Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

12/4/2012
05:05 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

'Gameover Zeus' Gang Launches New Attacks

Campaign includes rigged emails spoofing major U.S. banks and offering 'secure email' exchange with banking customers

The cybercrime group behind the Gameover Zeus Trojan that steals online banking creds and credit card numbers is waging a massive malicious email campaign that enlists the massive Cutwail spamming botnet to blast its emails.

Millions of emails -- many of which pose as coming from major U.S. banks -- have been spammed out in recent weeks, according to Dell SecureWorks' Counter Threat Unit. The phony but convincing-looking emails appeal to a more security-minded banking customer: "You have received a new encrypted message or a secure message from [XYZ] Bank," one of the email campaigns says, noting that the bank has set up a secure email exchange for its customers as a way to allay privacy and security concerns.

The message includes an infected attachment that the "bank" requires for download and registration to the supposed secure email system. Once downloaded, it executes the pony downloader Trojan that installs Gameover and steals online banking credentials, credit card account numbers, and other information.

Another email campaign claims the recipient has received a fax, scan, or voicemail, and includes a "free program" for retrieving the message -- but, of course, the attachment installs the malware.

The Gameover gang, unlike some cybercrime groups, doesn't lease or sell its malware or services. It's a closed operation that, instead, sometimes contracts resources such as the Cutwail botnet to transport its attacks. More than half of the Top 20 Fortune 500 firms were infected with the Trojan as of this summer, according to SecureWorks, which in July published a report on Gameover

"This particular group has found a combination of malware, tactics, and procedures that leads to success for them. They will continue to follow the same process [of working this way]," says Jon Ramsey, CTO of Dell SecureWorks. "The malware they use is a private version of theirs, and they don't sell it on the black market. They feel there's more of an upside financially in keeping it private."

Ramsey says the gang has had plenty of success creating large botnets for both sending more malicious spam and conducting distributed denial-of-service attacks. They're using a dual-botnet sort of model with Cutwail transporting the spam, and subsequently infected Gameover bots spreading their infections and doing the Gameover botnet operators' bidding.

About 678,205 machines were infected with Gameover Zeus in August, according to SecureWorks, and it's the biggest botnet targeting financial institutions today. Fourteen of the 20 top Fortune 500 firms are infected, including financial services firms, defense contractors, government agencies, law enforcement, military, and universities.

The peer-to-peer Gameover botnet was structured to deter disruption and to make attribution more difficult. Even so, peer-to-peer botnets are easier to "poison" by using phony peers that allow researchers to sinkhole traffic, according to Brett Stone-Gross, who has closely studied Gameover.

"The P2P ZeuS crew receives considerable support from the products and services offered by the underground community, who collectively fulfill vital functions to plan and execute a large successful cybercriminal operation. Moreover, the large number of compromised personal computers and web servers provide a robust and low cost infrastructure for a variety of malicious activities," Stone-Gross wrote in his report.

[Trade-offs are a fact of life for network defenders, but attackers have to abide them as well. See The Attacker's Trade-Off: Stealth Versus Resilience.]

Cutwail, one of the world's largest botnets, to date contains around 500,000 or so bots, according to SecureWorks data.

Researchers at LookingGlass Cyber Solutions say the top 10 countries infected by the Cutwail botnet, in order, are: India, Iran, China, Vietnam, Ukraine, Kazakhstan, Belarus, the U.S., South Korea, and Brazil.

"We saw 43,332 unique hosts infected with Cutwail on December 3, 2012," says Jason Lewis, chief scientist with LookingGlass. Overall, the researchers saw some 203,117 bots sending spam -- from botnets including Cutwail, Asprox, Festi, and Kelihos.

"About 3,000 hosts had multiple infections," Lewis says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DarkReadingTim
50%
50%
DarkReadingTim,
User Rank: Strategist
12/5/2012 | 2:39:04 PM
re: 'Gameover Zeus' Gang Launches New Attacks
Attacks on banks continue to be a favorite for cybercriminals. I'll be posting a story on a new attack on European banks later today.-
-- Tim Wilson, editor, Dark Reading
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15208
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can ...
CVE-2020-15209
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one....
CVE-2020-15210
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and ...
CVE-2020-15211
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices f...
CVE-2020-15212
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `outpu...