Vulnerabilities / Threats
10/6/2009
12:29 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

RSA: Cybergang Hid Money Trail Behind 'Fake' Mules

URLZone Trojan attackers made sure their real money mules remained anonymous

Turns out the bad guys using a sophisticated banking Trojan that covers its tracks also hid the identities of the money mule accounts they used.

Researchers from RSA's FraudAction Research Team discovered that the cybergang recently exposed in a report by Finjan knew its URLZone crimeware was being scrutinized, so the group set up decoy mule accounts in an attempt to dupe researchers and keep them from the real money-mule account information.

"The fraudsters check if the computer used by the researcher is part of the 'legitimate' botnet of URLzone-infected machines. If the computer is deemed to be a 'foreign' one -- in other words, if the criminals do not know the computer -- they deliver a fake mule account to the computer used by the researcher," RSA researchers blogged last night. "This is the way they prevent their real mules from being exposed."

Finjan had exposed how a group of attackers was using the so-called URLZone Trojan, which calls back to its command and control server for specific instructions on exactly how much to steal from the victim's bank account without raising any suspicion, and to which money mule account to send it the money. It also forges the victim's on-screen bank statements so the victim and bank don't see the unauthorized transaction. The bad guys had stolen around 200,000 euro each day from several European bank customers during a period of 22 days in August.

Money mules basically serve as the conduits for the stolen funds. They are typically unsuspecting users who believe they're performing a legitimate funds transfer for a job they were offered online. Shutting down those channels stops the money from moving, so keeping their information hidden keeps the flow of fraud alive.

But RSA says it turns out the money-mule information the cybergang "showed" was phony. The bad guys prevented researchers and investigators from seeing the actual mule accounts, instead displaying 400-plus legitimate accounts that do not actually belong to the gang's money mules. "The 'fake mules' method was conceived in order to ensure that the Trojans' real mule accounts are not exposed and subsequently blocked," RSA blogged.

And adding insult to injury, the fake mule accounts aimed at foiling researchers shows real bank account details from victims of the URLZone attacks. "The details of these payee accounts are screened by the Trojan according to various criteria to determine whether they should be added to the list of fake mule accounts. As long as PCs are infected with the Trojan, and victims continue to initiate online wire transfers, URLZone continues to replace payee details through MITB [man-in-the-browser] attacks and is growing a longer and longer list of fake mules," RSA says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4262
Published: 2014-07-28
svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows local users to gain privileges via a symlink attack on the pid file. NOTE: this issue was SPLIT due to different affected versions (ADT3). The irkerbridge.py issue is covered by CVE-...

CVE-2013-4840
Published: 2014-07-28
Unspecified vulnerability in HP and H3C VPN Firewall Module products SECPATH1000FE before 5.20.R3177 and SECBLADEFW before 5.20.R3177 allows remote attackers to cause a denial of service via unknown vectors.

CVE-2013-7393
Published: 2014-07-28
The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used. NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions...

CVE-2014-2974
Published: 2014-07-28
Cross-site request forgery (CSRF) vulnerability in php/user_account.php in Silver Peak VX through 6.2.4 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts.

CVE-2014-2975
Published: 2014-07-28
Cross-site scripting (XSS) vulnerability in php/user_account.php in Silver Peak VX before 6.2.4 allows remote attackers to inject arbitrary web script or HTML via the user_id parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.