As reported by The Hacker News, Elastic Security Labs has uncovered REF9334, a Brazilian banking malware campaign delivering a toolkit dubbed KREMLIN that has been active since at least May 2025. What makes this operation stand out is not just its targeting of Chromium-based browsers, but the convergence of three techniques that collectively raise the bar for detection and disruption: blockchain-based C2 resiliency, abuse of legitimate EDR binaries for DLL sideloading, and direct manipulation of Chromium's integrity mechanisms to persist malicious extensions.

Threat Alert: As reported by The Hacker News, Elastic Security Labs has uncovered REF9334, a Brazilian banking malware campaign delivering a toolkit dubbed KREMLIN that has been active since at least May 2025.

Why This Matters Beyond Brazilian Banking

While the lures are tailored to Brazilian financial institutions, the architectural choices in KREMLIN have global implications. The use of Ethereum smart contracts as dead drop resolvers is particularly significant. By encoding C2 endpoints and payload hosting locations on-chain, the threat actor creates a takedown-resistant infrastructure that cannot be neutralized through traditional domain seizure or hosting provider cooperation. This is a technique we expect to proliferate across cybercrime ecosystems beyond Latin America.

The combination of on-chain C2 resolution and Chromium integrity bypass represents a shift from opportunistic banking trojans to resilient, modular credential theft platforms.

The Chromium Integrity Bypass Is the Headline

The most technically concerning aspect is the malware's ability to bypass Chromium's Secure Preferences integrity model. Chromium uses HMAC-signed preference files and App-Bound encrypted hashes specifically to prevent extensions from being silently installed or modified. KREMLIN's ability to regenerate required HMACs and manipulate these protections means the browser's built-in tamper resistance is insufficient on its own. Any organization relying on Chromium extension policies as a sole control should reconsider that posture immediately.

DLL Sideloading via SentinelOne Binary

The campaign abuses a legitimate SentinelOne binary, SentinelMemoryScanner.exe, to sideload an unsigned payload masquerading as SentinelAgentCore.dll. This is not a vulnerability in SentinelOne's product — it is a living-off-the-land technique that exploits trust in signed security software. Defenders should be aware that EDR vendor binaries are increasingly attractive sideloading targets because they are ubiquitous on endpoints and often whitelisted by application control policies.

Who Is at Risk

The Chromium Integrity Bypass Is the Headline
Financial sector organizations — particularly those with Brazilian operations or customers
Enterprises with permissive browser extension policies — any environment where users can install extensions without administrative approval
Organizations relying solely on signature-based or sandbox-dependent detection — KREMLIN includes VM and sandbox evasion checks (CPU count, RAM thresholds, process enumeration)
Environments where EDR binaries are application-control whitelisted — sideloading abuse can bypass allowlisting

Shield53 Recommendations

  • Enforce strict browser extension policies: Use Chromium's ExtensionInstallBlocklist and ExtensionInstallAllowlist group policies to block all unapproved extensions. Do not rely on Secure Preferences HMAC validation alone.
  • Monitor for Chromium preference tampering: Alert on unexpected modifications to Secure Preferences and Preferences files in Chrome and Edge user profiles, especially outside of normal browser update cycles.
  • Hunt for DLL sideloading patterns: Deploy detection rules for unsigned DLLs loaded by signed security vendor binaries. Monitor for SentinelMemoryScanner.exe loading non-Microsoft DLLs, and extend this logic to other EDR vendor processes.
  • Implement blockchain-aware threat intelligence: Integrate Ethereum smart contract monitoring into threat hunting workflows. Track known REF9334-associated contract addresses and flag any outbound connections to Ethereum RPC endpoints from non-developer workstations.
  • Restrict JavaScript execution from user-writable locations: The initial infection requires manual execution of a JavaScript file. Use application control or Windows Script Host restrictions to prevent wscript.exe and cscript.exe from executing scripts in Downloads, AppData, or Temp directories.
  • Monitor scheduled task creation: KREMLIN establishes persistence via scheduled tasks. Alert on schtasks creation events from unusual parent processes, particularly those originating from script interpreters.
  • Session token rotation post-incident: Because KREMLIN specifically targets session tokens, standard password resets are insufficient. Force full session revocation and token rotation for any confirmed compromise.

The REF9334 campaign demonstrates that banking malware operators are adopting infrastructure resilience techniques once reserved for nation-state actors. The blockchain C2 layer, combined with Chromium integrity bypasses and EDR binary abuse, means defenders can no longer treat browser-based credential theft as a commodity threat solved by basic endpoint controls. This requires layered detection across browser configuration monitoring, DLL load analysis, and emerging on-chain threat intelligence capabilities.