Citadel banking malware is evolving and spreading rapidly, researchers warn
The open-source development model is helping Citadel's creators patch bugs and add features faster
IDG News Service - A computer Trojan that targets online banking users is evolving and spreading rapidly because its creators have adopted an open-source development model, according to researchers from cyberthreat management firm Seculert.
Called Citadel, the new piece of malware is based on ZeuS, one of the oldest and most popular online banking Trojans. ZeuS was abandoned by its creator in late 2010 and its source code leaked online a few months later.
Since its public release, the ZeuS source code has served as base for the development other Trojans, including Ice IX and now Citadel.
"Seculert's Research Lab discovered the first indication of a Citadel botnet on December 17th, 2011," the security company said Wednesday in a blog post. "The level of adoption and development of Citadel is rapidly growing."
Seculert has identified over 20 botnets that use different versions of this Trojan. "Each version added new modules and features, some of which were submitted by the Citadel customers themselves," the company said.
The most interesting aspect of Citadel is its development process, which is similar to the ones behind community-supported open source projects. "Similar to legitimate software companies, the Citadel authors provide their customers with a User Manual, Release Notes and a License Agreement," Seculert said.
Like its parent, Citadel is sold as a crimeware toolkit on the underground market. The tookit allows fraudsters to customize the Trojan according to their needs and command and control infrastructure.
However, the Citadel authors went even further and developed an online platform where customers can request features, report bugs and even contribute modules.
While analyzing different Citadel versions that were released in rapid succession, Seculert's researchers spotted improvements like the use of AES encryption for configuration files, the blocking of antivirus websites on infected computers, the blocking of automated botnet tracking services and the addition of remote screen video recording capability.
The security company believes that the success of this Trojan could drive other malware writers to adopt the open-source model. "This recent development may be an indication of a trend in malware evolution," Seculert said.
- EndPoint Interactive eGuide In this eGuide, Network World, Computerworld, and CIO examine two endpoint trends - BYOD and collaboration - and offer tips and advice on...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!