Researchers at SentinelOne have analyzed a new variant of the notorious banking Trojan Zeus and managed to access the control panel used by cybercriminals to monitor and control their operations.
The new Zeus variant has been used to target major Canadian banks, including the National Bank of Canada, the Royal Bank of Canada, and the Bank of Montreal.
Just like previous variants of the threat, the malware leverages Web injections to trick potential victims into handing over their personal and financial information. The targeted bank’s legitimate login page is replaced with an almost identical phishing page where users are instructed to enter their social insurance number, date of birth, ATM PIN, and credit/debit card details.
Antivirus applications had not detected the malware when SentinelOne analyzed it. Furthermore, the threat doesn’t raise too much suspicion since browser security is bypassed and no SSL warnings are generated. This happens because the malware is installed on the endpoint and it doesn’t break the SSL connection to the financial organization’s server.
As far as the control panel is concerned, it shows the sophistication of the tools used by cybercriminals to carry out their activities. The panel provides attackers with detailed information on each of the compromised bank accounts, including balance, login status, and Web browser used by the victim.
In a special “Drop” form, the cybercrooks can specify the bank account to which they want to transfer the stolen funds, the destination country and city, and the percentage the money mule gets to keep before forwarding the loot to the fraudster. The control panel can also be used to specify the minimum and maximum balance or transfer limits, researchers noted.
“This glimpse into the criminal underground demonstrates the sophistication of the tools being used by criminal gangs to conduct banking and other forms of online fraud. Building, executing and monetizing advanced attacks is easier and more affordable than ever before,” SentinelOne’s Anton Ziukin said in a blog post.
Last summer, researchers at Websense identified a vulnerability that allowed them to compromise the control panel of Zeus’ command and control server.