Zeus resurfaces to steal credit card details

Cybercriminals resurrect old malware to snaffle online credentials.

The Zeus malware has re-emerged and is being used by criminals to steal financial information, according to IT security company Trend Micro.

The firm claims the malware has re-appeared amidst a spike in numbers of active threats in the wild and has predicted that this year will be characterised by slightly modified old threats resurfacing, with new features added in order to avoid detection and infect more systems.

Peddling stolen banking information is a lucrative business in the underground market

The Zeus or ZBOT variants began to increase from the beginning of February, according to Trend Micro's Jay Yaneza.

"ZBOTvariants surged in the beginning of February and continued to be active up to this month. It even peaked during the middle of May 2013. The malware is designed to steal online credentials from users, which can be banking information or other personally identifiable information (PII)," said Yaneza in a blog post.

Yaneza warned that this variant of the Zeus malware was now more dangerous as it uses advanced techniques to avoid detection by security systems.

"ZBOTmalware of this generation are found to be mostly either Citadel or GameOver variants. Unlike earlier versions, the mutex name is randomly generated," said Yaneza.

"Both variants send DNS queries to randomised domain names. The difference in GameOver variant is that it opens a random UDP port and sends encrypted packets before sending DNS queries to randomised domain names. Zbot malware connects to a remote site to download its encrypted configuration file."

He said that these configuration files contain banks and other financial institutions that ZBOTs monitor in browsers.

"Since configuration files are downloaded from remote sites, the contents of these files may change any time. Malicious actors can change the list of sites they want to monitor on the affected system."

The firm said that there are ways to stop the Zeus malware in its tracks.

"There are several avenues for detecting ZBOT variants. First, as the malware tries to write to the registry Userinit' entry in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Secondly, detecting the call-back routine to the remote site upon execution, as it acquires its configuration file," he said.

Yaneza said that old threats like ZBOT can always make a comeback because cybercriminals profit from these. "Peddling stolen banking and other personal information from users is a lucrative business in the underground market," he said. "It is important to be careful in opening email messages or clicking links. Bookmark trusted sites and avoid visiting unknown ones."

Featured Resources

Security analytics for your multi-cloud deployments

IBM Security QRadar SIEM solution brief

Download now

Five reasons to move to the cloud

Join the enterprises moving their workloads to the cloud

Download now

Architecting hybrid IT and edge for digital advantage

Why business leaders should consider a hybrid IT strategy

Download now

Six reasons to accelerate remote asset monitoring with AI

How to optimise resources, increase productivity, and grow profit margins with AI

Download now

Recommended

Cyber security firm saw attacks rise by 20% during 2020
cyber security

Cyber security firm saw attacks rise by 20% during 2020

23 Feb 2021
What to look for in a secure cloud system
cloud security

What to look for in a secure cloud system

23 Feb 2021
Hackers turn to 'silent stealing' in bid to exploit home workers
scams

Hackers turn to 'silent stealing' in bid to exploit home workers

22 Feb 2021
MacBook users warned against EvilQuest ransomware
ransomware

MacBook users warned against EvilQuest ransomware

19 Feb 2021

Most Popular

Mysterious Silver Sparrow malware hits 30,000 macOS devices
malware

Mysterious Silver Sparrow malware hits 30,000 macOS devices

22 Feb 2021
IBM reportedly mulls sale of Watson Health business
mergers and acquisitions

IBM reportedly mulls sale of Watson Health business

22 Feb 2021
Microsoft to launch standalone Office 2021 suite
Microsoft Office

Microsoft to launch standalone Office 2021 suite

19 Feb 2021