KREMLIN: Bank malware campaign uses Etheum as dead drops to locate payloads in Brazil

Elastic Security Labs researchers have documented a bank malware operation that has not been publicly described so far and that uses a set of tools called KREMLIN. According to the report shared by researchers Cyril François and Andrew Pease and collected by specialized means, the campaign - traced by Elastic as REF9334 - has been active since at least May 2025 and uses decals aimed at customers in multiple Brazilian banks to induce the victim to run a malicious JavaScript file that triggers a load chain in several stages.

In technical terms, the attack starts when the user manually runs a JavaScript file that is presented as a bank document, invoice or corporate file. This JavaScript loader applies environment checks (sandbox / VM detection based on running processes and hardware properties) and only continues if the system seems real. The second stage creates persistence through a scheduled task, consults an intelligent contract on Etheum to get download locations controlled by the actor and downloads several binaries: a malicious browser extension installer (add-on ZIP), a .NET injector and a legitimate executable associated with SentinelOne (SentinelMemoryScanner.exe) that is abused to perform sideloading of an unsigned DLL that is passed by Sentinel AgentCore.dll. The malicious DLL repeats the anti-sandbox checks and, if you pass those tests, continue the installation of the active payload and extension.

A distinctive and confirmed feature of the researchers is the use of intelligent Etheum contracts such as "dead drops" or dynamic resolution: the block chain stores references that allow the attacker to update, without the need for traditional exposed servers, domains and payloads locations. Elastic indicates that the transition from the group to this technique took place on 19 May 2026. Using the lockchain in this way complicates the infrastructure's downsizing because the contracts and their transactions remain in the chain and do not depend on a centralized server that is easy to disconnect.

The malicious extension - reported with the name "AVSync System Inc." and the identifier "ndpbidppejfanjbhfgjlohffbklff" - is installed in Chromium (Chrome and Edge) browsers by means of a integrity evasion technique called Phantom Extension / GhostChrome-X: the malware manipulates the Secure Preferences file from the browser profile, forges HMAC entries and activates the developer mode to record the extension without passing through the official store. After the installation you request extensive permissions (tabs, cookies, storage, webRequest) and set up a WebSocket channel with a command and control server (C2) identified as luizestrothashapr [.] online: 443.

Once operational, the extension can run orders received by WebSocket: take and upload catches from the active tab, list tabs and domains, exfilter cookies and sessionStorage / localStorage, download HTML controlled by the attacker and update its configuration. It also implements an alternative method of polling disguised as requests to CSS files (such as / google _ api / 108766d0.css) that map to specific commands (upload cookies, catches, history, redirection rules, etc.). Elastic points out that the extension tries to extract up to 1,000 history entries from the last 15 days, although that probably fails because the extension manifesto does not include "history" permission.

As part of its anti-analysis checks, KREMLIN performs a "network canary": it tries to download a page from an unregistered domain. If the request returns a valid response (which usually indicates a simulated environment that responds to all connections), malware causes its own crash. Elastic recorded that canarian domain and reported having identified 1,515 infected systems trying to contact him; more than 98% were geolocalized in Brazil. Elastic believes that this record has allowed the actor's defenses to be temporarily degraded and to gain time for the mediation of affected devices.

Facts confirmed in the research: Elastic Security Labs has attributed the activity to REF9334 and has published technical analyses; KREMLIN uses JavaScript multi-stage loaders, C + + installers and Chromium extensions; the actor uses Etheum contracts to solve C2 and payload locations; the extension and associated domains (e.g., volmire [.] site, zaviro [.] online and luizestrothashapr [.]) are mentioned as infrastructure components. Information that remains as an estimate or open: the ultimate motivation of the actor (although the vector points to bank fraud and theft of credentials), the complete list of victims and the final economic scope of the intrusions.

Who does this affect? Confirmed: users and organizations in Brazil have been the main targets, especially people who interact with online banking. It is plausible that corporate customers connected to financial portals or billing systems are also at risk, as lures imitate invoices and business documents. The use of malicious extensions allows the attacker to get session tokens and cookies that can facilitate session supplanting and fraud without the need for flat text credentials.

Possible real consequences: session credentials and tokens theft, bank account control, financial fraud, corporate information theft, lateral movement if credentials allow access to domestic remedies. The operation of the sideloading mechanism by means of a legitimate binary (SentinelOne) also complicates your detection, because the process that launches the DLL can be seen as a legitimate security executable.

Specific and verifiable measures to be taken by readers: for domestic users, check the extensions installed in chrome: / / extensions (or edge: / / extensions), remove any unknown extensions or with excessive permissions, disable the developer mode and not install extensions outside the official store. Change financial service passwords and activate multi-factor authentication (MFA) if not active. Run analysis with updated anti-malware tools and, on suspicion of engagement, consider reinstalling the system or professional support.

For IT and SOC equipment, apply specific detections: look for unusual scheduled tasks, SeninelMemoryScanner.exe child processes that load unsigned DLs, outgoing connections to the aforementioned domains and WebSocket channels to 443 ports with unusual traffic patterns. Block in the perimeters the identified domains and any associated URL; deploy group policies to restrict the installation of extensions (force white list or install only from the Chrome Web Store and disable the developer mode) and monitor changes to the Secure Preferences file of Chromium profiles. Elastic recommends and shows that recording the network canary allowed to detect infected equipment; similarly, the defenses can establish lures and DNS sinkholes to detect calls to the attacker's infrastructure.

To expand the context and consult technical resources on these techniques, the Elastic Security Lab page and official documentation on Chromium extensions are available: https: / / securitylab.elastic.co, https: / / developer.chrome.com / docs / extensions /. To understand the use of smart contracts as a resolution mechanism, the official Etheum website provides general information on contracts and their immutability: https: / / ethereum.org.

In short: KREMLIN combines social engineering (bank lures), robust evasion (anti-sandbox, sideloading), abuse of legitimate components and a new use of the blockchain to make its infrastructure dynamic and resilient. Mitigation measures require both end-user actions (review and clearance of extensions and credentials) and coordinated security responses by issuing domain blocks, extension policies and forensic searches in endpoints and networks.