Tuesday, January 7, 2025
HomeComputer SecurityOrganized Cybercrime - Hacker Groups Work Together To Distribute Banking Malware Globally

Organized Cybercrime – Hacker Groups Work Together To Distribute Banking Malware Globally

Published on

The banking malware considered a top threat, it allows a malware developer an easy way to gain access to someone and cause serious damage.

According to the reports, the cybercrime costs more than $600 billion in 2017 and for 2018 predicted $1.5 trillion in losses.

Hacker groups continue to exchange their scripts, tactics, and techniques to bypass the security measures and to evade from law enforcement agencies.

The most popular active banking malware are TrickBot, cedID, Gozi, Ramnit and Zesus panda. According to the IBM report, the hacker groups have ties to each other to fuel their financial crime economy.

“The banking Trojan arena is dominated by groups from the same part of the world, by people who know each other and collaborate to orchestrate high-volume wire fraud,” IBM Executive Security Advisor, Limor Kessem.

Active Banking Malware

Trickbot is the infamous banking malware which steals login credentials from applications, it was discovered long back ago and it is the most aggressive trojan of 2018.

At earlier stages, Trickbot appears not connected with any trojans, in the recent campaign, the Trickbot drops IcedID. In another campaign observed by ESET Emotet drops TrickBot and IcedId.

“By August 2018, our researchers noted that IcedID had been upgraded to behave in a similar way to the TrickBot Trojan in terms of its deployment,” Kessem added.

In another Trickbot campaign, it drops the Ryuk Ransomware and Emotet malware. The Ryuk Ransomware infects the system and demands ransom.

The 2019 version of Trickbot variant adds three new functions Virtual Network Computing (VNC), PuTTY and Remote Desktop Protocol (RDP) platforms.

Gozi, yet another highly active malware which was first spotted in 2007, it was constantly evolving and its source code leak gives rise to a number of active trojans today. The Gozi malware is distributed through macro-enabled spreadsheet attachments.

Ramnit another banking trojan, which is initially a self-replicating worm evolved modular banking Trojan, later in 2018 it code was revamped partnering with Ngioweb.

Based on IBM research, “starting from 2018 connected the major cybercrime gangs together in explicit collaboration. This trend is a negative sign that highlights how botnet operators join forces, revealing the resilience factor in these nefarious operations.”

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

New WordPress Plugin That Weaponizes Legit Sites To Steal Customer Payment Data

Cybercriminals have developed PhishWP, a malicious WordPress plugin, to facilitate sophisticated phishing attacks, which...

New FireScam Android Malware Abusing Firebase Services To Evade Detection

FireScam is multi-stage malware disguised as a fake “Telegram Premium” app that steals data...

Hackers Weaponize Security Testing By Weaponizing npm, PyPI, & Ruby Exploit Packages

Over the past year, malicious actors have been abusing OAST services for data exfiltration,...

Hackers Mimic Social Security Administration To Deliver ConnectWise RAT

A phishing campaign spoofing the United States Social Security Administration emerged in September 2024,...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

New WordPress Plugin That Weaponizes Legit Sites To Steal Customer Payment Data

Cybercriminals have developed PhishWP, a malicious WordPress plugin, to facilitate sophisticated phishing attacks, which...

New FireScam Android Malware Abusing Firebase Services To Evade Detection

FireScam is multi-stage malware disguised as a fake “Telegram Premium” app that steals data...

Hackers Weaponize Security Testing By Weaponizing npm, PyPI, & Ruby Exploit Packages

Over the past year, malicious actors have been abusing OAST services for data exfiltration,...