Researchers at EMC’s RSA security division say evidence that the Citadel Trojan is slowly being pulled from underground markets continues to pile up.
According to RSA, a recent spat between Citadel’s developer, known as “Aquabox”, and one of his buyers led to him being banned from one of the “largest online crime communities Citadel was ever a part of.” The buyer accused Aquabox of becoming corrupt by all the money Citadel had earned him.
“The recent accusations against Aquabox are only one of many hints that confirm the very imminent withdrawal of the Citadel Trojan, as its developers change their business model from offering it as commercially-available crimeware to a much more selective and privatized operation,” according to a blog post today by RSA FraudAction Research Labs.
In July, RSA reported that it had found a statement on an underground forum that said updates for the Trojan would no longer be publicly available, and that only existing customers would be receiving upgrades. Others who wanted to purchase a new kit were told they would have to get an existing customer to vouch for them.
There are a number of reasons Citadel’s developers may want to go private. The more readily available Citadel is, the more likely it will attract law enforcement attention, RSA noted. In addition, with some many customers, technical support can be challenging.
Finally, the team may wish to go back to focusing on other endeavors, such as fraud.
“Citadel being taken deeper underground will likely mean a smaller, less “public” deployment of this Trojan, which could in turn result in the proliferation of Citadel variants becoming stabilized,” according to RSA. “It may also mean that in the long run detection rates (by AV engines) will gradually drop due to more limited sampling opportunities.
“Although the Citadel developers are not as interested in new buyers today, the team may still return to cybercrime forums or devise another business model in an effort to return with more news in the future.”
More from Brian Prince
- U.S. Healthcare Companies Hardest Hit by ‘Stegoloader’ Malware
- CryptoWall Ransomware Cost Victims More Than $18 Million Since April 2014: FBI
- New Adobe Flash Player Flaw Shares Similarities With Previous Vulnerability: Trend Micro
- Visibility Challenges Industrial Control System Security: Survey
- Adobe Flash Player Zero-Day Exploited in Attack Campaign
- Researchers Demonstrate Stealing Encryption Keys Via Radio
- Researchers Uncover Critical RubyGems Vulnerabilities
- NSA, GCHQ Linked to Efforts to Compromise Antivirus Vendors: Report
Latest News
- Fraudulent “CryptoRom” Apps Slip Through Apple and Google App Store Review Process
- US Downs Chinese Balloon Off Carolina Coast
- Microsoft: Iran Unit Behind Charlie Hebdo Hack-and-Leak Op
- Feds Say Cyberattack Caused Suicide Helpline’s Outage
- Big China Spy Balloon Moving East Over US, Pentagon Says
- Former Ubiquiti Employee Who Posed as Hacker Pleads Guilty
- Cyber Insights 2023: Venture Capital
- Atlassian Warns of Critical Jira Service Management Vulnerability
