Zeus Trojan Targets Online Payroll Services Providers
New attack could be used for paying money mules from victimized corporate accounts
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
The prolific Zeus Trojan has a new role: as a tool for breaking into online corporate payroll systems.
Researchers at Trusteer today said they spotted and studied a variant of the Trojan that attacked Canadian human resources and payroll services provider Ceridian. The attack grabs a screenshot of Ceridian's payroll services Web page when a Zeus-infected user logs into the site. Then the Trojan steals the users' credentials, company number, and the icon he uses for image-based authentication on the site.
"The more interesting issue here is who's being targeted ... payroll cloud services," says Oren Kedem, director of product marketing for Trusteer. Kedem says this could allow cybercriminals to add phony employees to the payroll -- namely money mules -- and transfer payment from the victimized business.
"We've seen with other incidents malware that's able to attack payroll systems and add fake employees," he says. "But we haven't seen this combination of using Zeus to [be able to] do this type of attack. That's a new combination."
Trusteer's Kedem says it's unclear whether an actual attack occurred against Ceridian, but it was clear that the Zeus configuration was designed to execute a first stage of attack. "We don't have information on" whether the attackers got credentials and attacked an employee payroll system, he says.
Zeus is still No. 1 for cybercime, he says. "This is an indication that attackers are looking at other ways of making money," he says.
Cloud providers, meanwhile, are prone to these types of attacks, Kedem says. "If you were running your payroll internally, you would actually need to have access to it internally. This [Zeus] attack would not work on a non-cloud-based payroll system, so the cloud is easier to attack because you could access it from your home."
Trusteer posted a blog about the new Zeus attack here.
Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024