Connect with us

Hi, what are you looking for?


Malware & Threats

RSA: Citadel Developer Banned From Cyber Underground Forum

Researchers at EMC’s RSA security division say evidence that the Citadel Trojan is slowly being pulled from underground markets continues to pile up.

Researchers at EMC’s RSA security division say evidence that the Citadel Trojan is slowly being pulled from underground markets continues to pile up.

According to RSA, a recent spat between Citadel’s developer, known as “Aquabox”, and one of his buyers led to him being banned from one of the “largest online crime communities Citadel was ever a part of.” The buyer accused Aquabox of becoming corrupt by all the money Citadel had earned him.

“The recent accusations against Aquabox are only one of many hints that confirm the very imminent withdrawal of the Citadel Trojan, as its developers change their business model from offering it as commercially-available crimeware to a much more selective and privatized operation,” according to a blog post today by RSA FraudAction Research Labs.

In July, RSA reported that it had found a statement on an underground forum that said updates for the Trojan would no longer be publicly available, and that only existing customers would be receiving upgrades. Others who wanted to purchase a new kit were told they would have to get an existing customer to vouch for them.

Advertisement. Scroll to continue reading.

There are a number of reasons Citadel’s developers may want to go private. The more readily available Citadel is, the more likely it will attract law enforcement attention, RSA noted. In addition, with some many customers, technical support can be challenging.

Finally, the team may wish to go back to focusing on other endeavors, such as fraud.

“Citadel being taken deeper underground will likely mean a smaller, less “public” deployment of this Trojan, which could in turn result in the proliferation of Citadel variants becoming stabilized,” according to RSA. “It may also mean that in the long run detection rates (by AV engines) will gradually drop due to more limited sampling opportunities.

“Although the Citadel developers are not as interested in new buyers today, the team may still return to cybercrime forums or devise another business model in an effort to return with more news in the future.”

Written By

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Malware & Threats

Threat actors are increasingly abusing Microsoft OneNote documents to deliver malware in both targeted and spray-and-pray campaigns.

Malware & Threats

Unpatched and unprotected VMware ESXi servers worldwide have been targeted in a ransomware attack exploiting a vulnerability patched in 2021.

Malware & Threats

A vulnerability affecting IBM’s Aspera Faspex file transfer solution, tracked as CVE-2022-47986, has been exploited in attacks.


The recent ransomware attack targeting Rackspace was conducted by a cybercrime group named Play using a new exploitation method, the cloud company revealed this...

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...