Vulnerabilities / Threats
7/23/2013
03:53 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%
Repost This

'Next Big' Banking Trojan Spotted In Cybercrime Underground

RSA says 'KINS' features a bootkit

Move over, Zeus and SpyEye: A new commercial banking Trojan is in the works, and it's the first one since the Citadel Trojan was yanked off the commercial malware market last December.

"This is the first actual commercial Trojan we've seen in a while, since Citadel was taken off the market. We haven't seen anything serious enough on the part of malware developers," says Limor Kessem, cybercrime specialist with RSA. "This is the first time something might materialize into a real, commercial banking Trojan" since then, she says.

RSA in February first began hearing hints of a new Trojan toolkit named "KINS," and then recently discovered an announcement of its sale in a closed Russian-speaking underground forum. An advertisement for KINS claims the Trojan was created "from scratch" and not part of another Trojan codebase, but Kessem says that remains to be seen. The kit should become available "soon," she says, so RSA researchers can then study the code and confirm its makeup.

KINS comes with a dropper and DLLs and Zeus-compatible Web injects, according to its creators, and sells for $5,000 in its standard kit form. Additional modules and plug-ins are another $2,000 apiece.

But what stands out most about the kit is that it includes a bootkit, Kessem says. "This guy is planning to bring in a bootkit. That's interesting. It's going to be an interesting way to have the Trojan infect a computer: It's more stealthy when it's a bootkit," she says.

No other commercial Trojan banking malware -- neither Zeus nor SpyEye -- came with a bootkit, she says. The Carberp Trojan creators offered to sell a bootkit for $40,000, but KINS is the first commercial Trojan that comes in bootkit mode, she says.

According to RSA, the commercial Trojan market has been missing a "stable offering" like KINS. "The ongoing turbulence since the leak of the Zeus code in mid-2011 has not given way to a stable offering in the underground, and it seems that professional cybercrime malware developers are just not what they used to be," RSA said in a blog post today on KINS.

Despite claims by KINS' author that the malware is not based on previous Trojans, RSA says the new malware has some obvious similarities with those predecessors, including a main file plus DLL plug-ins, compatibility with Zeus Web injections, the Anti-Rapport plug-in that came with SpyEye, and users in countries formerly with the USSR cannot get infected by KINS, which was a Citadel feature.

"It looks like the next big thing because of a few signs we see," RSA's Kessem says, such as being advertised in the Russian-speaking underground, and the features that are "very Trojan banking-like," she says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-0360
Published: 2014-04-23
Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCtn22376.

CVE-2012-1317
Published: 2014-04-23
The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route Processor crash) by sending packets at a high rate, aka Bug ID CSCts37717.

CVE-2012-1366
Published: 2014-04-23
Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544.

CVE-2012-3062
Published: 2014-04-23
Cisco IOS before 15.1(1)SY, when Multicast Listener Discovery (MLD) snooping is enabled, allows remote attackers to cause a denial of service (CPU consumption or device crash) via MLD packets on a network that contains many IPv6 hosts, aka Bug ID CSCtr88193.

CVE-2012-3918
Published: 2014-04-23
Cisco IOS before 15.3(1)T on Cisco 2900 devices, when a VWIC2-2MFT-T1/E1 card is configured for TDM/HDLC mode, allows remote attackers to cause a denial of service (serial-interface outage) via certain Frame Relay traffic, aka Bug ID CSCub13317.

Best of the Web