.macs" JSON object. <\/p>\n

\"KREMLIN<\/figure>\n

By successfully regenerating these cryptographic verifications, the malware tricks the browser into accepting the malicious extension as a legitimate, authorized component. This technique bears a striking resemblance to advanced persistent threat (APT) methodologies. Notably, similar manipulation strategies were observed in late August 2026 by China-linked threat actors deploying the BlueMoon exploit kit to install credential-stealing browser extensions codenamed GemStone, highlighting the growing trend of sophisticated threat groups adopting browser-level persistence techniques.<\/p>\n

Data Exfiltration and C2 Communications<\/p>\n

Once successfully installed, the malicious extension requests extensive permissions within the browser environment. It gains comprehensive access to active tabs, cookies, local storage, and the webRequest API. Before initiating data exfiltration, the extension generates a unique victim identifier that is stored locally and appended to all subsequent network traffic destined for the primary command-and-control server located at luizestrelhashapr[.]online:443.<\/p>\n

The extension maintains persistent communication with the C2 infrastructure through a dual-channel approach. It utilizes real-time WebSocket connections to receive remote operator commands and execute arbitrary tasks within the browser context. Additionally, as a secondary fallback and obfuscation measure, the extension periodically polls a "\/google_api\/" endpoint. These polling requests are deliberately designed to mimic routine cascading style sheet (CSS) file fetches, blending malicious telemetry with ordinary web traffic to evade network anomaly detection systems.<\/p>\n

Chronology of the Campaign and Attribution<\/p>\n

According to threat intelligence reports compiled by Elastic Security Labs, the threat group tracked as REF9334 has demonstrated sustained operational activity. While their focused deployment of the KREMLIN banking malware toolkit represents their primary signature, the actors have historically experimented with a variety of off-the-shelf administrative tools and Trojans. Historical telemetry indicates the group has been active since at least May 2025, utilizing standard remote access trojans such as Pulsar RAT and fileless iterations of Remcos RAT in earlier operations.<\/p>\n

The operational timeline reveals a steady evolution in sophistication:<\/p>\n

\"KREMLIN<\/figure>\n
    \n
  • May 2025:<\/strong> Initial observed activity of the REF9334 threat group, characterized by the distribution of standard banking lures and traditional RAT payloads.<\/li>\n
  • June 2025 \u2013 Early 2026:<\/strong> The group executes at least seven distinct campaign waves, progressively refining their delivery mechanisms and expanding their targeting scope to encompass over a dozen prominent Brazilian financial institutions.<\/li>\n
  • May 19, 2026:<\/strong> A pivotal architectural shift occurs as the threat actors integrate Ethereum smart contracts into their infrastructure, moving away from static C2 configurations toward decentralized dead drop resolvers.<\/li>\n
  • Late August 2026:<\/strong> Researchers document the full scope of the KREMLIN toolkit, detailing its multi-stage loaders, C++ installers, and advanced browser extension installation bypass techniques.<\/li>\n<\/ul>\n

    Broader Impact, Analysis, and Defensive Interventions<\/p>\n

    The geographical concentration of the KREMLIN campaign is heavily skewed toward Latin America. Elastic Security Labs reported a significant breakthrough during their investigation when they successfully registered the unregistered network canary domain utilized by the malware’s evasion routines. By monitoring outbound connection attempts to this domain, researchers identified 1,515 infected client systems. Over 98 percent of these compromised endpoints are geolocated within Brazil, underscoring the targeted nature of the campaign against local banking customers and corporate networks.<\/p>\n

    While these systems remain infected with the foundational components of the KREMLIN ecosystem, the interception and registration of the canary domain temporarily disrupted the malware’s automated self-preservation mechanisms. Security analysts note that this disruption introduces a critical window of opportunity for corporate security teams and managed detection and response (MDR) providers to identify compromised endpoints, quarantine affected machines, and remediate unauthorized browser extensions before extensive financial fraud can occur.<\/p>\n

    The deployment of KREMLIN serves as a stark reminder of the evolving threat landscape facing financial institutions. As traditional endpoint protection platforms become increasingly adept at blocking conventional executable malware, threat actors are shifting their focus toward application-layer persistence mechanisms, such as malicious browser extensions and decentralized infrastructure. Security experts strongly advise organizations to enforce strict controls over browser configurations, monitor modifications to critical system files like Secure Preferences, and educate users on the risks associated with executing unsolicited attachments from unknown sources.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Cybersecurity researchers have uncovered a sophisticated and previously undocumented financial malware campaign targeting financial institutions and corporate entities across Brazil. Monitored under the tracking identifier REF9334 by threat intelligence analysts at Elastic Security Labs, the operation relies on a versatile and stealthy malware toolkit known as KREMLIN. Active since at least May 2025, the threat …<\/p>\n","protected":false},"author":22,"featured_media":7417,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[108],"tags":[60,4060,2418,2814,109,4061,4062,4059,587,3065,879,765,111,110,477,3356],"class_list":["post-7418","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-protection","tag-banking","tag-brazil","tag-browser","tag-contracts","tag-cybersecurity","tag-ethereum","tag-extensions","tag-kremlin","tag-leverages","tag-malicious","tag-malware","tag-operation","tag-privacy","tag-security","tag-smart","tag-stealthy"],"_links":{"self":[{"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/posts\/7418","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/users\/22"}],"replies":[{"embeddable":true,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7418"}],"version-history":[{"count":0,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/posts\/7418\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=\/wp\/v2\/media\/7417"}],"wp:attachment":[{"href":"https:\/\/lockitsoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7418"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7418"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lockitsoft.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7418"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}