Zeus 2 hits 100,000 UK computers

Zeus has returned in a different guise, hitting around 100,000 UK computers in a targeted botnet attack.

Zeus

A Zeus version 2 botnet has been uncovered for the first time and is controlling over 100,000 computers, a security company has warned.

Of these systems, 98 per cent are located in the UK and the botnet has been acquiring a wide range of information, claimed security firm Trusteer.

The stolen data includes online banking login details, credit and debit card numbers, as well as access information for email accounts and social networks.

Mickey Boodaei, Trusteer's chief executive (CEO), told IT PRO this is not the first time such "regional malware" has been aimed at the UK.

"There are criminal groups who are very focused on the UK market," Boodaei warned.

In terms of how Zeus 2 differs from its infamous predecessor, Boodaei explained the new malware is superior at avoiding anti-virus protection as each Zeus 2 version differs from the next, even if downloaded from the same location.

Around nine in 10 Zeus 2 attacks get through anti-virus software, which is "quite significant," Boodaei said.

"We have seen a very significant shift of criminals from the older versions of Zeus to Zeus version 2," the chief executive added.

Trusteer uncovered how much the Zeus 2 botnet had achieved after managing to gain access to the fraudsters' drop servers and command and control centre.

The security company also managed to view the interface used by the attackers to control the botnet.

This led to further discoveries, notably of a search function that allowed the hackers to easily extract information stored on their database.

The fraudsters could search for details from a specific organisation by simply typing part of the company's URL into the search box and then pick out the login details they were after.

Following the Zeus 2 discovery, Trusteer has been in contact with the relevant authorities in the UK.

"It's at an early stage. We've contacted the police and we are in the process of transferring them all of the information we captured. I believe it is going to take them some time to process this information and do something with it," Boodaei said.

The Zeus Trojan is one of the most prevalent forms of malware and a version was recently discovered in the Mumba botnet, which had infected 55,000 computers and stolen over 60GB of personal data.

Featured Resources

Shining light on new 'cool' cloud technologies and their drawbacks

IONOS Cloud Up! Summit, Cloud Technology Session with Russell Barley

Watch now

Build mobile and web apps faster

Three proven tips to accelerate modern app development

Free download

Reduce the carbon footprint of IT operations up to 88%

A carbon reduction opportunity

Free Download

Comparing serverless and server-based technologies

Determining the total cost of ownership

Free download

Recommended

Hackers could use new Wslink malware in highly targeted cyber attacks
malware

Hackers could use new Wslink malware in highly targeted cyber attacks

1 Nov 2021
FBI raids Chinese POS business following cyber attack claims
malware

FBI raids Chinese POS business following cyber attack claims

27 Oct 2021
Malware developers create malformed code signatures to avoid detection
malware

Malware developers create malformed code signatures to avoid detection

24 Sep 2021
New malware uses search engine ads to target pirate gamers
malware

New malware uses search engine ads to target pirate gamers

21 Jul 2021

Most Popular

What should you really be asking about your remote access software?
Sponsored

What should you really be asking about your remote access software?

17 Nov 2021
What are the pros and cons of AI?
machine learning

What are the pros and cons of AI?

30 Nov 2021
Access brokers are making it easier for ransomware operators to attack businesses
cyber security

Access brokers are making it easier for ransomware operators to attack businesses

1 Dec 2021