Grandoreiro DLL Side-Loading with WebRTC/STUN C2 and Google Cloud Pub/Sub Connections

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•1

Detects Grandoreiro banking trojan activity by identifying the loading of specific DLLs (e.g., mingwm10.dll, libwebp.dll, libffi-6.dll) from non-standard or user-writable directory paths, which is characteristic of the Grandoreiro DLL side-loading technique.