Attacks/Breaches

Zeus Botnet Eurograbber Steals $47 Million

Sophisticated, targeted attack campaign enabled criminals to steal an estimated $47 million from more than 30,000 corporate and private banking customers.

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
A criminal gang wielding a new version of Zeus malware that's designed for mobile devices has stolen an estimated 36 million euros, or $47 million, from more than 30,000 corporate and private banking customers.

That finding comes from a new report published by security vendors Versafe and Check Point Software Technologies. They've dubbed the related attack campaign as "Eurograbber," and notified banks and law enforcement agencies in the affected countries.

Attackers have configured the malware to target customers of 16 specific banks in Italy, as well as seven in Spain, six in Germany and three in the Netherlands. "To date, this exploit has only been detected in euro zone countries, but a variation of this attack could potentially affect banks in countries outside of the European Union as well," according to the report. Individual transfer amounts made by Eurograbber malware have ranged from 500 euros ($656) to 250,000 euros ($328,000).

The malware used by attackers is a customized version of the Zitmo Trojan spyware application. Zitmo is short for "Zeus in the mobile," and the malware is designed to defeat the two-factor authentication systems employed by some banks. To do that, a companion, smartphone version of the malware intercepts the one-time transaction authentication number (TAN) that banks send to a customer's mobile device, via SMS, which the customer must then enter into a banking website prompt to authorize a money transfer.

[ Here is a good question: Can Banks Prevent The Next Cyber Attack? ]

The Zitmo Trojan can infect a PC if a user clicks on a malicious link in a spam or phishing email, or on a link on a website that's been compromised by attackers. The malicious Trojan application then remains dormant until a user logs into a targeted financial firm's website. "The next time the bank customer logs in to their bank account, the Eurograbber Trojan intercepts their banking session and injects a JavaScript into the customer's banking page," according to the report. "This malicious JavaScript informs the customer of the 'security upgrade' and instructs them on how to proceed."

The security upgrade page requests that the user indicated which mobile operating system their smartphone uses -- Android, BlackBerry, iOS (iPhone), Symbian (Nokia) or other -- as well as their mobile phone number. This information is then relayed to a drop zone, which is a publicly writable folder on a Web server -- which attackers may have previously hijacked -- where they store information about every infected bank customer's PC, including account numbers, log-in credentials, and one-time passwords.

A bogus confirmation SMS is then sent to the user's smartphone. "The SMS directs the customer to complete the security upgrade by clicking on the attached link. Doing so downloads a file onto the customer's mobile device with the appropriate mobile version of the Eurograbber Trojan," according to the report.

From then on, anytime that PC is used to log onto the targeted financial website, automatic attacks may take place, with the malware on the PC initiating transfers, and the malware on the smartphone intercepting any TAN sent by the bank, and automatically approving the transaction, which transfers money to mule accounts. "Victims' bank accounts will have lost money without their knowledge," according to the report. "This entire process occurs every time the bank customer logs into his or her bank account."

News of the Eurograbber Zitmo attack campaign follows the recent discovery of a cybercrime campaign waged using the Gameover Zeus Trojan, which steals banking credentials using phony but real-looking emails. Millions of those emails have been circulating in recent weeks, and are being distributed via the Cutwail spamming botnet.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Authentify_JohnZurawski
50%
50%
Authentify_JohnZurawski,
User Rank: Apprentice
12/10/2012 | 8:03:20 PM
re: Zeus Botnet Eurograbber Steals $47 Million
The real challenge is that authenticating the end user and signing transactions all happen on the front end. A secure SMS text with an OTP that the MITM can't read is fine - the MITM doesn't need it. He wants you logged on - he's going to change your transaction details "in flight"
The front end is unsafe to the point that secure out-of-band, or out-of-channel communication from the backend is required. Not transaction signing, but transaction review and approval. A phone-based voice call that speaks your transaction details to you and permits approval or cancellation is one example, provided you can can defend against call forwarding and exploits against the phone. That takes a vendor with experience.

A smart app on a smart phone or tablet with an encrypted communication layer and a top of the stack application level encryption to protect it from ZITMO is another example. The app would let you review and approve or cancel the transaction if it isn't correct. Don't trust using an app on the same phone the banking app is on - mix and match. Bank on a tablet, validate the transaction on the smart phone. The BYOD trend should offer more ways to secure transactions, not fewer. The situation today is similar to the initial rush to online banking back in the 90's. Identity theft and account takeover were rampant because in the rush to get "there" - not a lot of thought was given to the vulnerabilities. The mobile rush is on and similar and similar pitfalls are happening. Now BEFORE anyone starts poking holes in the use of out-of-band, and phone-based authentication, or smart app as an out-of-band end point, as I said - you need a vendor that knows how to defend those channels against the exploits. Call forward, SIM swap, phone account takeover - and there are ways to defend the voice and 3G 4G channels. The sky is not falling, FI's just need to catch up.
macker490
50%
50%
macker490,
User Rank: Ninja
12/6/2012 | 12:35:15 PM
re: Zeus Botnet Eurograbber Steals $47 Million
the problem is un-authorized programming, aka "malware" or "virus" not authentication.

AS USUAL
Devastating Cyberattack on Email Provider Destroys 18 Years of Data
Jai Vijayan, Freelance writer,  2/12/2019
Up to 100,000 Reported Affected in Landmark White Data Breach
Kelly Sheridan, Staff Editor, Dark Reading,  2/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8354
PUBLISHED: 2019-02-15
An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c has an integer overflow on the result of multiplication fed into malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow.
CVE-2019-8355
PUBLISHED: 2019-02-15
An issue was discovered in SoX 14.4.2. In xmalloc.h, there is an integer overflow on the result of multiplication fed into the lsx_valloc macro that wraps malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow in channels_start in remix.c.
CVE-2019-8356
PUBLISHED: 2019-02-15
An issue was discovered in SoX 14.4.2. One of the arguments to bitrv2 in fft4g.c is not guarded, such that it can lead to write access outside of the statically declared array, aka a stack-based buffer overflow.
CVE-2019-8357
PUBLISHED: 2019-02-15
An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c allows a NULL pointer dereference.
CVE-2013-2516
PUBLISHED: 2019-02-15
Vulnerability in FileUtils v0.7, Ruby Gem Fileutils <= v0.7 Command Injection vulnerability in user supplied url variable that is passed to the shell.