Researchers at EMC’s RSA security division say evidence that the Citadel Trojan is slowly being pulled from underground markets continues to pile up.
According to RSA, a recent spat between Citadel’s developer, known as “Aquabox”, and one of his buyers led to him being banned from one of the “largest online crime communities Citadel was ever a part of.” The buyer accused Aquabox of becoming corrupt by all the money Citadel had earned him.
“The recent accusations against Aquabox are only one of many hints that confirm the very imminent withdrawal of the Citadel Trojan, as its developers change their business model from offering it as commercially-available crimeware to a much more selective and privatized operation,” according to a blog post today by RSA FraudAction Research Labs.
In July, RSA reported that it had found a statement on an underground forum that said updates for the Trojan would no longer be publicly available, and that only existing customers would be receiving upgrades. Others who wanted to purchase a new kit were told they would have to get an existing customer to vouch for them.
There are a number of reasons Citadel’s developers may want to go private. The more readily available Citadel is, the more likely it will attract law enforcement attention, RSA noted. In addition, with some many customers, technical support can be challenging.
Finally, the team may wish to go back to focusing on other endeavors, such as fraud.
“Citadel being taken deeper underground will likely mean a smaller, less “public” deployment of this Trojan, which could in turn result in the proliferation of Citadel variants becoming stabilized,” according to RSA. “It may also mean that in the long run detection rates (by AV engines) will gradually drop due to more limited sampling opportunities.
“Although the Citadel developers are not as interested in new buyers today, the team may still return to cybercrime forums or devise another business model in an effort to return with more news in the future.”
More from Brian Prince
- U.S. Healthcare Companies Hardest Hit by ‘Stegoloader’ Malware
- CryptoWall Ransomware Cost Victims More Than $18 Million Since April 2014: FBI
- New Adobe Flash Player Flaw Shares Similarities With Previous Vulnerability: Trend Micro
- Visibility Challenges Industrial Control System Security: Survey
- Adobe Flash Player Zero-Day Exploited in Attack Campaign
- Researchers Demonstrate Stealing Encryption Keys Via Radio
- Researchers Uncover Critical RubyGems Vulnerabilities
- NSA, GCHQ Linked to Efforts to Compromise Antivirus Vendors: Report
Latest News
- KeePass Update Patches Vulnerability Exposing Master Password
- AntChain, Intel Create New Privacy-Preserving Computing Platform for AI Training
- Keep Aware Raises $2.4M to Eliminate Browser Blind Spots
- Google Workspace Gets Passkey Authentication
- Cybersecurity Startup Elba Raises €2.5 Million for Employee-Focused Product
- Zoom Expands Privacy Options for European Customers
- Several Major Organizations Confirm Being Impacted by MOVEit Attack
- Apple Unveils Upcoming Privacy and Security Features
