Banking Trojans: Mekotio and BBTok Ramp Up Phishing Scams in Latin America

Introduction

On September 5, 2024, TrendMicro released a detailed report on the resurgence of two notorious banking Trojans: Mekotio and BBTok. These malware variants, long known for targeting Latin American users, have adopted new tactics to evade detection and exploit victims. The cybercriminal groups behind them have ramped up phishing campaigns using business and judicial-related lures, expanding their reach beyond previous targets.

Report Overview

Mekotio, first detected in March 2018, has primarily targeted Brazil but has since expanded to include other Latin American countries such as Chile, Mexico, Colombia, and Argentina. The Trojan's evolution suggests the criminals behind it are exploring new geographical targets. BBTok, discovered in 2020, similarly focuses on Latin American financial institutions and shares common target regions with Mekotio.

Both Trojans are typically distributed through phishing emails containing malicious links or attachments. These emails impersonate legitimate organizations to trick users into downloading malware that can steal sensitive banking credentials, conduct unauthorized transactions, and more.

Mekotio has recently introduced more advanced evasion techniques, including the obfuscation of PowerShell scripts used to initiate the malware infection. The infection process begins when a victim clicks a malicious link in a phishing email, triggering the download of a ZIP file containing an obfuscated batch file. This batch file, when executed, runs a PowerShell script that connects to a secondary URL to download additional malware or steal data.

BBTok, on the other hand, uses a phishing link to deliver an ISO file containing a malicious LNK file. This file initiates the infection by launching MSBuild.exe, a legitimate Windows utility. By leveraging this trusted tool, attackers can avoid detection while executing malicious scripts and DLL payloads that connect to a command-and-control (C&C) server.

These banking Trojans pose significant risks to individuals and businesses alike. Mekotio and BBTok are designed to steal sensitive financial information, leading to unauthorized transactions, data theft, and potentially crippling financial losses. Mekotio’s new tactics, particularly its ability to adapt based on the compromised system’s location, indicate that the Trojan’s scope may expand beyond Latin America, potentially impacting victims worldwide.

Our research has also shown that manufacturing companies were the hardest hit by these phishing attacks in August 2024, accounting for 26% of all incidents. Retail businesses, technology enterprises, and financial services were also significantly targeted. The broader implications suggest a growing need for businesses to bolster their defenses against increasingly sophisticated phishing attacks.

Insights and Analysis

To protect against these evolving threats, organizations should:

• Implement advanced threat detection and zero-trust security frameworks.
• Educate employees on phishing tactics and how to identify suspicious emails.
• Regularly update security protocols and ensure that email filters and anti-spam tools are activated.
• Encourage employees to verify the legitimacy of emails, especially those involving financial or legal matters.

For individual users, the following practices are essential:

• Be wary of unsolicited emails and verify the sender’s identity.
• Avoid clicking on suspicious links or downloading unverified attachments.
• Use reputable anti-spam software and email filters.
• Report phishing attempts to IT teams or security personnel.

Mekotio and BBTok continue to be formidable threats in Latin America, employing sophisticated tactics to steal sensitive financial information. Businesses and individuals alike must adopt proactive measures to defend against these banking Trojans. Strengthening security protocols, increasing employee awareness, and maintaining vigilance against phishing emails are critical steps in mitigating the risks posed by these evolving threats.

Indicators of Compromise (IoCs)

MITRE ATT&CK Techniques

References

Banking Trojans Mekotio Looks to Expand Targets, BBTok Abuses Utility Command

Notorious Mekotio and BBTok are having a resurgence targeting Latin American users. Mekotio’s latest variant suggests the gang behind it is broadening their target, while BBTok is seen abusing MSBuild.exe to evade detection.

Trend MicroContact Us

https://documents.trendmicro.com/images/TEx/Mekotio-and-BBTok-IOCsktvYaQ0.txt