DanaBot began in 2018 as a banking trojan and grew into a rented malware platform that stole credentials, sold access to more than 300,000 computers and was also turned against government, military and diplomatic targets. In May 2025 United States authorities charged 16 defendants and seized its command servers as part of Operation Endgame, yet researchers reported a new Windows build six months later. This guide is a defender's profile: what DanaBot is, how it reaches victims, the behaviours that map to MITRE ATT&CK, why its stolen credentials matter long after cleanup, and how to detect, prevent and respond. It is for SOC analysts, threat intelligence teams and endpoint owners. The wider loader landscape is covered in the Malware Loaders and Droppers Guide; this page goes deep on one family and contains no attacker procedures.
Key takeaways
- A platform, not a single campaign. DanaBot was sold as malware-as-a-service: ThreatLabz tracked more than 50 affiliates, each renting the panel, builder and back-connect tools, so delivery methods and targets varied by customer.
- Credential theft first, then anything. Core features were browser and client credential theft, web injects, keylogging, screen and video capture, remote desktop and the ability to drop further payloads, including ransomware.
- Dual use is documented. The Justice Department describes a second botnet variant aimed at military, diplomatic and government targets, and vendors observed DDoS use against a Ukrainian Ministry of Defence webmail server in 2022.
- Disruption is not the end. The May 2025 takedown seized servers and charged operators, but Zscaler ThreatLabz reported DanaBot version 669 in November 2025, so detections and hunting should stay in place.
- Cleanup must include identities. Every credential, session cookie, wallet and key on an infected host should be treated as stolen; reimaging alone leaves the attacker's access intact.
What DanaBot is
Proofpoint first reported DanaBot on 31 May 2018, after observing it on 6 May 2018 as the payload of an email campaign aimed at Australian users. It is written in Delphi, as is its administration client. Over seven years it went through four major versions and at least 85 build numbers, the last pre-takedown build observed by ThreatLabz being 4006, compiled in March 2025.
| Attribute | Detail | Source |
|---|---|---|
| First reported | May 2018, Australia-targeted email campaigns | Proofpoint |
| Early distributor | Actor tracked by Proofpoint as TA547, active since at least November 2017 in Australia, Germany, the UK and Italy | Proofpoint |
| Business model | Malware-as-a-service; affiliates paid monthly fees from a few hundred to several thousand US dollars | Zscaler ThreatLabz, US DOJ |
| Scale | More than 300,000 infected computers and estimated damage above USD 50 million | US DOJ |
| Infrastructure | More than 1,000 unique C2 servers identified over its lifetime; proxy and backend layers with a Tor fallback | ESET, Zscaler ThreatLabz |
| Historic hotspot | Poland among the most targeted countries in ESET telemetry | ESET |
Because the operators rented the kit to many customers, a DanaBot detection says little about who is behind a given intrusion. Treat the affiliate, not the family, as the adversary, and keep attribution to what government statements and the reporting vendors' own research support. See the ATT&CK Banking Trojans Software Hub for related families.
How it reached victims
Delivery changed with the affiliate and the year. The reported routes fall into five groups.
- Email: the 2018 campaigns used links to macro-enabled Word documents that fetched the payload with PowerShell, and later zipped JavaScript files hosted on FTP servers, both with stolen security vendor branding (Proofpoint).
- Malvertising: ESET describes fake search adverts leading to bogus download sites for tools such as an IP scanner, and fake "unclaimed funds" sites. See the Malvertising and SEO Poisoning Guide.
- Paste-and-run lures: ESET reports fake "computer fix" pages that copy a command to the clipboard for the victim to run, the pattern covered in the ClickFix and Fake CAPTCHA Paste-and-Run Attacks Guide.
- Other loaders: HijackLoader and SmokeLoader (ThreatLabz), and DarkGate and Matanbuchus (ESET) have delivered DanaBot. See the SmokeLoader and Amadey Loaders Guide.
- Software supply chain: ThreatLabz notes supply chain attacks used for distribution in October and November 2021.
The defensive point: no single email or web control covers DanaBot. Controls on user-initiated execution (macros, script hosts, unsigned installers, clipboard-launched commands) do more than blocking any one lure.
Capabilities and payloads
| Capability | What it means for defenders | Reported by |
|---|---|---|
| Browser, email, FTP and SSH client credential theft; cookie theft | Saved passwords and live sessions leave the host, including for SaaS and admin consoles | Zscaler, ESET, Proofpoint |
| Web injects and form grabbing | Banking and payment pages are altered in the browser to capture data or approve fraudulent transfers | Zscaler, ESET, Proofpoint |
| Keylogging, screenshots, desktop video | Secrets typed or shown on screen, including MFA codes and recovery keys, are captured | US DOJ, Zscaler, ESET |
| VNC-style remote desktop, back-connect and SOCKS proxy | Operators act from the victim's own machine and IP, which defeats simple location checks | Zscaler, ESET, Proofpoint |
| Cryptocurrency wallet and file grabbing, clipboard hijacking | Wallet files and copied addresses are stolen or swapped | Zscaler, ESET |
| Privilege escalation via UAC bypass, process injection | Admin rights enable service-based persistence and wider collection | ESET |
| DDoS module | Infected hosts can be used against third parties | ESET, Zscaler |
| Download and execute further payloads | The infection becomes a foothold for ransomware and other malware | US DOJ, Zscaler, ESET |
Follow-on payloads reported by the vendors include DarkGate and SystemBC, the Lumma and Latrodectus families, and ransomware including Cactus, GlobeImposter, LockBit, Buran and Crisis. That is why a DanaBot alert should be triaged as a possible pre-ransomware event, not a commodity infection. See the Lumma Stealer Guide, DarkGate Malware Guide and Cactus Ransomware Profile Guide.
Command and control: ThreatLabz describes a custom binary protocol over TCP rather than a web backend, encrypted with 1024-bit RSA and 256-bit AES in CBC mode, hardcoded C2 addresses, and Tor as a fallback. ThreatLabz also found that a protocol change in build 2380 (June 2022) caused C2 servers to leak fragments of memory until early 2025, exposing backend addresses, victim data and keys, which later helped researchers and law enforcement.
Espionage, DDoS and the 2025 takedown
The US Department of Justice states that a second version of the botnet targeted military, diplomatic and government entities, recorded all computer interactions and sent data to a separate server, and was allegedly used against diplomats, law enforcement and military personnel in North America and Europe. ThreatLabz reports espionage use against government officials in the Middle East and Eastern Europe that it assessed as likely nation-state activity, and DDoS use in early 2022 against a Ukrainian Ministry of Defence webmail server.
| Date | Event | Source |
|---|---|---|
| May 2018 | First campaigns observed against Australian users | Proofpoint |
| October to November 2021 | Supply chain distribution reported | Zscaler ThreatLabz |
| Early 2022 | DDoS against a Ukrainian Ministry of Defence webmail server | Zscaler ThreatLabz, ESET |
| June 2022 to early 2025 | C2 memory leak exposes backend data | Zscaler ThreatLabz |
| 22 May 2025 | 16 defendants charged; DCIS seizes C2 servers, including dozens of US-hosted virtual servers, within Operation Endgame | US DOJ |
| November 2025 | Version 669 reported after a hiatus of about six months | Zscaler ThreatLabz, via Security Affairs |
The Justice Department credits private partners including Amazon, CrowdStrike, ESET, Flashpoint, Google, Intel 471, Lumen, PayPal, Proofpoint, SpyCloud, Team Cymru and Zscaler, with the Shadowserver Foundation supporting victim notification. Organisations that receive a Shadowserver or national CERT notification naming DanaBot should treat it as a confirmed lead. The related Endgame actions against other loaders are covered in the Latrodectus and Bumblebee Loaders Guide.
Tactics and techniques (MITRE ATT&CK)
The mapping below links behaviours described in the cited vendor and DOJ reporting to ATT&CK v20 techniques. It is an analyst mapping, not an ATT&CK software entry.
| Behaviour | Technique | Defensive focus |
|---|---|---|
| Fake download adverts | T1583.008 Malvertising | Software sourcing policy, ad and DNS filtering |
| Email links to documents or scripts | T1566.002 Spearphishing Link | URL rewriting, attachment and macro policy |
| User runs file or script | T1204.002 Malicious File | Allowlisting, script host restrictions |
| Persistence as a service, Run key or scheduled task | T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder; T1053.005 Scheduled Task | Alert on new services, Run values and tasks with random names |
| Browser credential theft | T1555.003 Credentials from Web Browsers | Managed password storage, browser policy |
| Web injects and session abuse | T1185 Browser Session Hijacking | Transaction signing, session binding |
| Keylogging and screen capture | T1056.001 Keylogging; T1113 Screen Capture | Phishing-resistant MFA so captured codes are useless |
| Remote control and proxying | T1219 Remote Access Tools; T1090 Proxy | Egress control, unusual outbound TCP from workstations |
| Encrypted custom C2 | T1573 Encrypted Channel | Block non-proxied egress, Tor detection |
| Fetching further payloads | T1105 Ingress Tool Transfer | Block execution from user-writable paths |
| DDoS module | T1498 Network Denial of Service | Contain bots; report outbound floods |
Why the identity impact outlasts the infection
DanaBot collected exactly what attackers need to return without malware: saved passwords, session cookies, SSH and FTP client credentials, email client secrets and wallet files. Developers' and administrators' machines also hold cloud CLI tokens, API keys in configuration files and SSH keys, which a file grabber can take. After a confirmed infection, revoke sessions and reset credentials for every account used on the host, rotate any machine credentials found in its files, and review sign-ins from new devices or proxies over the infection window. The Infostealer Logs Monitoring and Response Guide sets out that response, and the Credential Theft vs Session Hijacking page explains why password resets alone do not end session abuse.
Detection and defence
Detection
- Persistence artefacts: new Windows services (Event ID 7045 in the System log), new Run key values and scheduled tasks (Security Event ID 4698 where auditing is on) with pseudorandom names. ThreatLabz notes names are derived from a hardware-based hash and released a detection tool, DanaDetector, for this purpose.
- Vendor detections: Zscaler uses Win32.Downloader.Danabot and Win32.Banker.Danabot; ESET uses names such as Win32/Spy.Danabot.O and Win32/Spy.Danabot.X. Check that your EDR maps these to a high-severity incident, not an auto-cleaned event.
- Network: workstations making long-lived outbound TCP sessions to raw IPs on non-web protocols, or Tor connections; Proofpoint published IDS signatures for DanaBot check-in and VNC module traffic.
- Execution chain: Office or browser processes spawning PowerShell, script hosts running from archives or downloads, and commands launched from the Run dialog after a web visit.
- Threat intelligence: ingest IOCs published by the reporting vendors and CERT or Shadowserver notifications, and age them out, because C2 addresses changed often.
Prevention
- Control software sourcing: publish an approved software portal and block installer downloads from search adverts.
- Restrict execution: block macros from the internet, constrain script hosts, and apply application control to user-writable paths. See the Application Allowlisting Guide.
- Remove local admin: without admin rights DanaBot falls back to Run key persistence and loses service installation and wider collection.
- Harden credentials: move to phishing-resistant MFA, disable browser password saving in favour of a managed password manager, and bind sessions where the platform allows.
- Control egress: force web traffic through a proxy and block direct outbound connections and Tor from user networks.
- Pilot and roll back safely: run execution and egress rules in audit mode with one business unit first, review blocked events for a fortnight, then enforce, keeping a documented exception path.
Response
- Isolate the host, collect memory and the persistence artefacts before reimaging.
- Look for follow-on payloads and lateral movement, because DanaBot often preceded ransomware.
- Revoke sessions, reset passwords and rotate keys and tokens for every identity used on the host.
- Alert finance and payment teams if web injects were possible, and check recent transfers.
- Reimage, then watch the affected accounts for at least 30 days.
Metrics
- Mean time from DanaBot or loader alert to host isolation.
- Percentage of infections where all exposed credentials and sessions were rotated within 24 hours.
- Share of endpoints without standing local admin rights.
- Share of workstations with blocked direct egress and Tor.
- Number of installer downloads from unapproved sources per month.
Common failure patterns
- Clean and close: the EDR removes the file and the ticket closes, while stolen sessions and passwords stay valid.
- Assuming the takedown ended it: detections were retired after May 2025, but a new build appeared in November 2025.
- Commodity triage: a banking trojan alert gets low priority even though the same foothold has delivered ransomware.
- Admin by default: local admin lets the malware install services and collect more.
- Search-sourced tools: IT staff download utilities from adverts, the exact lure ESET describes.
- Forgotten machine credentials: API keys, SSH keys and cloud tokens on the infected host are never rotated.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.PS (platform security), DE.CM (continuous monitoring), RS.MI (incident mitigation) | Execution control, detection and containment |
| NIST SP 800-53 Rev. 5 | CM-7(5) authorised software allowlisting, SI-3 malicious code protection, SI-4 system monitoring, IA-2(1) MFA for privileged accounts | Prevention and detection controls above |
| CIS Controls v8.1 | Control 2 (software inventory and allowlisting), 9 (email and browser protections), 10 (malware defences), 13 (network monitoring) | Delivery and C2 disruption |
| ISO/IEC 27001:2022 Annex A | A.8.7 protection against malware, A.8.16 monitoring activities, A.8.2 privileged access rights | Control objectives for audit |
Practitioner checklist
- Confirm EDR detections for DanaBot raise high-severity incidents with isolation.
- Alert on new services, Run keys and scheduled tasks with random names on workstations.
- Block macros from the internet and restrict script hosts and user-writable execution.
- Remove standing local admin rights from user endpoints.
- Provide an approved software portal and block advert-sourced installers.
- Force egress through a proxy and block Tor from user networks.
- Include session revocation and machine credential rotation in the malware playbook.
- Act on Shadowserver and CERT notifications naming DanaBot within one business day.
Standards and references
- US Department of Justice: 16 defendants federally charged in connection with DanaBot malware scheme
- Zscaler ThreatLabz: Operation Endgame 2.0, DanaBusted
- Zscaler ThreatLabz: DanaBleed, DanaBot C2 server memory leak bug
- ESET Research: Danabot, analyzing a fallen empire
- Proofpoint: DanaBot, a new banking trojan surfaces down under
- Security Affairs: New DanaBot Windows version appears after May disruption
Related NHI Mgmt Group resources: Infostealers vs Loaders · Latrodectus and Bumblebee Loaders Guide · Malware Loaders and Droppers Guide · Botnets Guide