the Tetrade (Brazilian banking trojans)
loresecurityhacking
The collective name given by Kaspersky researchers in 2020 to four Brazilian banking trojan families - Guildma, Javali, Melcoz and Grandoreiro - that matured locally and then went international, reaching Latin America, Spain, Portugal and beyond.
Brazil has been a world centre of banking malware for two decades, and the Tetrade report is the clearest technical account of why: heavy obfuscation, modular installers, abuse of legitimate tools for execution, command and control hidden on ordinary websites, and in Grandoreiro's case a malware-as-a-service model where other criminals rent the toolkit. Grandoreiro became the most widespread of the four. The strategic point is that these crews did not need novel exploits - they industrialised social engineering and evasion against a banking population that had gone online early.
Also known as: guildma, javali, melcoz, grandoreiro, brazilian banking malware