Panda Banking Trojan Shifts Focus to Brazil Just in Time for the Rio Olympics

Panda Banker, a banking trojan discovered this past March, has received a massive update that allows it to target Brazilian financial institutions, along with other services.

These Panda samples targeting Brazil were first spotted in July, and according to experts at IBM, for this version, a local cyber-crime gang seems to be involved.

Panda is based on the Zeus v2 banking trojan that leaked online in 2011 and was used in multiple other banking trojan families such as Citadel and ZeusVM.

Panda Banker is your typical Zeus variant

When Panda Banker first appeared, the trojan only targeted financial institutions in U.K., Germany, the Netherlands, Poland, Canada, the U.S. and a few other countries in Europe.

Initial configurations allowed it to use browser Web injects to hijack the portals for online banking portals, bu...

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - Panda Banking Trojan Shifts Focus to Brazil Just in Time for the Rio Olympics
id: 18a35cd1-89d9-45b5-a3f0-7c414dfc3a5f
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "Panda Banking Trojan Shifts Fo" ascii wide
    condition:
        any of them
}