Elastic Security Labs has detailed a Brazilian banking malware operation that uses Ethereum smart contracts as a dead drop resolver, letting its operators rotate infrastructure that law enforcement cannot seize.
The group, tracked as REF9334, has been active since at least May 2025 and lures victims with pages impersonating a dozen Brazilian banks. Its toolkit is called KREMLIN and pairs multi-stage JavaScript loaders and custom C++ installers with a malicious browser extension for Chrome and Edge.
A victim manually runs a JavaScript file disguised as a bank statement, invoice or company document. The loader that follows checks for sandboxes and virtual machines before downloading anything. It then establishes persistence through a scheduled task, pulls payload locations from the smart contract, and fetches a browser-extension installer, a .NET PE injector and a copy of a legitimate SentinelOne binary.
That last piece is the clever part. The C++ installer abuses the signed SentinelOne executable to sideload an unsigned payload masquerading as a SentinelOne DLL, which repeats the sandbox checks by counting CPUs and RAM. If the machine looks like an analysis rig, it exits.
The extension installs by manipulating Chrome’s Secure Preferences file and regenerating the HMACs and App-Bound encrypted hashes that Chromium uses to validate extensions, a documented bypass the APT31 group also used in a late-August campaign. Once resident, it uploads cookies, session storage, tab lists, screenshots and page HTML over WebSocket, and polls commands through requests disguised as CSS file fetches.
Elastic registered the campaign’s network canary domain and counted 1,515 infected systems checking in, more than 98 percent of them in Brazil.
