Zeus resurfaces to steal credit card details

Cybercriminals resurrect old malware to snaffle online credentials.

The Zeus malware has re-emerged and is being used by criminals to steal financial information, according to IT security company Trend Micro.

The firm claims the malware has re-appeared amidst a spike in numbers of active threats in the wild and has predicted that this year will be characterised by slightly modified old threats resurfacing, with new features added in order to avoid detection and infect more systems.

Peddling stolen banking information is a lucrative business in the underground market

The Zeus or ZBOT variants began to increase from the beginning of February, according to Trend Micro's Jay Yaneza.

"ZBOTvariants surged in the beginning of February and continued to be active up to this month. It even peaked during the middle of May 2013. The malware is designed to steal online credentials from users, which can be banking information or other personally identifiable information (PII)," said Yaneza in a blog post.

Yaneza warned that this variant of the Zeus malware was now more dangerous as it uses advanced techniques to avoid detection by security systems.

"ZBOTmalware of this generation are found to be mostly either Citadel or GameOver variants. Unlike earlier versions, the mutex name is randomly generated," said Yaneza.

"Both variants send DNS queries to randomised domain names. The difference in GameOver variant is that it opens a random UDP port and sends encrypted packets before sending DNS queries to randomised domain names. Zbot malware connects to a remote site to download its encrypted configuration file."

He said that these configuration files contain banks and other financial institutions that ZBOTs monitor in browsers.

"Since configuration files are downloaded from remote sites, the contents of these files may change any time. Malicious actors can change the list of sites they want to monitor on the affected system."

The firm said that there are ways to stop the Zeus malware in its tracks.

"There are several avenues for detecting ZBOT variants. First, as the malware tries to write to the registry Userinit' entry in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Secondly, detecting the call-back routine to the remote site upon execution, as it acquires its configuration file," he said.

Yaneza said that old threats like ZBOT can always make a comeback because cybercriminals profit from these. "Peddling stolen banking and other personal information from users is a lucrative business in the underground market," he said. "It is important to be careful in opening email messages or clicking links. Bookmark trusted sites and avoid visiting unknown ones."

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Leading the data race

The trends driving the future of data science

Download now

How to create 1:1 customer experiences at scale

Meet the technology capable of delivering the personalisation your customers crave

Download now

How to achieve daily SAP releases

Accelerate the pace of SAP change to support your digital strategy

Download now

Recommended

8 most secure web browsers
web browser

8 most secure web browsers

25 Sep 2020
Your essential guide to internet security
Security

Your essential guide to internet security

23 Sep 2020
How to enable private browsing on any device
privacy

How to enable private browsing on any device

22 Sep 2020
Third-party apps are tracking your WhatsApp activity
social media

Third-party apps are tracking your WhatsApp activity

21 Sep 2020

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
The Xbox Series X shows how far the cloud still has to go
Cloud

The Xbox Series X shows how far the cloud still has to go

25 Sep 2020