Improved Carberp malware targets U.S. banks
Carberp authors are developing custom scripts for U.S. and Canadian banking websites, Group-IB researchers say
IDG News Service - The creators of Carberp, a banking Trojan program used exclusively in Russian-speaking countries, have started to sell an improved version of the malware together with custom scripts that would allow cybercriminals to target U.S. online banking customers, according to researchers from Russian security firm Group-IB.
The Carberp malware first appeared in 2010 and started out as a private Trojan program used by a single gang.
In early 2011, its creators sold the malware's builder -- the tool used to customize the Trojan program -- for $10,000 to a limited number of customers. This gave life to several Carberp-powered operations that targeted online banking users from Russia, Ukraine, Belarus, Kazakhstan, Moldova and other former Soviet Union states.
Between March and June this year, the leaders of the three largest Carberp cybercriminal groups were arrested in Russia. Group-IB assisted Russian law enforcement authorities in the investigations.
Last week, the creators of the Carberp malware, who have been silent since 2011, started advertising a new and improved version of the malware on an underground forum, security researchers from RSA said Friday in a blog post.
The Trojan program is offered on a monthly subscription-based model with prices ranging between $2,000 and $10,000 depending on the number of additional modules, or for a one-time fee of $40,000, which buys the builder application for a special Carberp version that has a bootkit -- boot sector rootkit -- component.
"At no point in cybercrime history has any developer asked such price for a banking Trojan," according to the RSA researchers.
On Friday, security researchers from Russian antivirus vendor Kaspersky Lab reported that several Carberp-related Android apps designed to steal online transaction authentication codes sent by banks to customers via SMS, were found on Google Play. This was the first time when malicious mobile components associated with Carberp had been found.
At the time, Denis Maslennikov, senior malware analyst at Kaspersky, said via email that the company's researchers have not yet seen Carberp variants targeting banks that are not located in Russian-speaking countries. However, according to Group-IB, that might not be the case for long.
Group-IB has reliable information that the Carberp creators are developing and selling custom "Web injects" -- scripts that define how banking malware interacts with targeted websites -- for the sites of major North American banks like Wells Fargo, Citibank, JP Morgan Chase, Bank of America, TD Bank and others, Andrey Komarov, Group-IB's head of international projects department, said Monday.
The Carberp creators are selling custom versions of the malware with Web injects that target specific banks, Komarov said via email. "We have samples of Carberp Web injects for banks in U.S. and Canada."
In addition, Carberp customers can develop their own custom Web inject if they know the API (application programming interface) and the proper Web inject structure, he said.
The Carberp authors will probably not get many customers, considering the malware's price, Komarov said. However, they will attract professional customers with experience in running money mule and cashout operations in the U.S., Canada and Australia, he said.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts