The Grandoreiro banking Trojan continues to pose a significant threat to banking customers, primarily in Latin America, more than two years after law enforcement disrupted its operations.

The latest evidence is a new campaign using the 12-year-old payload that’s targeting users in Mexico. The operators are using DLL sideloading and a legitimate file-management application to deliver the malware.

Telemetry from the campaign that security vendor Acronis analyzed showed a handful of victims in North America and Europe as well. But “the overall distribution continues to reflect the malware’s long-standing focus on Spanish-speaking regions,” Acronis said in a report this week.