DanaBot
Also known as: DanaTools
Proofpoints describes DanaBot as the latest example of malware focused on persistence and stealing useful information that can later be monetized rather than demanding an immediate ransom from victims. The social engineering in the low-volume DanaBot campaigns we have observed so far has been well-crafted, again pointing to a renewed focus on “quality over quantity” in email-based threats. DanaBot’s modular nature enables it to download additional components, increasing the flexibility and robust stealing and remote monitoring capabilities of this banker.
Linked Threat Actors
Last 7 days
No activity observed in the last 7 days.
Further Reading
ESET researchers have found new versions of the DanaBot Trojan, which now features a new C&C protocol and modifications to architecture and campaign IDs.
ESET Research shares its findings on the workings of Danabot, an infostealer recently disrupted in a multinational law enforcement operation.
A flaw in DanaBot's C2 server code caused a memory leak that we named "DanaBleed", exposing sensitive data and offering researchers a look into DanaBot’s operations.
Researchers at Zscaler discovered a DDoS attack launched by DanaBot against the Ukrainian Ministry of Defense.
Two large software supply chain attacks distributed the DanaBot malware. DanaBot is a malware-as-a-service platform that focuses credential theft.
A technical analysis of the DanaBot malware's obfuscation techniques.