Waledac malware returns after two years with password-stealing capabilities
A new version of the Waledac malware, capable of stealing passwords and BitCoins, has been detected in the wild
IDG News Service - A new version of the Waledac malware has been spotted on the Internet, but unlike previous variants, which were mainly used for spamming purposes, this one steals various log-in credentials and BitCoins, a type of virtual currency.
"The sample was originally detected on Feb 2nd and the first coverage by a major AV was not observed until Feb 13th," researchers from network security firm Palo Alto Networks announced in a blog post on Tuesday.
However, the new version's primary goal might no longer be spam, said Wade Williamson, a senior product manager at Palo Alto Networks. That's because it also steals FTP, POP3 and SMTP user passwords, as well as .dat files for BitCoin wallets.
This is the first time that Palo Alto Networks' firewall products have spotted Waledac-related activity since the original botnet was shut down two years ago, Williamson said.
The botnet's two-year inactivity was confirmed by antivirus firm BitDefender. "We have closely monitored the Web space during international events such as the deaths of political leaders and calamities a moments when the Waledac botnet would run at peak capacity before the takedown and did not notice any malicious activity on that front," said BitDefender E-Threats Analyst Bogdan Botezatu.
It's difficult to determine with certainty if the new version is the creation of the original Waledac authors, but its high similarity to the old variant suggests that it is the work of someone with access to the original source code, Williamson said.
"What it is sure is the fact that the newly added functionalities (email and FTP credentials harvesting) will contribute to an explosive development of the new botnet," Botezatu said. "FTP accounts will likely be used to accommodate binary copies of the bots, while the e-mail accounts will be used to propagate spam through not-yet-blacklisted mail servers."
Palo Alto Networks researchers have determined that the new Waledac version is being distributed through Web sessions, probably with the help of exploits hosted on compromised websites. According to Botezatu, BitDefender is also investigating this possibility.
"We recommend users to deploy and update a security solution with antispam and antivirus modules," Botezatu said. "We also advise that users rely on SFTP and SSL when connecting to FTP and mail servers, respectively, in order to minimize the risk of network sniffing."
- The Pivotal Big Data Suite- Reducing the Risks of Big Data The explosion of big data and the rapid evolution of big data tools and technologies is challenging IT to meet the demands of...
- A Survival Guide for Data in the Wild All corporate data used to reside in the data center. Safe and sound behind the corporate firewall. But now, employees have multiple devices...
- Transforming Security: Designing a State-of-the-Art Extended Team The information security mission is no longer about implementing and operating controls.
- The Big Data Security Analytics Era Is Here New security risks and old security challenges often overwhelm legacy security controls and analytical tools.
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!