New Danabot Windows version appears in the threat landscape after May disruption

DanaBot has resurfaced with a new Windows variant (v669), marking its comeback six months after Operation Endgame disrupted its activity in May, according to Zscaler ThreatLabz. The campaign includes a set of command and control servers and wallet addresses used by its operators, with current C2s listed as 62.60.226[.]146:443, 62.60.226[.]154:443 and 80.64.19[.]39:443.

DanaBot is a multi-stage modular banking Trojan written in Delphi that first appeared in 2018 and operates as a malware-as-a-service model, with crooks paying a subscription to rent it. It initially targeted Australia and Poland, expanding to other countries including Italy, Germany, Austria and Ukraine, and has continued to evolve with campaigns targeting users in Australia, North America and Europe.

In May, an international law enforcement operation, called Operation Endgame, targeted initial access malware used by threat actors to infiltrate systems prior to ransomware deployment, with authorities describing joint actions across multiple countries.