10:13 AM

Zeus Botnet Eurograbber Steals $47 Million

Sophisticated, targeted attack campaign enabled criminals to steal an estimated $47 million from more than 30,000 corporate and private banking customers.

Who Is Hacking U.S. Banks? 8 Facts
Who Is Hacking U.S. Banks? 8 Facts
(click image for larger view and for slideshow)
A criminal gang wielding a new version of Zeus malware that's designed for mobile devices has stolen an estimated 36 million euros, or $47 million, from more than 30,000 corporate and private banking customers.

That finding comes from a new report published by security vendors Versafe and Check Point Software Technologies. They've dubbed the related attack campaign as "Eurograbber," and notified banks and law enforcement agencies in the affected countries.

Attackers have configured the malware to target customers of 16 specific banks in Italy, as well as seven in Spain, six in Germany and three in the Netherlands. "To date, this exploit has only been detected in euro zone countries, but a variation of this attack could potentially affect banks in countries outside of the European Union as well," according to the report. Individual transfer amounts made by Eurograbber malware have ranged from 500 euros ($656) to 250,000 euros ($328,000).

The malware used by attackers is a customized version of the Zitmo Trojan spyware application. Zitmo is short for "Zeus in the mobile," and the malware is designed to defeat the two-factor authentication systems employed by some banks. To do that, a companion, smartphone version of the malware intercepts the one-time transaction authentication number (TAN) that banks send to a customer's mobile device, via SMS, which the customer must then enter into a banking website prompt to authorize a money transfer.

[ Here is a good question: Can Banks Prevent The Next Cyber Attack? ]

The Zitmo Trojan can infect a PC if a user clicks on a malicious link in a spam or phishing email, or on a link on a website that's been compromised by attackers. The malicious Trojan application then remains dormant until a user logs into a targeted financial firm's website. "The next time the bank customer logs in to their bank account, the Eurograbber Trojan intercepts their banking session and injects a JavaScript into the customer's banking page," according to the report. "This malicious JavaScript informs the customer of the 'security upgrade' and instructs them on how to proceed."

The security upgrade page requests that the user indicated which mobile operating system their smartphone uses -- Android, BlackBerry, iOS (iPhone), Symbian (Nokia) or other -- as well as their mobile phone number. This information is then relayed to a drop zone, which is a publicly writable folder on a Web server -- which attackers may have previously hijacked -- where they store information about every infected bank customer's PC, including account numbers, log-in credentials, and one-time passwords.

A bogus confirmation SMS is then sent to the user's smartphone. "The SMS directs the customer to complete the security upgrade by clicking on the attached link. Doing so downloads a file onto the customer's mobile device with the appropriate mobile version of the Eurograbber Trojan," according to the report.

From then on, anytime that PC is used to log onto the targeted financial website, automatic attacks may take place, with the malware on the PC initiating transfers, and the malware on the smartphone intercepting any TAN sent by the bank, and automatically approving the transaction, which transfers money to mule accounts. "Victims' bank accounts will have lost money without their knowledge," according to the report. "This entire process occurs every time the bank customer logs into his or her bank account."

News of the Eurograbber Zitmo attack campaign follows the recent discovery of a cybercrime campaign waged using the Gameover Zeus Trojan, which steals banking credentials using phony but real-looking emails. Millions of those emails have been circulating in recent weeks, and are being distributed via the Cutwail spamming botnet.

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
User Rank: Ninja
12/6/2012 | 12:35:15 PM
re: Zeus Botnet Eurograbber Steals $47 Million
the problem is un-authorized programming, aka "malware" or "virus" not authentication.

User Rank: Apprentice
12/10/2012 | 8:03:20 PM
re: Zeus Botnet Eurograbber Steals $47 Million
The real challenge is that authenticating the end user and signing transactions all happen on the front end. A secure SMS text with an OTP that the MITM can't read is fine - the MITM doesn't need it. He wants you logged on - he's going to change your transaction details "in flight"
The front end is unsafe to the point that secure out-of-band, or out-of-channel communication from the backend is required. Not transaction signing, but transaction review and approval. A phone-based voice call that speaks your transaction details to you and permits approval or cancellation is one example, provided you can can defend against call forwarding and exploits against the phone. That takes a vendor with experience.

A smart app on a smart phone or tablet with an encrypted communication layer and a top of the stack application level encryption to protect it from ZITMO is another example. The app would let you review and approve or cancel the transaction if it isn't correct. Don't trust using an app on the same phone the banking app is on - mix and match. Bank on a tablet, validate the transaction on the smart phone. The BYOD trend should offer more ways to secure transactions, not fewer. The situation today is similar to the initial rush to online banking back in the 90's. Identity theft and account takeover were rampant because in the rush to get "there" - not a lot of thought was given to the vulnerabilities. The mobile rush is on and similar and similar pitfalls are happening. Now BEFORE anyone starts poking holes in the use of out-of-band, and phone-based authentication, or smart app as an out-of-band end point, as I said - you need a vendor that knows how to defend those channels against the exploits. Call forward, SIM swap, phone account takeover - and there are ways to defend the voice and 3G 4G channels. The sky is not falling, FI's just need to catch up.
Register for Dark Reading Newsletters
White Papers
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio