Connect with us

Hi, what are you looking for?

HEADLINES

NukeBot caught as new ready-to-attack version of dangerous banking Trojan

Kaspersky Lab researchers reported that it detected NukeBot – new malware which has been designed to steal the credentials of online banking customers. Earlier versions of the Trojan were known to the security industry as TinyNuke, but lacked the features necessary to launch attacks. The latest versions however, are fully operable, and contain code to target the users of specific banks.   

Kaspersky Lab researchers reported that it detected NukeBot – new malware which has been designed to steal the credentials of online banking customers. Earlier versions of the Trojan were known to the security industry as TinyNuke, but lacked the features necessary to launch attacks. The latest versions however, are fully operable, and contain code to target the users of specific banks.   

Kaspersky Lab_NukeBot.jpg

Although the appearance of a malware family in the wild is not unusual, the fact that criminals have a ready-to-attack version of the Trojan, means that soon they may initiate a wide-scale malicious campaign, to infect multiple users.

As an early warning to its customers and other users, Kaspersky Lab has published a brief analysis of the malware.

NukeBot is a banking Trojan. Upon infection it “injects” malicious code into the webpage of an online banking service displayed in a victim’s browser and then steals user data, spoofs their credentials, and more.

According to Kaspersky Lab researchers, there are already a number of compiled samples of this Trojan in the wild – shared on underground hacking forums. Most of these are rough, barely operational malware drafts; however, the company’s experts have managed to identify some that pose a real threat.

Around 5% of all samples found by Kaspersky Lab were NukeBot’s new ‘combat versions’, which have improved source codes and attacking capacities. Among other things these versions contain injections – specific pieces of code, which mimic parts of user interface of real online banking services.

Advertisement. Scroll to continue reading.

Based on the analysis of injections, Kaspersky Lab experts believe the main targets of the new version of NukeBot are users of several French and US banks.

In addition, Kaspersky Lab researchers managed to detect several NukeBot modifications that didn’t have web injection functionality, and were designed to steal mail client and browser passwords.

This means that developers of new versions may aim to widen the functionality of this malware family.

“While criminals behind recent versions of this malware currently are not actively distributing NukeBot, this may, and likely will, change very soon. We’ve already seen this before with some other malware families: after a short testing period of a ready-to-attack malware, criminals start distributing it widely through infected websites, spam and phishing. So far we have seen NukeBot versions which are ready to attack the customers of at least six banks located in France and the US, however this list of targets looks like only the beginning. The goal of our brief research is to warn the banking community and online banking customers about a potentially emerging threat. We urge interested parties to use the results of our research in order to protect themselves from this threat in advance,” said Sergey Yunakovsky, security expert at Kaspersky Lab.

“In 2016, the number of users attacked with malware targeting financial data increased about 30.55% over the previous year, bringing it to close to 1.1 Million attacks. While most of these attacks were mostly towards regular users, approximately 17.7% of the attacks also targeted corporate users. From our Financial Cyberthreats report for 2016, we found that users in Russia, Germany, Japan, India, Vietnam and the US are the ones most often attacked by banking malware. The trends show us that although professional cybercriminal groups have indeed shifted a lot of their attention to targeted attacks against large companies, regular users and smaller firms are still being targeted,” added Sylvia Ng, General Manager at Kaspersky Lab Southeast Asia.

To protect yourself and your customers from NukeBot attacks, Kaspersky Lab security specialists offer the following advice:

For financial organizations providing online banking services:

Advertisement. Scroll to continue reading.
  • Make sure you have an effective fraud prevention solution in place, so that you can quickly and accurately spot unauthorized use of customer accounts and irregular financial activity.

For customers of online banking services:

  • Use an Internet security solution with tailored technologies to protect financial transactions, like Kaspersky Lab’s Safe Money.

  • Regularly run a system scan to check for possible infections.

Kaspersky Lab products detect the malware as Trojan-Banker.Win32.TinyNuke.

Advertisement

Like Us On Facebook

You May Also Like

HEADLINES

Providing a sense of security for its subscribers has pushed Converge to also provide quick access to online support while raising awareness through online...

HEADLINES

Poll shows how people are managing the pandemic as we approach the one-year anniversary of the start of large-scale quarantines that forced millions of...

HEADLINES

The Philippines slipped two notches down from its previous ranking in the latest top 10 global list of countries with the most web-borne threats...

HEADLINES

bluedog was launched two years ago to make professional cybersecurity services accessible to a wider audience – including businesses in Asia and smaller firms...

HEADLINES

The remote setup had employees bringing home their workstations, taking devices out of the protection of cybersecurity systems found inside offices and leaving them...

HEADLINES

Last spring, more than 1 billion schoolchildren around the globe were affected by school closures as countries attempted to slow rising infection rates. For...

HEADLINES

The multibillion-peso investment has enabled the two companies to block 3,020 domains that host illicit materials featuring children as mandated by the National Telecommunications...

HEADLINES

Researchers from Kaspersky spotted a significant growth of the malware used by SilentFade, the gang responsible for $4 million fraud on Facebook in 2019.

Advertisement