Organized Cybercrime – Hacker Groups Work Together To Distribute Banking Malware Globally

The banking malware considered a top threat, it allows a malware developer an easy way to gain access to someone and cause serious damage.

According to the reports, the cybercrime costs more than $600 billion in 2017 and for 2018 predicted $1.5 trillion in losses.

Hacker groups continue to exchange their scripts, tactics, and techniques to bypass the security measures and to evade from law enforcement agencies.

The most popular active banking malware are TrickBot, cedID, Gozi, Ramnit and Zesus panda. According to the IBM report, the hacker groups have ties to each other to fuel their financial crime economy.

“The banking Trojan arena is dominated by groups from the same part of the world, by people who know each other and collaborate to orchestrate high-volume wire fraud,” IBM Executive Security Advisor, Limor Kessem.

Active Banking Malware

Trickbot is the infamous banking malware which steals login credentials from applications, it was discovered long back ago and it is the most aggressive trojan of 2018.

At earlier stages, Trickbot appears not connected with any trojans, in the recent campaign, the Trickbot drops IcedID. In another campaign observed by ESET Emotet drops TrickBot and IcedId.

“By August 2018, our researchers noted that IcedID had been upgraded to behave in a similar way to the TrickBot Trojan in terms of its deployment,” Kessem added.

In another Trickbot campaign, it drops the Ryuk Ransomware and Emotet malware. The Ryuk Ransomware infects the system and demands ransom.

The 2019 version of Trickbot variant adds three new functions Virtual Network Computing (VNC), PuTTY and Remote Desktop Protocol (RDP) platforms.

Gozi, yet another highly active malware which was first spotted in 2007, it was constantly evolving and its source code leak gives rise to a number of active trojans today. The Gozi malware is distributed through macro-enabled spreadsheet attachments.

Ramnit another banking trojan, which is initially a self-replicating worm evolved modular banking Trojan, later in 2018 it code was revamped partnering with Ngioweb.

Based on IBM research, “starting from 2018 connected the major cybercrime gangs together in explicit collaboration. This trend is a negative sign that highlights how botnet operators join forces, revealing the resilience factor in these nefarious operations.”

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.