Metamorfo

Executive Summary

Metamorfo (alias Casbaneiro) is a Brazilian banking Trojan active since 2018 that targets banks and cryptocurrency services in Brazil and Mexico. Public reports indicate it harvests online banking credentials and exfiltrates sensitive data, although specific technical details remain limited. Security teams should prioritize monitoring for suspicious Windows processes, C2 communications, and phishing activity linked to this threat family.

Metamorfo, also known by the alias Casbaneiro, is a Windows‑based banking Trojan that has been linked to a Brazilian cybercrime group active since at least April 2018, according to reports from ESET (April 2020) and Medium. The gang focuses on financial institutions and cryptocurrency services in Brazil and Mexico, leveraging phishing campaigns, malicious links, or compromised web infrastructure to deliver the payload. While detailed technical analyses are sparse, public sources suggest that Metamorfo is designed to capture monetary credentials—such as online banking logins—and exfiltrate sensitive data for illicit use. Like many modern banking Trojans, Metamorfo likely employs a combination of stealthy persistence mechanisms and command‑and‑control communication channels. It may establish persistence via registry or scheduled task entries, while exfiltrating stolen credentials through encrypted tunnels to its C2 infrastructure. The malware’s behavior is tailored to infiltrate the highly regulated finance sector in Latin America, allowing attackers to siphon funds from bank accounts or gain control over cryptocurrency wallets. The threat actor behind Metamorfo demonstrates a clear preference for targeted attacks against local financial ecosystems, which increases exposure for entities operating within those markets. The limited public information on this family underscores the need for heightened vigilance and thorough endpoint monitoring—especially in environments where users may encounter social‑engineering attempts or compromised third‑party vendors. Given the small amount of publicly available evidence, analysts should treat Metamorfo’s capabilities as probable rather than confirmed until corroborated by forensic samples or threat‑intel feeds.

Key Capabilities

• Credential harvesting from banking websites
• Form grabbing and keylogging for credential theft
• Persistent execution via registry or scheduled tasks
• Encrypted command‑and‑control communication to exfiltrate data
• Remote process injection or DLL side‑loading for persistence
• Potential use of PowerShell for download and execution

ATT&CK Techniques

Recommended Actions

• Deploy next‑generation antivirus with real‑time detection for known banking Trojan indicators (file hashes, PE characteristics)
• Implement network segmentation and strict egress controls around banking applications to reduce lateral movement
• Enforce multi‑factor authentication on all financial system logins and monitor for credential misuse
• Patch Windows systems promptly to close known vulnerabilities that could be leveraged by trojan delivery vectors
• Educate users about phishing emails, malicious links, and the dangers of unverified third‑party attachments

Suggested Tags