Casbaneiro: Two Campaigns and an Active C2
Unit 42 tracked two Casbaneiro activity lines, including an abused remote access tool, Delphi side-loading and a malicious Chromium extension.
Unit 42 reconstructed two activity lines linked to Casbaneiro, also tracked as Metamorfo and Ponteiro. In one, the banking malware was distributed alongside a malicious Chromium extension whose infrastructure was still active when the analysis ended. In the other, the intrusion began with phishing, moved to the installation of a legitimate remote access client from an abused test tenant, and ended with PowerShell execution on the compromised system. From there, the operators separately downloaded an extension file, a signed utility and a malicious DLL, opening two execution paths in parallel.
The Delphi payload abused DLL side-loading through VmLauncher.exe, a signed Caphyon Advanced Installer binary, to load zlibai.dll. That DLL impersonated zlib, exported decoy functions, patched the host process entry point and handed execution to a handler that hid the window, checked connectivity and decrypted commands with an XOR routine backed by a 150-byte table. In parallel, the Chromium extension loaded outside the Chrome Web Store with chrome.exe --load-extension=C:\chrome, requested broad permissions and set up a WebSocket channel for screenshots, cookie theft, tab enumeration, form capture and operator-controlled HTML overlays.
The infrastructure was split between the extension platform, the panel and the Delphi payload, hosted by different providers. Unit 42 identified 216.203.21[.]119 as the visible control center for the WebSocket and panel, and 190.2.184[.]201 as the Delphi C2 on ports 8082 and 8398. It also published configuration and download domains, sample hashes and host artifacts, including local extensions, a distribution ZIP and associated registry keys. The panel’s observed target list includes about 65 Portuguese and Brazilian banking portals, 11 cryptocurrency exchanges and webmail providers, but that reflects observed technical reach, not confirmed victims.
Separate secondary coverage attributes a broader regional component to an August campaign, with custom lures built around invoices, demands or alleged court procedures. That line also reportedly collected Outlook contacts and sender and recipient data before activating banking-related communication. However, the operational link between that regional campaign and the later activity described by Unit 42 is not confirmed in the sources reviewed, so they should be treated as separate investigations.
Executive summary
Unit 42 documented two separate activity lines associated with Casbaneiro, also tracked as Metamorfo and Ponteiro. One combined abused legitimate remote access, a Delphi payload delivered through DLL side-loading, and a malicious Chromium extension with a persistent WebSocket. The other, covered by secondary sources, describes an August regional campaign with invoice, demand and legal-process lures, plus prior collection of Outlook data before banking logic was triggered.
In the line analyzed by Unit 42, initial access began with phishing. The victim ended up installing a legitimate remote access client obtained from an abused test tenant, where it was installed as a Windows service. From that session, the operators ran PowerShell and downloaded, on one side, a compressed file containing an unpacked Chromium extension and, on the other, a signed binary together with a malicious DLL. That sequence allowed two components to be deployed in parallel and remain active at the time of analysis.
The Delphi side abused VmLauncher.exe, a signed Caphyon Advanced Installer component, to load zlibai.dll. The DLL impersonated the zlib compression library, exported decoy functions, patched the host process entry point and redirected execution to its handler. Once running, that handler hid the process window, checked connectivity and decrypted commands with XOR using a 150-byte key table. The report also recorded Delphi C2 traffic at 190.2.184[.]201 on ports 8082 and 8398.
The Chromium extension used Manifest V3, was loaded locally with chrome.exe --load-extension=C:\chrome, and never went through the Chrome Web Store. It requested permissions for storage, tabs, webNavigation, scripting, activeTab and cookies. On startup, it queried a plain-text file on the operator’s domain to retrieve the WebSocket endpoint, generated 10-character uppercase identifiers and kept the session alive with periodic pings. From there, it received commands to capture the screen, recover cookies, list tabs and inject or remove HTML, while its content scripts captured form fields and passwords across pages.
Unit 42 also described "Painel Gangster" panels built on Node.js Express behind nginx, with API routes for managing clients, overlays, screenshots, cookies and notification silencing through messaging. The panel showed a technical list of roughly 65 Portuguese and Brazilian banking portals, 11 cryptocurrency exchanges and webmail providers, including typosquatted domains. That does not equal verified victims, but it does help gauge the actor’s operational focus. The extension platform infrastructure and the Delphi payload infrastructure were separated and hosted by different providers, a split that suggests deliberate design.
The second line, documented in secondary coverage, adds a broader regional dimension. Those reports mention custom lures, geofencing and, in the description of an August campaign, Outlook contact collection and sender and recipient data before a mark of completion in the form of a .Outlook file. Even so, the operational relationship between that campaign and the later intrusion analyzed by Unit 42 was not confirmed in the main source, so they should be treated as distinct investigations.
Context and background
Casbaneiro appears in the material as a banking family with several aliases and an evolution that mixes classic Windows payload delivery with browser abuse. Unit 42 tracks it as Casbaneiro, Metamorfo and Ponteiro. In its October 2026 report, the firm describes an intrusion where execution did not depend on a single channel, but on two coordinated components, a Delphi loader and a Chromium extension, both with infrastructure still active during analysis.
The operational context matters because the actor separated functions. Delivery, panel and C2 did not live on the same site or even the same type of service. Unit 42 observed different infrastructure for the extension platform and the Delphi payload, hosted by different providers. That functional split reduces visibility from monolithic infrastructure sweeps and complicates attribution based only on hosting or domains.
The family had already appeared in secondary coverage from August 2026 tied to a regional distribution campaign. Those reports discuss geofencing, lures that looked like invoices, demands or court procedures, and a stage before communication with banking sites where the malware collected Outlook contacts plus sender and recipient data. They also report a completion marker in the form of a .Outlook file under %APPDATA%. Those elements fit a deployment logic designed to prepare the ground before banking interactions.
Unit 42’s main source, however, does not operationally link that regional campaign to the later activity it analyzed. It does make clear that the panel’s target list, made up of Portuguese and Brazilian banking portals, cryptocurrency exchanges and webmail services, is an observed technical scope and not a victim count. It also clarifies that the intrusion alone does not confirm impact in specific regional countries, including Mexico or Brazil, beyond the targets selected by the panel.
On the engineering side, the use of a signed utility to load a malicious DLL and the use of an extension outside the Chrome Web Store show an effort to blend legitimate components with malicious artifacts. The first path helps disguise loading on Windows. The second enables persistence and higher-level interaction with the browser, including session capture, cookie theft and form interception. That combination explains why the actor operated with split infrastructure and centralized telemetry through web panels.
Key facts table
| Date | Fact | Source | Confidence |
|---|---|---|---|
| 2025-09 | The name "Painel Gangster" appeared in panel data sent to a public malware repository and was later confirmed on active hosts. | Unit 42 | confirmed |
| 2026-08 | Secondary coverage described a regional campaign with invoice and demand lures and prior Outlook data collection. | CybersecurityNews, CyberPress, GBHackers | confirmed and attributed_by_source_as_uncertain |
| 2026-10-12 | Secondary sources said the August campaign may have targeted Latin American countries, including Argentina, Peru, Colombia and Mexico. | GBHackers | attributed_by_source_as_uncertain |
| 2026-10-13 | Unit 42 published analysis on Casbaneiro with a malicious Chromium extension and a Delphi payload delivered in parallel. | Unit 42 | confirmed |
| 2026-10-13 | The initial access described by Unit 42 began with phishing and ended with installation of a legitimate remote access client from an abused test tenant. | Unit 42 | confirmed |
| 2026-10-13 | The remote client was installed as a Windows service and allowed operators to run PowerShell. | Unit 42 | confirmed |
| 2026-10-13 | PowerShell downloaded, from a public service, an unpacked Chromium extension and separately a signed utility with a malicious DLL. | Unit 42 | confirmed |
| 2026-10-13 | VmLauncher.exe, signed by Caphyon Advanced Installer, loaded zlibai.dll through side-loading. | Unit 42 | confirmed |
| 2026-10-13 | The Chromium extension queried a text file on the operator’s domain to obtain its WebSocket C2 and maintained the session with periodic pings. | Unit 42 | confirmed |
| 2026-10-13 | Unit 42 reported domains, IPs, hashes and host artifacts associated with the operation. | Unit 42 | confirmed |
Operation timeline
| Date | Event | Actor/vector | Verified source |
|---|---|---|---|
| 2025-09 | The name "Painel Gangster" appears in panel data leaked or shared in a public repository. | Operator panel | Unit 42 |
| 2026-08 | Lures with invoices, demands and recipient email personalization, according to secondary coverage. | Document phishing | CyberPress, CybersecurityNews, GBHackers |
| 2026-10-12 | Secondary coverage adds a hypothesis of Latin American target geography. | Regional reading | GBHackers |
| 2026-10-13 | Unit 42 documents a second activity line involving Casbaneiro, Metamorfo and Ponteiro. | Unit 42 research | Unit 42 |
| 2026-10-13 | Initial phishing and abuse of a test tenant for a legitimate remote access product. | Phishing, remote access tool | Unit 42 |
| 2026-10-13 | Remote client installed as a Windows service. | Host persistence | Unit 42 |
| 2026-10-13 | PowerShell executed from the remote session. | Living off the land | Unit 42 |
| 2026-10-13 | Download of Chromium extension and signed binary plus malicious DLL. | Delivery via PowerShell | Unit 42 |
| 2026-10-13 | Side-loading of zlibai.dll through VmLauncher.exe. | DLL side-loading | Unit 42 |
| 2026-10-13 | Activation of WebSocket C2 and panel on 216.203.21[.]119. | WebSocket C2 | Unit 42 |
| 2026-10-13 | Delphi C2 traffic observed on 190.2.184[.]201, ports 8082 and 8398. | Delphi C2 | Unit 42 |
| 2026-10-13 | Infrastructure remained active at the time of analysis. | Active infrastructure | Unit 42 |
Attack chain and TTPs
The first observable line in the material follows a classic intrusion chain built around abused remote access and a dual final payload. The user receives phishing, installs a legitimate remote access client obtained from an abused test tenant, and the tool remains running as a Windows service. From there, the operators gain persistent interaction, run PowerShell and download the components needed to deploy both the Delphi module and the Chromium extension.
The second line, according to secondary sources, relies on document-based lures. There, the malware reportedly collected Outlook contacts and metadata before moving into banking-related logic. That pre-stage, transmitted without encryption and marked with a .Outlook file, suggests the operator was not seeking only immediate banking theft, but also pre-processing victim information. Unit 42’s main source does not confirm that sequence, but it does show a modular and carefully segmented operation.
In the Windows payload, VmLauncher.exe is central. The signed Caphyon Advanced Installer utility acted as a container for zlibai.dll. That DLL impersonated zlib, exported decoy functions to fool the loading environment, patched the host process entry point and redirected execution to its handler. Once there, the malware hid its window, checked connectivity and ran commands decrypted with XOR and a 150-byte table.
In the browser, the technique was different but just as aggressive. The extension was installed locally, outside the Chrome Web Store, with Manifest V3 and broad permissions. Requesting storage, tabs, webNavigation, scripting, activeTab and cookies gave it access to navigation, sessions and page manipulation. Its content scripts also ran on all URLs and all frames, expanding the observation surface and reducing reliance on selective site matching.
The most sensitive component is the WebSocket. On startup, the extension queries a plain-text file on the operator’s domain to obtain the active endpoint. It then creates a 10-character uppercase identifier and sustains the session with periodic pings. This centralizes real-time control, enables interactive commands and supports a mix of observation, capture and visual manipulation, a combination the actor used to steal cookies, take screenshots, list tabs and control HTML overlays.
| TTP | Description | Source |
|---|---|---|
| Initial phishing | Access began with a phishing email that prompted installation of a legitimate remote access client. | Unit 42 |
| Abused test tenant | The remote client was obtained from a test tenant abused by the operators. | Unit 42 |
| Windows service | The remote client was installed as a service, sustaining interactive persistence. | Unit 42 |
| PowerShell | Operators ran PowerShell directly on the compromised host. | Unit 42 |
| DLL side-loading | VmLauncher.exe loaded zlibai.dll to redirect execution into the payload. | Unit 42 |
| WebSocket C2 | The extension maintained remote control through WebSocket. | Unit 42 |
| Credential capture | The script captured form fields and passwords across pages. | Unit 42 |
| Overlay injection | The server ordered injection or removal of operator-controlled HTML. | Unit 42 |
| Navigation rewriting | Earlier versions rewrote destinations with webNavigation, though that logic was later removed. | Unit 42 |
| Infrastructure segmentation | The extension infrastructure and the Delphi payload infrastructure were split across different providers. | Unit 42 |
Regional impact
The regional reading combines a technical operation observed by Unit 42 with a regional campaign described by secondary sources. The first is verifiable at the technical level, but it does not confirm victim geography on its own. The second adds a broader layer, with customizable lures, reported target countries and prior Outlook collection. The operational relationship between the two lines is not confirmed in the main source, so they should be treated separately.
Regional overview
Unit 42 observed a banking family active at the time of analysis, delivered with a malicious Chromium extension and live infrastructure for both the browser C2 and the Delphi payload. The technical surface points to a mature operation, with its own panels, segmented hosting and telemetry for navigation and forms. The secondary material, for its part, suggests an earlier regional campaign where lure personalization and Outlook collection came before the banking hit.
The strongest regional data point is the target selection. The panel analyzed by Unit 42 included roughly 65 Portuguese and Brazilian banking portals, 11 cryptocurrency exchanges and webmail providers, including typosquatted domains. That does not mean all of those targets were compromised, only that they formed the technical universe loaded into the operator’s panel. The list shows a selective strategy aimed at banking, crypto and webmail.
The other regional piece, the August campaign described by secondary media, adds a tactic useful in fraud campaigns across Latin America: using lures personalized with the recipient’s identity. The reporting mentions email-address personalization and themes such as invoices, demands or court procedures. It also discusses geofencing and a chain that does not stop at banking theft, but starts with Outlook data collection and ends with activation of the banking component.
Argentina
Secondary coverage places Argentina among the countries targeted by the August regional campaign, but that geography is not confirmed by Unit 42’s main source. What is verified is that the regional campaign was described with personalized lures and that, in parallel, the activity analyzed by Unit 42 used a Chromium extension, a Delphi payload and a panel with banking and webmail targets.
Peru
Peru appears in the material as a country mentioned by secondary coverage for the August regional campaign. Unit 42 does not confirm that geographic scope, although it does document the delivery chain with phishing, abused remote access and two parallel payloads. For Peru, the relevant point is the coexistence of a regional narrative and a separate technical investigation.
Colombia
Colombia appears in secondary coverage as part of the alleged geography affected by the August campaign, but Unit 42 notes that its report does not explicitly mention it. The reference works as a regional indicator, not as confirmation of victims or intrusion in that country.
Brazil
Brazil appears consistently in the panel observed by Unit 42. The technical list included about 65 Portuguese and Brazilian banking portals, plus exchanges and webmail. The source makes clear that this does not prove Brazilian victims or an intrusion that took place in Brazil, but it does show that the targets loaded by the operator included that financial ecosystem.
Mexico
Mexico was mentioned in secondary coverage as part of the alleged regional reach of the August campaign. Unit 42, however, does not confirm that attribution or explicitly link its intrusion to the regional campaign. What can be verified in the main line is the use of distributed infrastructure and an extension capable of intercepting credentials, cookies and navigation.
Chile
There are no additional verifiable facts in the research for Chile. The consulted source does not provide confirmed geographic attribution or country-specific indicators.
Paraguay
There are no additional verifiable facts in the research for Paraguay. The available material does not allow this country to be tied to a specific intrusion or to published infrastructure.
Bolivia
There are no additional verifiable facts in the research for Bolivia. The research provides no IOC, sample or country-specific operational context.
United States
There are no additional verifiable facts in the research for the United States. Although some infrastructure was hosted by different providers, the material does not assign victim country or geographic focus to the United States.
Technical indicators
| Type | Value | Source |
|---|---|---|
| Domain | n1.youconnectedssl[.]digital | Unit 42 |
| Domain | updatehostingfree[.]top | Unit 42 |
| Domain | euromasterx[.]com | Unit 42 |
| Domain | xdrivewin[.]com | Unit 42 |
| Domain | uixfilepdfview[.]top | Unit 42 |
| Domain | locuralocuralocuraloocura[.]top | Unit 42 |
| Domain | arneighti[.]com | Unit 42 |
| Domain | knowledgerknolle[.]com | Unit 42 |
| Domain | learnflourishspace[.]com | Unit 42 |
| Domain | zytherostudio[.]com | Unit 42 |
| IP | 216.203.21[.]119 | Unit 42 |
| IP | 190.2.184[.]201 | Unit 42 |
| IP | 216.203.20[.]116 | Unit 42 |
| IP | 65.38.121[.]128 | Unit 42 |
| IP | 134.209.200[.]162 | Unit 42 |
| IP | 142.93.109[.]181 | Unit 42 |
| IP | 45.76.69[.]213 | Unit 42 |
| IP | 45.61.136[.]99 | Unit 42 |
| URL | hxxps[:]//n1.youconnectedssl[.]digital/pt.txt | Unit 42 |
| URL | hxxps[:]//updatehostingfree[.]top/w.txt | Unit 42 |
| URL | hxxps[:]//euromasterx[.]com/kayaba/2.dll | Unit 42 |
| URL | hxxps[:]//euromasterx[.]com/good/VmLauncher.exe | Unit 42 |
| SHA-256 hash | d180a1978cd547f8aa4c387f951c720f0b2ff9641a45a8153994a8f29cfdf610 | Unit 42 |
| SHA-256 hash | 6cdf132ee130b4cec889e39e06b07559fb4119c61a62d48c03cf357f66eb8900 | Unit 42 |
| SHA-256 hash | c14c25792af4e1552b54b4fe0aca6e405ed052b4ba4af67a439bfdad5b3919ed | Unit 42 |
| SHA-256 hash | 36f7a35c3e811fc1f66836297bc7a5d1dcc8443e7873a6369fb6d5e99351d26a | Unit 42 |
| SHA-256 hash | f91e37f4951dfd606c0faf9b77aa4e640f735a92319f10e572941e647a9b991d | Unit 42 |
| Host artifact | C:\Docstar\zlibai.dll | Unit 42 |
| Host artifact | C:\Docstar\VmLauncher.exe | Unit 42 |
| Host artifact | C:\Backup11\ptpt.zip | Unit 42 |
| Host artifact | C:\chrome\background.js | Unit 42 |
| Host artifact | C:\chrome\content_script.js | Unit 42 |
| Host artifact | C:\chrome\manifest.json | Unit 42 |
| Host artifact | chrome.exe --load-extension=C:\chrome | Unit 42 |
| Registry | HKCU\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings | Unit 42 |
| Service | HKLM\SYSTEM\ControlSet001\Services\ScreenConnect Client | Unit 42 |
Analysis for security teams
The operational priority is to detect the combination, not each piece in isolation. A legitimate remote access client installed as a service, followed by PowerShell downloading files from business-unrelated domains, and then chrome.exe with load-extension pointing to a local directory, forms a very distinctive chain. That sequence already justifies hunting across endpoint, proxy and EDR telemetry.
On Windows, observing the ScreenConnect Client service alongside a 16-character hexadecimal instance identifier should be cross-checked with PowerShell execution and downloads from the published domains. The artifact C:\Docstar\zlibai.dll and the presence of C:\Docstar\VmLauncher.exe are useful post-exploitation markers. If there is evidence of C:\Backup11\ptpt.zip or C:\chrome\manifest.json, the team is no longer looking at browser noise, but at an intrusion chain with persistent components.
In Chrome, the defensive key is detecting side-loaded extensions. The chrome.exe --load-extension=C:\chrome command, combined with deletion of HKCU\Software\Google\Chrome\PreferenceMACs\Default\extensions.settings, points to integrity-control evasion and deliberate manipulation. The DOM identifiers published by Unit 42, such as _ext_injected_overlay_wrapper_id, _ext_injected_style_id and extbtn_submit, are also useful for hunting in memory, DOM and browser artifacts.
The command-and-control logic deserves specific attention. The extension pulls a plain-text file to resolve the WebSocket and then keeps periodic pings going. That dependence on a configuration file makes it sensitive to blocklists and to detection through requests to paths like /pt.txt or /w.txt. The WebSocket channel and the commands for screenshots, cookies and HTML injection should also be treated as high-risk behavior when they appear alongside storage, tabs, webNavigation, scripting, activeTab and cookies permissions.
On the Delphi side, the XOR routine with a 150-byte table and the use of a signed executable to load a DLL with decoy exports are signs of packing and obfuscation. It is not necessary to know the exact decrypted command content to detect the chain. The combination of a legitimate installer utility, a DLL that imitates zlib and a loader that hides its window is enough to trigger manual investigation.
The secondary regional coverage adds a preventive vector earlier in the timeline. If the phishing email contains invoices, demands or alleged court procedures, and also includes the recipient’s email in the body, personalization is more likely. That personalization should be correlated with Outlook telemetry, creation of the .Outlook file in %APPDATA% and any unencrypted data transmission, because in that block the timeline can differ from the intrusion described by Unit 42.
Frequently asked questions
What is the practical difference between the August regional campaign and the activity analyzed by Unit 42?
The August regional campaign, according to secondary coverage, used invoice and demand lures and reportedly collected Outlook data before triggering banking logic. The Unit 42 activity focused on phishing, abused remote access, Delphi side-loading and a Chromium extension with WebSocket. The relationship between the two is not confirmed.
Which part of the report is most useful for endpoint hunting?
The sequence of remote service, PowerShell, chrome.exe --load-extension=C:\chrome and the paths C:\Docstar\zlibai.dll or C:\chrome\manifest.json is the most useful for hunting. That combination crosses the Attack chain and TTPs and Technical indicators sections, and it allows teams to look for persistence, side-loading and a store-bypassing extension.
Why doesn’t the panel equal confirmed victims?
Because Unit 42 makes clear that the list of 65 banking portals, 11 exchanges and webmail services is an observed technical scope in the panel, not a victim count. That distinction should be read together with the Context and background section and the Regional impact table, where target selection does not translate into confirmed compromise.
What role do browser indicators play versus network indicators?
Network indicators, such as 216.203.21[.]119 or the domains n1.youconnectedssl[.]digital and euromasterx[.]com, help detect C2 and delivery. Browser indicators, such as _ext_injected_overlay_wrapper_id or extbtn_submit, help find the injection layer in the DOM. Both complement each other and cross the TTPs and Technical indicators sections.
Which countries can be mentioned with the most certainty in the material?
With certainty, the main material links Portuguese and Brazilian banking targets inside the panel, but it does not confirm national victims. Secondary coverage mentions Argentina, Peru, Colombia and Mexico as target countries in the August regional campaign. Brazil and Mexico appear in different sections, with different verification levels, so they should be kept separate.
Material limitations
Unit 42’s main source allows for a detailed reconstruction of the second activity line, but it does not confirm an operational link to the August regional campaign described by secondary media. That relationship should be treated as unverified.
There is also no confirmation of specific victims by country in the operation analyzed by Unit 42. The panel showed Portuguese and Brazilian banking targets, 11 cryptocurrency exchanges and webmail providers, but that does not equal confirmed compromise. The source also makes clear that it does not assert an intrusion in Brazil or explicitly mention Colombia.
The August data about Argentina, Peru, Colombia and Mexico comes from secondary coverage with lowered confidence. It helps contextualize a possible regional scope for the campaign, but not to assert specific victims without cross-checking with independent telemetry.
Finally, the material does not provide full details on the initial stage of the regional campaign beyond the document lures, Outlook collection and the .Outlook marker. Not all files, payload variants or a demonstrated technical correlation with the operation observed by Unit 42 were published.
Sources
- Casbaneiro Banking Trojan Delays Main C2 Activity Until Victims Visit Banking Sitesmallory.ai· Mallory
- Casbaneiro Banking Trojan Uses Fake 403 Responses and Distributed Servers to Evade Detectioncyberpress.org· CyberPress
- Latin American firms face silent data theft from Casbaneiro until banking triggerscipherinsider.com· CipherInsider
- Casbaneiro Malware Hides C2 Activity Until Victims Visit Banking Websitescybersecuritynews.com· CybersecurityNews
- Casbaneiro Malware Hides C2 Activity Until Victims Visit Banking Websitescybersecuritynews.com· CybersecurityNews
- Casbaneiro Banking Trojan Paired With Malicious Chromium Extension and Delivered via Abused Remote Access Toolinggithub.com· Unit 42, Palo Alto Networks
- Casbaneiro Banking Trojan Activates Only When Victims Visit Targeted Bank Websitesgbhackers.com· GBHackers
- Casbaneiro Phishing Targets Latin America and Europe Using Dynamic PDF Luresthehackernews.com· The Hacker News
