Wednesday, April 24, 2024

Organized Cybercrime – Hacker Groups Work Together To Distribute Banking Malware Globally

The banking malware considered a top threat, it allows a malware developer an easy way to gain access to someone and cause serious damage.

According to the reports, the cybercrime costs more than $600 billion in 2017 and for 2018 predicted $1.5 trillion in losses.

Hacker groups continue to exchange their scripts, tactics, and techniques to bypass the security measures and to evade from law enforcement agencies.

The most popular active banking malware are TrickBot, cedID, Gozi, Ramnit and Zesus panda. According to the IBM report, the hacker groups have ties to each other to fuel their financial crime economy.

“The banking Trojan arena is dominated by groups from the same part of the world, by people who know each other and collaborate to orchestrate high-volume wire fraud,” IBM Executive Security Advisor, Limor Kessem.

Active Banking Malware

Trickbot is the infamous banking malware which steals login credentials from applications, it was discovered long back ago and it is the most aggressive trojan of 2018.

At earlier stages, Trickbot appears not connected with any trojans, in the recent campaign, the Trickbot drops IcedID. In another campaign observed by ESET Emotet drops TrickBot and IcedId.

“By August 2018, our researchers noted that IcedID had been upgraded to behave in a similar way to the TrickBot Trojan in terms of its deployment,” Kessem added.

In another Trickbot campaign, it drops the Ryuk Ransomware and Emotet malware. The Ryuk Ransomware infects the system and demands ransom.

The 2019 version of Trickbot variant adds three new functions Virtual Network Computing (VNC), PuTTY and Remote Desktop Protocol (RDP) platforms.

Gozi, yet another highly active malware which was first spotted in 2007, it was constantly evolving and its source code leak gives rise to a number of active trojans today. The Gozi malware is distributed through macro-enabled spreadsheet attachments.

Ramnit another banking trojan, which is initially a self-replicating worm evolved modular banking Trojan, later in 2018 it code was revamped partnering with Ngioweb.

Based on IBM research, “starting from 2018 connected the major cybercrime gangs together in explicit collaboration. This trend is a negative sign that highlights how botnet operators join forces, revealing the resilience factor in these nefarious operations.”

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.


Latest articles

Phishing Attacks Rise By 58% As The Attackers Leverage AI Tools

AI-powered generative tools have supercharged phishing threats, so even newbie attackers can effortlessly create...

Multiple MySQL2 Flaw Let Attackers Arbitrary Code Remotely

The widely used MySQL2 has been discovered to have three critical vulnerabilities: remote Code...

CoralRaider Hacker Evade Antivirus Detections Using Malicious LNK File

This campaign is observed to be targeting multiple countries, including the U.S., Nigeria, Germany,...

Spyroid RAT Attacking Android Users to Steal Confidential Data

A new type of Remote Access Trojan (RAT) named Spyroid has been identified.This...

Researchers Uncover that UK.GOV Websites Sending Data to Chinese Ad Vendor Analysts

Analysts from Silent Push, a data analytics firm, have uncovered several UK government websites...

Ransomware Victims Who Opt To Pay Ransom Hits Record Low

Law enforcement operations disrupted BlackCat and LockBit RaaS operations, including sanctions on LockBit members...

IBM Nearing Talks to Acquire Cloud-software Provider HashiCorp

IBM is reportedly close to finalizing negotiations to acquire HashiCorp, a prominent cloud infrastructure...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles