Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Email Security

Massive Spam Campaign Spreads Panda Banker Trojan

Panda Banker, an offspring of the infamous Zeus malware, was recently observed in a massive infection campaign where millions of spam messages were sent to potential victims, Proofpoint researchers warn.

Panda Banker, an offspring of the infamous Zeus malware, was recently observed in a massive infection campaign where millions of spam messages were sent to potential victims, Proofpoint researchers warn.

In early August the Trojan was observed shifting to targets in Brazil, although it had been targeting banks in Europe and North America prior. Just ahead of the Rio 2016 Olympics, a campaign focused on 10 local banks and various payment platforms in Brazil.

Proofpoint now says that Panda Banker, also known as Zeus Panda, which is based on the source code of the Zeus Trojan that leaked in 2011, has grown significantly.

Originally distributed via spam emails and exploit kits (EKs), and targeting customers of UK and Australian banks, Panda Banker has become more prevalent in recent weeks, researchers say. A large infection campaign observed last week was targeting banks in Europe and Australia, as well as UK online casinos and international online payment systems.

On August 11 and 12, the Panda Banker operators sent millions of messages targeting organizations in manufacturing, retail, insurance, and several other verticals, Proofpoint researchers reveal. These emails were supposedly coming from legitimate banks but instead contained malicious links leading to Microsoft Word documents. Macros in these documents were meant to download the banking Trojan onto the victims’ computers.

Researchers also discovered that the messages used in this campaign were translated into Dutch, German, Italian, and English, depending on the targeted country. Some of the subject lines included: “Detected suspicious transaction on your account,” “Incomplete transaction,” “Locked transaction,” “Online Banking informs,” “Barclays Personal Banking,” “HSBC Personal Banking,” “Geehrter Kunde” (German for “Dear Customer”), “Rechnung bei Postbank AG” (German for “Account at Postbank AG”), or “Sehr geehrter Kunde” (A variation on “Dear Customer”).

Similar to other banking Trojans, Panda Banker uses web injects to intercept online banking traffic. These web injects are designed to specifically target a desired bank, and they were configured for banks in the Netherlands, Italy, and Germany.

Compared to previously used web injects, the newly observed ones represent a substantial expansion, especially given the addition of online casinos in the UK and international payment systems such as OKPay, PayPal, and Xoom. Courtesy of these, the potential attack surface for Panda Banker has dramatically increased, mainly because these payment systems are not limited by geography like most banks, researchers say.

Advertisement. Scroll to continue reading.

Compared to the previously observed Panda Banker variant, there are no significant changes, except for the web injects and encryption of the configuration file. Panda Banker is only one of the variants that spawned from the Zeus Trojan, which was one of the most successful banking Trojans.

“Even as attention turns to ransomware like Locky and CryptXXX, this campaign shows that banking Trojans are far from dead. Both individuals and organizations must remain vigilant to the threat, especially in regions that have not previously experienced the onslaught of Dridex and hardened their defenses accordingly. Protection at both the email gateway and endpoint will be critical to keeping a new generation of banking Trojans at bay,” Proofpoint researchers note.

Related: New Zeus Variant “Sphinx” Offered for Sale

Related: Panda Banker Goes to Brazil Ahead of the Olympics

Written By

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cloud Security

Cloud security researcher warns that stolen Microsoft signing key was more powerful and not limited to Outlook.com and Exchange Online.

Malware & Threats

The NSA and FBI warn that a Chinese state-sponsored APT called BlackTech is hacking into network edge devices and using firmware implants to silently...

Compliance

Government agencies in the United States have made progress in the implementation of the DMARC standard in response to a Department of Homeland Security...

Email Security

Many Fortune 500, FTSE 100 and ASX 100 companies have failed to properly implement the DMARC standard, exposing their customers and partners to phishing...

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...