{
  "family": "tinukebot",
  "sample_count": 5,
  "category": "trojan",
  "description": "Trojan:Win32/Tinukebot (widely known as **TinyNuke** or Nuclear Bot) is a sophisticated, commercially sold banking trojan and botnet framework. Its primary objective is to facilitate severe financial fraud by stealing banking credentials, bypassing Multi-Factor Authentication (MFA), and allowing attackers to initiate unauthorized wire transfers directly from the victim's compromised machine. Its source code was leaked in 2017, leading to numerous highly customized, dangerous variants.<br><br><b>Understanding TinyNuke (Banking Trojans)</b><br>To a victim, a TinyNuke infection is invisible until money is missing from their accounts. For a financial institution, it represents a critical threat capable of defeating standard anti-fraud measures. TinyNuke specializes in Man-in-the-Browser (MitB) attacks and Hidden VNC (hVNC) sessions, allowing the attacker to interact with the victim's bank session while the victim is actively logged in, bypassing IP and device fingerprinting checks.<br><br><b>Execution and Web Injection Mechanics</b><br>TinyNuke is typically distributed via targeted malspam (`T1566.001`) or dropped by other loaders. Upon execution, it achieves persistence (`T1547.001`) and heavily utilizes API hooking and process injection (`T1055`) to embed itself into web browsers (Chrome, Firefox, IE). When the victim navigates to a targeted banking URL, TinyNuke uses 'Web Injects' (`T1185`) to dynamically alter the HTML/JavaScript of the bank's page before it renders on the screen. It can present fake login fields asking for Social Security numbers or ATM PINs, capturing the data and sending it to the C2 server. Furthermore, its hVNC capability (`T1071.001`) allows the attacker to open a hidden, secondary desktop session on the victim's machine to execute fraudulent transactions using the victim's already-authenticated browser session.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is direct, massive financial theft. Host-based IoCs include EDR alerts for known banking trojan signatures, suspicious DLLs injected into browser processes (`chrome.exe`, `firefox.exe`), and unexpected outbound network connections from those browsers to known malicious C2 panels. Network IoCs include the downloading of 'web inject' configuration files from the C2 infrastructure.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1185",
    "T1055",
    "T1071.001",
    "T1555.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Man-in-the-Browser / Web Injects)",
      "tactic": "Collection"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Hooking browser APIs)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (hVNC communication)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to sever the hVNC connection and prevent the attacker from initiating fraudulent transactions.",
    "Contact the victim's financial institutions immediately to freeze accounts and alert them to the high probability of a Man-in-the-Browser compromise.",
    "Assume all web credentials stored on or entered into the machine have been stolen, and mandate enterprise-wide password resets.",
    "Conduct memory forensics to extract the TinyNuke web inject configuration file, which will reveal the exact list of financial institutions targeted by the threat actor."
  ],
  "what_to_avoid": [
    "Do not rely on standard MFA (like SMS codes) to protect accounts if TinyNuke is suspected, as the attacker is operating *from* the authenticated session.",
    "Avoid simply running an AV scan and leaving the machine online; banking trojans require a complete wipe and reimage to ensure the deep API hooks are removed."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}