Banking Trojan Techniques: How Financially Motivated Malware Became Infrastructure
Summary: Unit 42 describes how banking Trojan families including Zeus, Kronos, Trickbot, IcedID, Emotet and Dridex use techniques such as webinjects, Heaven's Gate, process hollowing and AtomBombing to evade detection and steal data. The report notes that some of these Trojans are now primarily used as infrastructure to deliver other malware, so blocking their techniques also stops other threat types.
Bottom line: The same injection and hooking methods these families built for financial theft now serve as delivery infrastructure for other malware, so a control gap that lets a banking Trojan through is a gap an unrelated actor can use against you.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026