Monday, December 4, 2023

Organized Cybercrime – Hacker Groups Work Together To Distribute Banking Malware Globally

The banking malware considered a top threat, it allows a malware developer an easy way to gain access to someone and cause serious damage.

According to the reports, the cybercrime costs more than $600 billion in 2017 and for 2018 predicted $1.5 trillion in losses.

Hacker groups continue to exchange their scripts, tactics, and techniques to bypass the security measures and to evade from law enforcement agencies.

The most popular active banking malware are TrickBot, cedID, Gozi, Ramnit and Zesus panda. According to the IBM report, the hacker groups have ties to each other to fuel their financial crime economy.

“The banking Trojan arena is dominated by groups from the same part of the world, by people who know each other and collaborate to orchestrate high-volume wire fraud,” IBM Executive Security Advisor, Limor Kessem.

Active Banking Malware

Trickbot is the infamous banking malware which steals login credentials from applications, it was discovered long back ago and it is the most aggressive trojan of 2018.

At earlier stages, Trickbot appears not connected with any trojans, in the recent campaign, the Trickbot drops IcedID. In another campaign observed by ESET Emotet drops TrickBot and IcedId.

“By August 2018, our researchers noted that IcedID had been upgraded to behave in a similar way to the TrickBot Trojan in terms of its deployment,” Kessem added.

In another Trickbot campaign, it drops the Ryuk Ransomware and Emotet malware. The Ryuk Ransomware infects the system and demands ransom.

The 2019 version of Trickbot variant adds three new functions Virtual Network Computing (VNC), PuTTY and Remote Desktop Protocol (RDP) platforms.

Gozi, yet another highly active malware which was first spotted in 2007, it was constantly evolving and its source code leak gives rise to a number of active trojans today. The Gozi malware is distributed through macro-enabled spreadsheet attachments.

Ramnit another banking trojan, which is initially a self-replicating worm evolved modular banking Trojan, later in 2018 it code was revamped partnering with Ngioweb.

Based on IBM research, “starting from 2018 connected the major cybercrime gangs together in explicit collaboration. This trend is a negative sign that highlights how botnet operators join forces, revealing the resilience factor in these nefarious operations.”

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles