{
  "name": "Analysis of Ongoing Ousaban Attacks Targeting the Iberian Peninsula",
  "slug": "analysis-of-ongoing-ousaban-attacks-targeting-the-iberian-peninsula",
  "description": "In May 2026, an attack campaign targeting banking users in Spain and Portugal was identified involving the Ousaban banking Trojan. The malware, previously active in Brazil, spreads through phishing PDFs that redirect victims to malicious webpages performing environment checks to ensure targets are located in Spain or Portugal. The attack chain involves VBS scripts downloading steganographic images containing the payload, which is then dropped and executed on victims' systems. Ousaban establishes persistence, monitors banking activity across multiple financial institutions, and uses daily-changing DDNS domains to resolve C2 server addresses. The malware employs screenshot capture, keylogging, clipboard injection, and remote control capabilities to steal banking credentials. It utilizes custom encryption algorithms and geofencing techniques to evade detection and limit exposure to intended targets.",
  "published": "2026-07-01T21:35:11.459000+00:00",
  "created_at": "2026-07-02T07:13:58.370000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-07-02T07:13:58.370000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "banking trojan",
    "casbaneiro",
    "credential theft",
    "geofencing",
    "iberian peninsula",
    "ousaban",
    "phishing",
    "portugal",
    "spain"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "a27647b3-bdb3-41a9-ac97-5d4936c58151",
        "name": "4c9fdc2823da505ef339d43c6ad38499b7e3447736733e42b5ab6b1afcfd42aa"
      },
      {
        "id": "56e330c5-e4fb-480b-b364-85a89845a4eb",
        "name": "18fd38988d58dd930f5992d448cc09a9400c1eafba76b820b9a83239ac48cf4e"
      },
      {
        "id": "0b66fa0f-7636-4ca2-9c25-e609ec27f4b1",
        "name": "65c1a998bac48e02b52b1c850cd500e9fb87521e21755c3a4a491243f5f9a700"
      },
      {
        "id": "9aef666e-72e5-44c8-967c-d0d0cd7ca5d1",
        "name": "48723a33bab89f174750576f9a62da35b3b9e5ac31a5a8f1ce9859a1b35bf8b8"
      },
      {
        "id": "e4712904-0d0d-4757-a097-f23069c3d2a9",
        "name": "fadbb8061715128bebecf7bc59132b6bb04fe8cc39b965aa5b8722dffe28d7e7"
      },
      {
        "id": "a415f33f-c4bc-46b1-973a-6f6de56e62ec",
        "name": "19ac18a50abb48dc0ea9524850acfaec49359e6b3bcc67c6193c2d56da812c71"
      },
      {
        "id": "d082f568-70f4-4efd-ae0e-eefdbe79ec7f",
        "name": "6bc2e11b0917f47d0557288c4f0cb20bd7589185943b989a969fdc6d3704ee73"
      },
      {
        "id": "b1bc5f5b-1e8d-4113-b890-2db2e57ea902",
        "name": "78.40.209.32"
      },
      {
        "id": "c5ac6d63-2136-422f-81e4-2fdc7de1c287",
        "name": "d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3"
      },
      {
        "id": "cacbe376-203b-4c79-9e2e-08a5367a8289",
        "name": "ffb9eb47cc0cb2f43e04a10dc84df13d04bca1ebacbe47fad0b669728de2f59c"
      },
      {
        "id": "0744dfc3-693a-497b-b2a5-53b7c110614c",
        "name": "21b24f7ee1f6bdbbb670f0394d66009ee0daa8ced57048298da715e88f7a7cdd"
      },
      {
        "id": "d53f9f14-1678-4dd5-ba5c-a064e3f189a9",
        "name": "213.159.64.191"
      },
      {
        "id": "87811985-d4f8-4ce7-9456-37d918b0d138",
        "name": "facture-arsys.duckdns.org"
      },
      {
        "id": "7f9f366d-2620-415a-93ec-ec943e28939a",
        "name": "5837e47198a20877e1b04b270c36d9194206ee38d4f32fe3151b3c3b396c4f0d"
      },
      {
        "id": "778b1c3e-7424-4c0f-b911-df3b9e56d190",
        "name": "540ee1936e61d2344b5ebc93485589a351ec2f113a9b4940ae16f3baa4807392"
      },
      {
        "id": "84a3517c-7993-4917-9c11-41c7096b7b4b",
        "name": "9d07a83cf89685651ea8992047ae694c24f6ddef193044357debd15ce07a64fe"
      },
      {
        "id": "5fda4933-4e25-4716-9e13-1c400a24424c",
        "name": "faturanova.duckdns.org"
      },
      {
        "id": "b67ed4fa-5b34-4bb9-900d-396683af0f63",
        "name": "faturanova.xyz"
      },
      {
        "id": "5716bb45-f566-4f50-88d8-c2ea1adf5380",
        "name": "9e81ade09cc18f0fc09d73e72d2e0bffad02f52fdcc26553e473cee8cabc1567"
      },
      {
        "id": "f6123267-17c7-44f9-b847-f5d6a88bdd8c",
        "name": "e2f0c2d4c1552cd81fa012043e4a5ac832582b639b7b6b7eccc0c4802d7a8ad8"
      },
      {
        "id": "a6dbdb70-689c-4a9c-a031-75952af5d517",
        "name": "91.92.240.140"
      },
      {
        "id": "e23d50da-8b2a-4030-841d-e56c7baa8284",
        "name": "5a2ed557c357ba8f96f2d55a8a00695987806b5df766cd1dfdab0cbed111774a"
      },
      {
        "id": "7594e242-8913-440c-897a-230ec4a87d4a",
        "name": "controlfacturas.site"
      },
      {
        "id": "93bd21a9-af31-4721-a1e5-fcef7b06b992",
        "name": "4ca2c863d740bb7022776dccabd8ae34bb9998768928042d76ebcf08984eefcb"
      },
      {
        "id": "8b45c290-f80c-4121-a87d-489de4c55f01",
        "name": "e6e78eb2e9bd41a4bc62f7ad54d095ea9813864bebe37172ae30a1afa631fe14"
      },
      {
        "id": "bc203981-2f17-4ac3-a2e1-25a00e96bffe",
        "name": "5e06af187b45476ade0d953e834fced6197d0a33ac60c2575877660e26ab15e8"
      },
      {
        "id": "da44feba-bfa9-4e9b-a2d0-8041bd29e218",
        "name": "1e77992666acbbfa0d01fcefa9cc8fbdac291e0681b35745be27c6dfb159a375"
      },
      {
        "id": "b0244582-721e-45af-8ab0-ddb9cda0386a",
        "name": "162.33.179.46"
      }
    ],
    "attack_patterns": [
      {
        "id": "16e4fc82-7c0b-4d1a-b784-b804b4df26dc",
        "name": "T1204.001"
      },
      {
        "id": "5c67e5d2-bc85-4ce0-822d-f2f5d3b0ae4e",
        "name": "T1185"
      },
      {
        "id": "eaff4611-3c78-4127-8745-726f77ed68ba",
        "name": "T1070.004"
      },
      {
        "id": "667462db-9031-48eb-893a-05d35f9330a7",
        "name": "T1056.001"
      },
      {
        "id": "840f859f-575f-487e-8083-6ffd01a13a84",
        "name": "T1218.007"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "9e784d22-5a6c-4da6-968a-5fab2f019efd",
        "name": "T1059.005"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "c998d878-b668-40dd-a84c-9ca7f73caaa4",
        "name": "T1497.003"
      },
      {
        "id": "05ac27d4-58d0-44b2-a984-cd5aefd1f7f9",
        "name": "T1497.001"
      },
      {
        "id": "14660ccf-ca6b-42f6-8bca-e1b7a04650b3",
        "name": "T1573.001"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "f4a450ef-8297-42e5-9e47-01162138baa2",
        "name": "T1115"
      },
      {
        "id": "64e548d5-24de-4894-9c90-c6e17b3b3bee",
        "name": "T1056.002"
      }
    ],
    "malware": [
      {
        "id": "a9eb670d-b404-47d4-bbd9-0db7bd172d30",
        "name": "Ousaban",
        "slug": "ousaban"
      },
      {
        "id": "2c7c2d45-9960-44d5-a9d1-fbe79105b8d3",
        "name": "Metamorfo - S0455",
        "slug": "metamorfo-s0455"
      },
      {
        "id": "fd90682a-2083-4dce-9321-727313b86232",
        "name": "Casbaneiro",
        "slug": "casbaneiro"
      }
    ],
    "observables": [
      {
        "id": "a867c4e7-d204-4ade-a6e5-ee29ad66a713",
        "name": "faturanova.xyz"
      },
      {
        "id": "2ea77607-6205-4b18-8e1a-8ffba79f0b55",
        "name": "controlfacturas.site"
      },
      {
        "id": "f639f521-d939-4caa-b822-5e305389316a",
        "name": "facture-arsys.duckdns.org"
      },
      {
        "id": "c0da450b-7e4b-45e2-ae2b-136c49542260",
        "name": "faturanova.duckdns.org"
      },
      {
        "id": "e43c6a31-0203-4ac3-81b7-4a2e969006a8",
        "name": "162.33.179.46"
      },
      {
        "id": "1d3723d7-54f6-4e20-adff-4e0db18badc1",
        "name": "213.159.64.191"
      },
      {
        "id": "a650c997-b5f6-442b-b16c-e50a5d923b02",
        "name": "91.92.240.140"
      },
      {
        "id": "4df4febf-1291-4cfa-a7d2-c9cf4915c447",
        "name": "78.40.209.32"
      }
    ]
  },
  "external_refs": [
    {
      "id": "a8de90a8-a028-4dd6-904a-ac76d49fb8a4",
      "standard_id": "external-reference--8232499a-945f-5f22-8c0a-c969a0167f40",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.fortinet.com/blog/threat-research/analysis-of-ongoing-ousaban-attacks-targeting-the-iberian-peninsula",
      "hash": null,
      "external_id": null,
      "created": "2026-07-02T07:13:51.044Z",
      "modified": "2026-07-02T07:13:51.044Z",
      "createdById": null
    },
    {
      "id": "4f0c61ce-ce81-45a2-b34a-5e39671ac68e",
      "standard_id": "external-reference--9e5aed7a-b390-5a3b-9af6-458ffeaa7463",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a45880f3df872860c77a553",
      "hash": null,
      "external_id": "6a45880f3df872860c77a553",
      "created": "2026-07-02T07:13:51.012Z",
      "modified": "2026-07-02T07:13:51.012Z",
      "createdById": null
    }
  ]
}