Ousaban Deploys Daily Rotating C2 via Google Date Parsing After Steganographic PDF Lures Hit 25 Iberian Banks

The campaign begins with phishing PDFs that either prompt an 'Atualizar' click or auto-open a tax-portal page performing IP, language, timezone and anti-VM checks server-side. Successful visitors receive an image hiding a ZIP; the dropper extracts Ousaban, deletes traces, and installs persistence under the Financeiro registry key. Command infrastructure pulls a Pastebin link as decoy then resolves the real server by hashing the current date from a Google page plus a hardcoded secret, rotating daily.

This matches the Tetrade cluster documented by Kaspersky in 2019-2022, where Ousaban shares custom string encryption with Casbaneiro and loader patterns with Grandoreiro. The same infrastructure appeared in late-2025 ClickFix campaigns; Grandoreiro's survival after the January 2024 Interpol operation shows the group's operational resilience when operators simply migrate loaders rather than rebuild cores.

Fortinet's coverage correctly describes the steganography and country gating but understates the infrastructure agility and code reuse across families. No public technical attribution ties the actors to any state; the pattern is consistent with Brazilian financially motivated groups expanding from domestic targets since 2018.

Expect continued Iberian focus with incremental loader changes; the daily C2 rotation defeats simple blocklists and will likely persist until the Google page or Pastebin fallback is disrupted.