Grandoreiro after the 2024 operation: evidence from three vendors

The arrest of administrators and the disappearance of a malware family are different events. Grandoreiro illustrates that distinction through a January 2024 operation and subsequent publications by three vendors. This note synthesizes those documents: it is neither original sample analysis nor confirmation of activity on the day it is read.

What the Windows / PoS front includes

The September 17, 2026 snapshot used in this article includes 24 Windows families and, in specific cases, PoS/ATM malware. It covers Grandoreiro, Mekotio (Melcoz), Casbaneiro (Metamorfo), Guildma (Astaroth), Javali (Ousaban), Mispadu (URSA) and Prilex. Dataset aliases are retained to connect publications using different names, not to merge operations automatically.

Blind Eagle (APT-C-36) appears because of the payloads it uses, but it is a threat group, not a family. That distinction must accompany any reading of this front: an editorial category does not make all its entries equivalent.

The September 29 update records 28 of 67 families in the Windows / PoS front. It does not replace the snapshot of 24 used above. To interpret both, see country coverage and its documentary limits.

Tetrade does not prove a common operator

The Kaspersky report of July 14, 2020 groups Guildma, Javali, Melcoz and Grandoreiro under Tetrade. It describes distinct families, shared techniques and an affiliate ecosystem. For Grandoreiro, it identifies a malware-as-a-service model involving multiple operators.

CTI LATAM’s interpretation is that Tetrade helps organize historical literature; the name alone does not prove common responsibility for two incidents. Similar lures or techniques are not enough to join them either.

What INTERPOL reported about the arrests

The March 18, 2024 statement reports five administrators arrested in Brazil in January. It cites cooperation from Trend Micro, Kaspersky, Group-IB and Scitum. It estimates more than 3.5 million euros defrauded and attributes to CaixaBank more than 110 million in potential failed attempts.

These figures are not interchangeable: failed attempts must not be added to completed fraud. The statement documents action against an operation, not the eradication of every variant.

What was documented after the operation

• Kaspersky, October 22, 2024: describes remaining operators and new versions, listing 1,700 banks, 276 crypto wallets and 45 countries or territories as targets. Its January–October 2024 telemetry highlights Mexico, Brazil, Spain and Argentina. An institution’s presence in configuration does not prove it was attacked.
• IBM X-Force: documents campaigns since March 2024, including institutional impersonation in Mexico, Argentina and South Africa. This is another set of observed campaigns, not a numerical continuation of Kaspersky’s telemetry.
• ESET, June 25, 2025: analyzes emails impersonating AFIP that deliver Grandoreiro through a ZIP containing VBS. The publication also mentions 2025 waves in Spain, Argentina and Mexico.

The conclusion is bounded by that timeline: activity was documented after the arrests. These reports do not establish that the same operators maintain the same infrastructure today or that every listed target became a victim.

Taking this reading into the SOC

As an analytical recommendation, correlate the email lure, web access and endpoint execution within the incident under investigation. The ESET case provides one chain example; it should not become a universal pattern imposed on every variant.

• Record family, alias, source and period before comparing alerts. A shared name does not resolve attribution by itself.
• Separate target configuration, vendor detections and losses associated with the operation. They answer different questions and use different units.
• Before joining incidents under Tetrade, request specific evidence involving code, infrastructure or lures. An editorial comparison is not a proven operational relationship.

Version note: the figures in this analysis reflect the dataset cut-off in effect at the time of publication; the Atlas is updated continuously.