Banking trojans began as tools for stealing online banking sessions, but several of the best known families became the first stage of ransomware intrusions, so a detection gap here is rarely just a fraud problem. This hub covers the 14 software entries that NHI Mgmt Group groups as banking trojans in MITRE ATT&CK Enterprise v20, all of them classed by ATT&CK as malware rather than tools. It lists every entry with its platforms, the groups ATT&CK links to it and its most distinctive techniques, and it summarises the behaviours the family shares, computed from the v20 technique relationships rather than from vendor marketing. It then turns those shared behaviours into detection and hardening priorities. It is for detection engineers, threat intelligence analysts and security architects in financial services and beyond who use ATT&CK to plan coverage.
Key takeaways
- Fourteen entries, one platform dominates. Thirteen of the 14 entries run on Windows; the exception is Crocodilus (S9004), an Android banking trojan that ATT&CK says was discovered in March 2025.
- Delivery is the common choke point. Malicious links and files (T1204.001, T1204.002), spearphishing links and attachments (T1566.002, T1566.001) and Visual Basic execution (T1059.005) recur across the family, so email and script controls stop most of it early.
- Theft happens in the browser. Browser Session Hijacking (T1185), Credentials from Web Browsers (T1555.003), Clipboard Data (T1115) and Keylogging (T1056.001) each map to four or five members, which is why bank-side fraud controls matter as much as endpoint controls.
- Several are loaders in practice. ATT&CK describes Emotet as primarily a downloader for other malware such as TrickBot and IcedID, and Ingress Tool Transfer (T1105) is the most common technique in the hub, mapped to 11 of 14 entries.
- Takedowns do not end the threat. Law enforcement disrupted Emotet in January 2021 and the dropper ecosystem, including IcedID, in May 2024; families and their operators return or are replaced, so detection should target behaviours rather than names.
What ATT&CK counts as a banking trojan
ATT&CK does not have a "banking trojan" category. It classifies each software entry only as malware (software intended for malicious use) or a tool (software a defender could also use), and describes each one in its own text. This hub groups the entries whose ATT&CK description centres on stealing banking or financial information, plus three delivery frameworks that ATT&CK ties closely to banking malware: Squirrelwaffle, which ATT&CK says delivered the QakBot banking trojan and Cobalt Strike; Gootloader, which ATT&CK describes as a JavaScript infection framework used since at least 2020 to deliver the Gootkit banking trojan and other malware; and Emotet, which ATT&CK says first emerged in June 2014 initially targeting the financial sector. Membership follows the NHI Mgmt Group software category list, and every count on this page is computed from the ATT&CK Enterprise v20 STIX data with revoked and deprecated objects removed.
The family splits into three practical groups:
- Classic Windows banking trojans: Dridex, Dyre, Ursnif and Zeus Panda. ATT&CK records that by December 2019 the US Treasury estimated Dridex had infected computers in hundreds of banks and financial institutions in over 40 countries, leading to more than $100 million in theft.
- Latin American banking trojans: Grandoreiro, Javali, Melcoz, Metamorfo and Mispadu, mostly written in Delphi and aimed at customers of banks in Brazil, Mexico and Spanish and Portuguese speaking countries. See the Latin American Banking Trojans Guide for the regional depth.
- Loaders that grew out of, or into, banking malware: Emotet, IcedID, Squirrelwaffle and Gootloader. These matter most to enterprise defenders, because their main job became delivering the next stage. See the Malware Loaders and Droppers Guide.
Mobile banking trojans are covered in depth in the Android Banking Trojans Guide; Crocodilus is the only mobile entry in this Enterprise hub.
Shared behaviours across the family
Across the 14 entries, ATT&CK Enterprise v20 holds relationships to 125 distinct techniques and sub-techniques (Crocodilus is mapped in the Mobile matrix, so its techniques are not counted here). The table shows the most common ones and how many members use each. Thirteen of the 14 entries have at least one Command and Control technique, 13 at least one Stealth (TA0005) technique and 13 at least one Execution technique; 12 have a Discovery technique.
| Technique | Members (of 14) | What it looks like in this family |
|---|---|---|
| T1105 Ingress Tool Transfer | 11 | Download of modules, plugins or a follow-on payload after first execution |
| T1082 System Information Discovery | 10 | Host profiling sent to the operator before deciding what to deploy |
| T1140 Deobfuscate/Decode Files or Information | 9 | Encoded strings, configuration and payloads decoded at run time |
| T1071.001 Web Protocols | 9 | HTTP or HTTPS command and control that blends with browsing |
| T1059.005 Visual Basic | 9 | VBA macros and VBScript droppers in the delivery chain |
| T1547.001 Registry Run Keys / Startup Folder | 8 | Persistence through Run keys or the Startup folder |
| T1204.002 Malicious File | 8 | A user opens an attachment or downloaded archive |
| T1218.007 Msiexec | 6 | Signed Windows Installer used to run the payload, common in the Latin American families |
| T1566.002 Spearphishing Link | 6 | Email links to a downloader or a ZIP hosted on a compromised or cloud site |
| T1185 Browser Session Hijacking | 5 | Web injects or a man-in-the-browser position inside a live banking session |
| T1555.003 Credentials from Web Browsers | 5 | Saved passwords read from browser stores |
| T1115 Clipboard Data | 5 | Clipboard read or replaced, for example to swap a payment or wallet address |
| T1056.001 Keylogging | 4 | Keystrokes captured during banking logins |
| T1614.001 System Language Discovery | 4 | Locale checks used to select or avoid victims by country |
Two points stand out. First, the early stages (delivery, decode, download) are more uniform across the family than the theft stage, so they give the widest detection return. Second, System Language Discovery appears in four entries (Gootloader, IcedID, Mispadu and Zeus Panda): these trojans check the locale of a host to select or avoid victims, so a sandbox configured for the wrong region may see nothing.
Detection priorities
Build detections on the shared behaviours, then tune for the members that matter to you. The order below follows how early in the chain each signal fires.
- Office and script launch chains: alert when Word, Excel or Outlook spawns wscript.exe, cscript.exe, mshta.exe, powershell.exe or cmd.exe, and when wscript.exe runs a .js or .vbs file from a user download or temp folder. This covers the Visual Basic stages ATT&CK maps to Emotet, Ursnif and Squirrelwaffle and the JavaScript stage of Gootloader.
- Signed binary proxy execution: msiexec.exe installing a package from a URL or a user profile path, and rundll32.exe loading a DLL from a temp or downloads folder (T1218.007, T1218.011). Six members use Msiexec.
- Download and persist in quick succession: a new executable or DLL written to disk shortly after first script execution, followed by a new Run key or scheduled task (T1547.001, T1053.005). Correlating the three events is more reliable than any one alone.
- Process injection into browsers: a non-browser process opening a handle to, or injecting into, chrome.exe, msedge.exe or firefox.exe, and browser credential stores read by a process that is not the browser (T1185, T1555.003).
- Command and control over web protocols: newly registered or rarely seen domains contacted by a process that is not a browser, and regular beacon intervals (T1071.001). Grandoreiro, for example, generates new command and control domains daily according to ESET's analysis.
- Follow-on tooling: any banking trojan or loader detection followed by Cobalt Strike, remote access tools or domain discovery is a ransomware precursor and should be escalated as an intrusion, not closed as commodity malware.
For how to turn these into tested analytics, see the ATT&CK Detection Strategies and Analytics Guide.
Hardening that breaks the chain
| Stage | Control | Techniques it addresses |
|---|---|---|
| Delivery | Block macros in files from the internet, quarantine script and archive attachments, rewrite and detonate links | T1566.001, T1566.002, T1204.001, T1204.002 |
| Execution | Application control that blocks scripts and installers from user writable paths; change the default handler for .js and .vbs to a text editor | T1059.005, T1218.007, T1218.011 |
| Download | Web proxy or protective DNS that blocks uncategorised and newly registered domains for non-browser processes | T1105, T1071.001 |
| Theft | Phishing-resistant authentication and transaction signing on the bank side; enterprise browser policies that disable password saving on managed devices | T1185, T1555.003, T1056.001 |
| Persistence | Monitor and restrict Run keys and scheduled task creation by standard users | T1547.001, T1053.005 |
See the App Control for Business (WDAC) guide for script and installer control, the CIS Control 9 Email and Web Browser Protections Guide for delivery controls, and the Browser Security Hardening Guide for browser policy.
Real cases
- Emotet takedown, January 2021: the US Department of Justice announced on 28 January 2021 that an international operation had disrupted the Emotet botnet. It said Emotet spread mainly through spam with malicious attachments or links and could deliver additional malware such as ransomware, that about 1.6 million IP addresses appeared infected between April 2020 and January 2021, and that investigators replaced Emotet on its servers with a file that stopped administrators communicating with infected computers. Europol reported the same action with partners from eight countries. See the Emotet Malware Guide.
- Operation Endgame, May 2024: Europol described actions between 27 and 29 May 2024 against the dropper ecosystem, targeting IcedID, SystemBC, Pikabot, Smokeloader, Bumblebee and Trickbot, with over 100 servers taken down and four arrests. IcedID is the member of this hub that it names.
- Grandoreiro disruption, January 2024: ESET reported on 30 January 2024 that it supported the Federal Police of Brazil in an operation against Grandoreiro, a banking trojan active since at least 2017 that targeted Brazil, Mexico and Spain. ESET observed on average about 551 unique victims connected per day.
Where identity fits
A banking trojan on a workstation steals more than bank logins. Browser credential stores, session cookies and keystrokes also hold access to SaaS consoles, cloud portals and code repositories, so a single infection can hand an operator the session of an administrator or the credentials a developer saved for a service account. Treat any confirmed infection as a credential exposure: revoke browser sessions for the user, rotate passwords and tokens used on the device, and review recent sign-ins. Where online banking or payment platforms are in scope, pair endpoint controls with server-side protection such as the controls in the Transaction Monitoring and Behavioural Biometrics Guide.
Catalogue: all 14 entries
Every member in the category, sorted by name. Associated groups are the intrusion sets ATT&CK v20 links to the software (up to three); "Distinctive techniques" are up to three techniques of that entry that are least common across the hub, which makes them better hunting leads than the shared behaviours above. Links go to the ATT&CK software page and, where one exists, to the NHI Mgmt Group actor profile.
| ID | Name | Type | Platforms | Associated groups (v20) | Distinctive techniques |
|---|---|---|---|---|---|
| S9004 | Crocodilus | malware | Android | None linked in v20 | T1657 |
| S0384 | Dridex | malware | Windows | TA505, Indrik Spider | T1219, T1027, T1090 |
| S0024 | Dyre | malware | Windows | Wizard Spider | T1007, T1055, T1074.001 |
| S0367 | Emotet | malware | Windows | Wizard Spider | T1003.001, T1016.002, T1021.002 |
| S1138 | Gootloader | malware | Windows | None linked in v20 | T1069.002, T1584.001, T1584.006 |
| S0531 | Grandoreiro | malware | Windows | None linked in v20 | T1027.011, T1102.002, T1222.001 |
| S0483 | IcedID | malware | Windows | TA551, TA578 | T1027.003, T1048.002, T1055.004 |
| S0528 | Javali | malware | Windows | None linked in v20 | T1027.001, T1102.001, T1574.001 |
| S0530 | Melcoz | malware | Windows | None linked in v20 | T1059.010, T1565.002, T1574.001 |
| S0455 | Metamorfo | malware | Windows | None linked in v20 | T1070, T1095, T1102.003 |
| S1122 | Mispadu | malware | Windows | Malteiro | T1217, T1555, T1055 |
| S1030 | Squirrelwaffle | malware | Windows | None linked in v20 | T1560.003, T1132.001, T1218.010 |
| S0386 | Ursnif | malware | Windows | TA551 | T1005, T1055.005, T1080 |
| S0330 | Zeus Panda | malware | Windows | None linked in v20 | T1059, T1012, T1055.002 |
Framework mapping
| Framework | Reference | Relevance to banking trojans |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-3 Malicious Code Protection | Detection and blocking of the payloads and their scripts |
| NIST SP 800-53 Rev 5 | SI-4 System Monitoring | Process, script and network telemetry for the detections above |
| NIST SP 800-53 Rev 5 | CM-7 Least Functionality | Restricting script hosts, macros and installers |
| NIST CSF 2.0 | PR.PS-05 | Installation and execution of unauthorised software are prevented |
| NIST CSF 2.0 | DE.CM-09 | Monitoring of computing hardware, software and runtime environments |
| CIS Controls v8.1 | Control 9 and Control 10 | Email and web browser protections; malware defences |
| ISO/IEC 27001:2022 | Annex A 8.7 | Protection against malware |
Common failure patterns
- Closing it as commodity malware. An Emotet, IcedID or Squirrelwaffle alert is triaged as low severity and the host is reimaged without checking what was downloaded next.
- Only matching family names. Signatures for one family miss the next one, while the shared chain (script, download, Run key, web beacon) stays the same.
- Sandboxes in the wrong locale. Members that check system language can stay quiet in analysis environments set to another region.
- Ignoring the credential exposure. The device is cleaned but browser sessions and saved credentials stolen before detection stay valid.
- Script handlers left at defaults. Double-clicking a .js file still runs it with Windows Script Host on most fleets.
Practitioner checklist
- Map your detections to the 14 shared techniques in the table and record gaps.
- Alert on Office applications spawning script hosts, msiexec or rundll32.
- Block macros from the internet and change the default handler for .js and .vbs files.
- Correlate download, new executable and new Run key or task on the same host.
- Detect non-browser processes reading browser credential stores or injecting into browsers.
- Escalate any loader detection followed by Cobalt Strike or discovery as an intrusion.
- On every confirmed infection, revoke sessions and rotate credentials used on the device.
- Test sandboxes with locales that match your customer and staff regions.
Standards and references
- MITRE ATT&CK: Software
- MITRE ATT&CK: ATT&CK STIX Data (Enterprise v20)
- MITRE ATT&CK: Emotet (S0367)
- US Department of Justice: Emotet Botnet Disrupted in International Cyber Operation
- Europol: World's most dangerous malware EMOTET disrupted through global action
- Europol: Largest ever operation against botnets hits dropper malware ecosystem
- ESET: ESET takes part in global operation to disrupt Grandoreiro banking trojan
Related NHI Mgmt Group resources: ATT&CK Loaders and Droppers Software Hub, ATT&CK Remote Access Trojans Software Hub, Banking Cybersecurity Programme Guide, CFPB Section 1033 Open Banking Rule Guide, MITRE ATT&CK Guide for Defenders.