Zeus Trojan Targets Online Payroll Services Providers

New attack could be used for paying money mules from victimized corporate accounts

Dark Reading Staff, Dark Reading

April 10, 2012

2 Min Read

The prolific Zeus Trojan has a new role: as a tool for breaking into online corporate payroll systems.

Researchers at Trusteer today said they spotted and studied a variant of the Trojan that attacked Canadian human resources and payroll services provider Ceridian. The attack grabs a screenshot of Ceridian's payroll services Web page when a Zeus-infected user logs into the site. Then the Trojan steals the users' credentials, company number, and the icon he uses for image-based authentication on the site.

"The more interesting issue here is who's being targeted ... payroll cloud services," says Oren Kedem, director of product marketing for Trusteer. Kedem says this could allow cybercriminals to add phony employees to the payroll -- namely money mules -- and transfer payment from the victimized business.

"We've seen with other incidents malware that's able to attack payroll systems and add fake employees," he says. "But we haven't seen this combination of using Zeus to [be able to] do this type of attack. That's a new combination."

Trusteer's Kedem says it's unclear whether an actual attack occurred against Ceridian, but it was clear that the Zeus configuration was designed to execute a first stage of attack. "We don't have information on" whether the attackers got credentials and attacked an employee payroll system, he says.

Zeus is still No. 1 for cybercime, he says. "This is an indication that attackers are looking at other ways of making money," he says.

Cloud providers, meanwhile, are prone to these types of attacks, Kedem says. "If you were running your payroll internally, you would actually need to have access to it internally. This [Zeus] attack would not work on a non-cloud-based payroll system, so the cloud is easier to attack because you could access it from your home."

Trusteer posted a blog about the new Zeus attack here.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights