Last seven days
- First activity
- Sep 16, 2026
- Last activity
- Sep 16, 2026
- Feed role
- C2
- Host form
- 0 IP / 17 hostnames
KREMLIN
KREMLIN is a Brazil-focused banking trojan toolkit associated with the REF9334 cybercrime operation, active since at least May 2025.
Profile source: Mallory opens in a new tabKREMLIN
Family profile
KREMLIN is a Brazil-focused banking trojan toolkit associated with the REF9334 cybercrime operation, active since at least May 2025. It targets Brazilian banking users through Portuguese-language lures impersonating financial institutions, invoices, receipts, payment records, and corporate documents. Infection begins when a victim executes a disguised JavaScript file, which performs sandbox checks and launches a multi-stage loader chain.
KREMLIN establishes Windows persistence with a scheduled task, uses anti-analysis checks, and retrieves mutable payload and command-and-control configuration through Ethereum smart contracts. Later activity incorporated DLL sideloading through a legitimate security-product component. The toolkit installs malicious Chromium extensions, including AVSync, directly into Google Chrome and Microsoft Edge profiles. It bypasses Chromium extension-integrity protections by modifying protected browser preferences and associated validation data, allowing the extension to appear authorized without installation through an official extension store.
The malicious extension and supporting components steal saved browser credentials, cookies, session tokens, browser storage, encryption keys, typed form data, screenshots, tab information, page content, and other Chromium profile data. Extension functionality also supports keylogging, HTTP-request interception, HTML injection, and attacker-controlled browser redirection, enabling account takeover and transaction fraud. KREMLIN has also been deployed alongside Pulsar RAT and Remcos RAT in some campaigns. Confirmed victim telemetry indicates that the overwhelming majority of affected systems were located in Brazil.
Capabilities
- Credential Theft
- Defense Evasion
- Dll Sideloading
- Exfiltration
- Keylogging
- Persistence
- Process Injection
- Session Hijacking
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
10 Sep 16
Observed infrastructure
Leading locations
- US5
- CH2
- CY1
- DE1
- NL1
Leading providers
- Cloudflare, Inc.2
- Namecheap, Inc.2
- SKN Subnet & Telecom Ltd2
- BL Networks1
- DigitalOcean, LLC1
- Hetzner Online GmbH1
Infrastructure traits
- Hosting 8
- Anycast 3
Reported operators
Threat actors
1 named in public reportingElastic Security Labs describes REF9334 as a Brazilian banking-malware operation active since May 2025. The toolkit is named KREMLIN by its author, Kr3mlin4rt1st, and deploys a malicious Chromium extension while using Node.js, scheduled-task persistence, DLL sideloading, and Ethereum smart contracts for configuration and payload delivery.
MITRE ATT&CK
KREMLIN in ATT&CK
48 distinct techniquesTechniques
48 techniques T1562.001 Disable or Modify Tools T1027.003 Steganography T1497 Virtualization/Sandbox Evasion T1053.005 Scheduled Task T1539 Steal Web Session Cookie T1176 Software Extensions T1105 Ingress Tool Transfer T1036 Masquerading T1555.003 Credentials from Web Browsers T1102 Web Service T1113 Screen Capture T1566.001 Spearphishing Attachment T1204.002 Malicious File T1556.004 Network Device Authentication T1102.001 Dead Drop Resolver T1560 Archive Collected Data T1056.001 Keylogging T1041 Exfiltration Over C2 Channel T1059.007 JavaScript T1620 Reflective Code Loading T1027.013 Encrypted/Encoded File T1140 Deobfuscate/Decode Files or Information T1033 System Owner/User Discovery T1608.001 Upload Malware T1027.007 Dynamic API Resolution T1082 System Information Discovery T1518.001 Security Software Discovery T1057 Process Discovery T1047 Windows Management Instrumentation T1217 Browser Information Discovery T1070.004 File Deletion T1560.002 Archive via Library T1036.008 Masquerade File Type T1132.001 Standard Encoding T1005 Data from Local System T1497.001 System Checks T1573.001 Symmetric Cryptography T1036.004 Masquerade Task or Service T1083 File and Directory Discovery T1027.009 Embedded Payloads T1036.005 Match Legitimate Resource Name or Location T1185 Browser Session Hijacking T1071.001 Web Protocols T1106 Native API T1001.003 Protocol or Service Impersonation T1059.001 PowerShell T1119 Automated Collection T1055 Process Injection
