KrBanker
Also known as: BlackMoon
ThreatPost describes KRBanker (Blackmoon) as a banking Trojan designed to steal user credentials from various South Korean banking institutions. It was discovered in early 2014 and since then has adopted a variety of infection and credential stealing techniques.
C2 Infrastructure
Last 7 days
| Date | C2 Hosts |
|---|---|
| Apr 13, 2026 | 5 |
| Apr 11, 2026 | 1 |
| Apr 10, 2026 | 3 |
| Apr 9, 2026 | 2 |
| Apr 8, 2026 | 1 |
Further Reading
Unit 42 has been tracking KRBanker AKA 'Blackmoon', a campaign that targets banks of the Republic of Korea using adware and exploit kits.
Blog about computer security, malware and reverse engineering.
Rapid7 is tracking a new, more sophisticated and staged campaign using the Blackmoon trojan, which appears to have originated in November 2022.
Two days ago I blogged about the approach I used to start analysing the malware, today I spent some more time on the target trying to get an idea of its behaviours. According to VirusTotal the file…