Actor Profile

REF9334 is a Brazilian threat actor tracked by Elastic Security Labs, active since at least May 2025. The actor specializes in banking fraud operations targeting Brazilian financial institutions through sophisticated malware delivery campaigns. REF9334 demonstrates advanced technical capabilities including blockchain-based infrastructure obfuscation, browser integrity bypass techniques, and multi-stage malware deployment. The actor's motivation is financially driven, focusing on credential theft and session hijacking to facilitate unauthorized access to banking systems. REF9334 has also been observed distributing commodity remote access trojans including Pulsar RAT and Remcos RAT alongside their custom KREMLIN toolkit.

TTPs (Tactics, Techniques, Procedures)

REF9334 employs sophisticated multi-stage infection chains beginning with JavaScript loaders masquerading as banking documents (T1204.002 - User Execution: Malicious File). The actor establishes persistence via scheduled tasks (T1053.005 - Scheduled Task/Job) and leverages DLL side-loading against legitimate SentinelOne binaries (T1574.002 - Hijack Execution Flow: DLL Side-Loading). Defense evasion is achieved through sandbox and VM detection checks examining CPU count and RAM capacity (T1497 - Virtualization/Sandbox Evasion), and by abusing browser integrity mechanisms using Phantom Extension and GhostChrome-X techniques to install malicious Chrome/Edge extensions. C2 infrastructure is obfuscated using Ethereum smart contracts as dead drop resolvers (T1102 - Web Service), dynamically updating C2 endpoints and payload locations. The KREMLIN extension harvests credentials, session tokens, cookies, localStorage, and sessionStorage (T1539 - Steal Web Session Cookie, T1555.003 - Credentials from Web Browsers), captures screenshots (T1113 - Screen Capture), and exfiltrates data via WebSocket channels and HTTP requests disguised as CSS file fetches (T1041 - Exfiltration Over C2 Channel).

Targets & Patterns

REF9334 exclusively targets the Brazilian financial services and banking sector. The actor uses social engineering lures impersonating at least a dozen Brazilian banks to trick victims into executing malicious JavaScript files disguised as banking documents, invoices, or company files. This geographic and sectoral focus indicates deep familiarity with the Brazilian banking ecosystem and Portuguese-language social engineering tactics. The targeting pattern suggests the actor seeks high-value financial data including online banking credentials, session tokens, and transaction details to enable fraudulent transfers or account takeovers. The use of browser extensions specifically designed to intercept banking sessions demonstrates intent to bypass multi-factor authentication and perform real-time transaction manipulation.

Historical Context

REF9334 has been active since at least May 2025, representing a 16-month operational timeline as of the September 2026 reporting date. The actor's use of browser integrity bypass techniques mirrors tactics employed by China-linked APT31 in late August 2026, which leveraged the BlueMoon exploit kit and similar extension installation methods to deploy the GemStone credential stealer. This suggests cross-pollination of techniques between APT and cybercrime ecosystems. REF9334's distribution of commodity RATs (Pulsar RAT and Remcos RAT) alongside custom tooling indicates operational flexibility and potential evolution from simpler crimeware operations to more sophisticated custom malware development. The KREMLIN toolkit represents a significant advancement in Brazilian banking malware capabilities, incorporating blockchain-based infrastructure resilience previously uncommon in regional cybercrime operations.

Defensive Recommendations

  • Monitor for suspicious scheduled task creation (T1053.005) targeting browser directories or persistence mechanisms, particularly tasks executing JavaScript or PowerShell with obfuscated parameters
  • Detect DLL side-loading attempts against legitimate security software binaries like SentinelOne components by monitoring for unsigned DLLs loaded from non-standard directories (T1574.002)
  • Implement behavioral detection for modifications to Chromium Secure Preferences files and unexpected changes to browser extension manifests, particularly enabling developer mode or altering protection.macs HMAC values
  • Block or alert on WebSocket connections from browser processes to non-standard domains, and monitor for HTTP requests with CSS file extensions (.css) that exhibit POST behavior or carry non-CSS payloads (T1041)
  • Deploy network monitoring to detect Ethereum smart contract queries from endpoint systems, particularly repeated calls to blockchain APIs that may indicate dead drop resolver activity (T1102)

---

# Geopolitical Context

Geopolitical Context

The KREMLIN malware campaign represents a continuation of Brazil's position as a significant source of financially motivated cybercrime, particularly banking trojans targeting domestic financial institutions. Brazilian threat actors have historically demonstrated technical sophistication in credential theft and session hijacking operations, with campaigns typically focused on Portuguese-speaking markets in Latin America. The use of blockchain-based infrastructure (Ethereum smart contracts as dead drop resolvers) reflects an evolution in Brazilian cybercriminal tradecraft, adopting techniques previously associated with state-sponsored actors to achieve operational resilience against takedown efforts. This campaign appears consistent with Brazil's broader cybercrime ecosystem, where organized groups develop custom toolkits for financial fraud rather than relying exclusively on commodity malware. The targeting of a dozen Brazilian banks suggests domestic focus rather than transnational operations, though the technical capabilities demonstrated could enable future expansion to other Portuguese-speaking jurisdictions.

State Actor Alignment

REF9334 appears to be a financially motivated cybercriminal operation rather than state-sponsored activity. No indicators suggest links to Brazilian government entities or intelligence services. The campaign's exclusive focus on banking credential theft, use of commodity remote access trojans (Pulsar RAT, Remcos RAT), and targeting of domestic financial institutions are consistent with organized cybercrime rather than strategic intelligence collection. The adoption of advanced evasion techniques—including the Phantom Extension and GhostChrome-X integrity bypass methods previously observed in China-linked APT31 operations—demonstrates technology transfer between state and criminal actors but does not indicate direct state sponsorship. Brazilian law enforcement agencies, particularly the Federal Police's cybercrime units, would likely view REF9334 as a domestic criminal threat subject to investigation under financial fraud statutes. No international sanctions frameworks currently apply to this actor.

Business Impacty pro region

The KREMLIN campaign's regional impact remains primarily confined to Brazil's financial services sector, with limited immediate spillover to European or North American institutions. However, the technical sophistication demonstrated—particularly blockchain-based C2 infrastructure and Chromium integrity bypasses—may influence cybercriminal tradecraft globally. European financial institutions with Brazilian operations or Portuguese-language services may face elevated risk if REF9334 expands targeting beyond domestic banks. The campaign's use of techniques observed in Chinese APT operations (GemStone extension methodology) highlights continued convergence between state-sponsored and criminal tooling, complicating attribution and defense strategies for Western cybersecurity teams. Latin American financial institutions in Portuguese-speaking markets (Angola, Mozambique, Portugal) represent plausible expansion targets given linguistic and operational similarities. The Ethereum-based dead drop resolver technique may be adopted by other financially motivated groups seeking resilient infrastructure, potentially complicating law enforcement disruption efforts across jurisdictions. Brazilian cooperation with international cybercrime initiatives, including partnerships with Europol and FBI, will be important for containing REF9334's evolution and preventing technology transfer to transnational criminal networks.

Forecast

If REF9334 continues operations without significant law enforcement intervention, the group is likely to refine its browser extension deployment mechanisms and potentially expand targeting to additional financial institutions across Portuguese-speaking markets within the next 6-12 months. The adoption of blockchain-based infrastructure suggests the actors are investing in operational longevity, making traditional takedown approaches less effective. If Brazilian Federal Police prioritize investigation and coordinate with international partners, disruption of key infrastructure and arrests may occur within 12-18 months, though the decentralized C2 architecture will complicate attribution and seizure operations. Should the Chromium integrity bypass techniques employed by KREMLIN become more widely documented in criminal forums, similar campaigns targeting financial institutions in other regions are likely to emerge within 6-9 months. If major Brazilian banks enhance browser extension monitoring and deploy endpoint detection capabilities specifically targeting the observed TTPs, REF9334 may pivot to alternative delivery mechanisms or shift focus to less-defended regional financial institutions. The continued convergence of state-sponsored and criminal techniques suggests that future iterations of Brazilian banking malware will likely incorporate additional advanced evasion methods, requiring enhanced public-private collaboration for effective defense.