IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Inner workings of Citadel malware exposed

Malwarebytes gives blow by blow account of pernicious Trojan’s code and deployment.

Laptop and virus

Anti-malware company Malwarebytes is warning consumers of the dangers around one of the Zeus crimkekit's more recent offspring, Citadel.

The Trojan is used by criminal gangs to either steal or extort money from unwitting users. Infected computers can also be turned into bots' in a botnet and silently used to proliferate the malware.

In a blog post, Malwarebytes analyst Jerome Segura has demonstrated how one of the newer version 1.3.4.5 of the Trojan, is ordered almost like a normal software from crime rings specialising in this type of cyber crime. It also demonstrates how Citadel circumvents most anti-virus programmes by blocking them before it is recognised.

Keylogging and stealing personal details can go on secretly for some time.

Citadel first appeared in January 2012 and can be used in one of two ways. The first and, according to Malwarebytes, most common function is to run silently and invisibly in the background, logging key strokes and capturing images and videos of victims computers. The primary aim of this type of attack is to covertly steal people's bank details and defraud them.

The second, less common method of attack, but one which is of greater concern to the FBI, is an extortion attack, carried out through the deployment of a ransomware known as Reveton. This program locks the computer, posing as an FBI imposed lockdown, and demands a payment in order to make it operational again.

A Malwarebytes spokesperson told IT Pro he believed the FBI was focused on the second element of the Citadel threat as it is more concerned about Reveton in general.

"[Reveton] is abusing [the FBI] brand name to extort money from people. This is obviously very serious, but is only a part of the wider Citadel threat. Keylogging and stealing personal details can go on secretly for some time, but once a piece of ransomware exposes itself then it is the final blaze of glory for any piece of malware," he said.

To avoid infection by Citadel, the spokesperson advised all PC users to use Malwarebytes Anti Malware, to ensure it is running the most up-to-date versions of all software and to avoid clicking on links they don't recognise as far as possible.

Featured Resources

Activation playbook: Deliver data that powers impactful, game-changing campaigns

Bringing together data and technology to drive better business outcomes

Free Download

In unpredictable times, a data strategy is key

Data processes are crucial to guide decisions and drive business growth

Free Download

Achieving resiliency with Everything-as-a-Service (XAAS)

Transforming the enterprise IT landscape

Free Download

What is contextual analytics?

Creating more customer value in HR software applications

Free Download

Recommended

Hackers could use new Wslink malware in highly targeted cyber attacks
malware

Hackers could use new Wslink malware in highly targeted cyber attacks

1 Nov 2021
FBI raids Chinese POS business following cyber attack claims
malware

FBI raids Chinese POS business following cyber attack claims

27 Oct 2021
Malware developers create malformed code signatures to avoid detection
malware

Malware developers create malformed code signatures to avoid detection

24 Sep 2021
New malware uses search engine ads to target pirate gamers
malware

New malware uses search engine ads to target pirate gamers

21 Jul 2021

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
Europe's first autonomous petrol station opens in Lisbon
automation

Europe's first autonomous petrol station opens in Lisbon

23 May 2022
Linux-based Cheerscrypt ransomware found targeting VMware ESXi servers
ransomware

Linux-based Cheerscrypt ransomware found targeting VMware ESXi servers

26 May 2022