Vulnerabilities / Threats
03:40 PM
Connect Directly

Japanese Banks Targeted With New Rovnix Trojan

US organizations need to monitor such threats because cyber criminals can easily modify and migrate such threats for use here, IBM says.

The language barrier that for long protected Japanese banks from being targeted by Trojan attacks appears to have been decisively overcome by cybercrime groups if the sustained attacks against the nation’s financial institutions over the past few months are any indication.

The latest manifestation of that trend is Rovnix, an advanced malware tool that is currently being used to target customers at as many as 14 major Japanese banks.

IBM’s X-Force security researchers have been tracking the banking Trojan for the past several months and this week described the Rovnix campaign against the banks as “nothing short of an onslaught.” The infection campaigns, which began in early December, include the use of email messages with an attachment containing the Rovnix downloader. Recipients who click on the attachment -- typically disguised as a package delivery waybill from an international transport company -- end up downloading the malware on their systems.

Until recently, the operators of Rovnix have used the malware mainly to target banks in Europe. But more recently, Rovnix’ configuration file appears to have been uniquely adapted to target banks in Japan, IBM researchers found. The malware contains attack schemes that have been specifically customized for each of the targeted banks.

Rovnix uses a Web injection mechanism that is capable of perfectly imitating a targeted bank’s Web pages. When a user with an infected computer visits the web page of a targeted bank, Rovnix serves up Web pages that look and feel exactly like the bank’s actual site. The malware is even capable of adapting itself to whatever authentication process the user might employ to log into the account. For instance, Rovnix in some cases tries to get victims to download a malicious Android app on their smartphone so it can intercept authorization codes send via SMS by the bank.

“For each bank, the injections used by Rovnix modify large parts of the original page, which is designed to trick the victim into divulging the second password or token for the ensuing fraudulent transaction,” IBM cybersecurity evangelist Limor Kessem wrote.

The use of convincing-sounding Japanese language email messages to distribute Rovnix and the level of customization that has gone into the attacks suggests that the gang behind Rovnix has put some thought into its campaign in Japan, IBM noted. The malware continues a trend that began last summer when cybercrime gangs suddenly turned their attention on Japanese banks after mostly ignoring it for the past several years. Since then, financial services companies in the country have been hammered by a succession of banking Trojans including Shifu and Tsukuba.

Etay Maor, senior cybersecurity strategist at IBM Security, says US organizations need to keep an eye on threats like Rovnix because of the ease with which cybercriminals can modify such malware for use here.

“Companies should pay specific attention to the amount of effort the attackers have put into this campaign as it shows the attackers studied how individual banks work, uncovered their security measures, and developed specific schemes for them,” Maor says.

The attackers put in the effort because they knew they could generate significant revenue through the campaign, he says. “It’s important for banks and financial institutions to monitor for these types of threats and campaigns as they can be quickly migrated to target the United States – or wherever [the attackers] determine is worth the investment.”

The growing sophistication of such malware is also a worry. Rovnix, for instance, has employed extensive mechanisms to protect against known security tools. The malware also leverages digital signatures in all communications and even uses code before the malware reaches the device to detect any anti-virus software or security measures that may be present on it, Maor says. “It uses many different modules to look into the device and be persistent in its attack. “


Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
According to industry estimates, about a million new IT security jobs will be created in the next two years but there aren't enough skilled professionals to fill them. On top of that, there isn't necessarily a clear path to a career in security. Dark Reading Executive Editor Kelly Jackson Higgins hosts guests Carson Sweet, co-founder and CTO of CloudPassage, which published a shocking study of the security gap in top US undergrad computer science programs, and Rodney Petersen, head of NIST's new National Initiative for Cybersecurity Education.