Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

7/26/2018
05:10 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Kronos Banking Trojan Resurfaces

Re-emergence of malware consistent with overall surge in banking malware activity this year, Proofpoint says.

Like a bad penny, the notorious Kronos banking Trojan has turned up again after disappearing from the threat landscape for well more than a year.

Security vendor Proopoint this week said it had recently observed a new variant of Kronos being used in separate campaigns against users in Germany, Japan, and Poland. A fourth campaign involving the malware appears to be in the works and is currently being tested.

The new variant is very similar to older versions except for the fact that it now uses the Tor anonymizing network for hiding its command-and-control (C&C) server.

Otherwise, the new version uses the same Windows API hashing techniques and hashes, encryption technique, C&C encryption mechanism, Zeus webinject format, and C&C panel layout. The new malware even includes a self-identifying string labeling it as Kronos.

The sudden reappearance is consistent with a broader resurgence in malicious activity involving banking Trojans so far this year, says Sherrod DeGrippo, director of emerging threats at Proofpoint. "We can only speculate on the reasons for the disappearance [of Kronos], but banking Trojans have come to dominate the threat landscape over the first half of 2018," she says.

One reason could be that ransomware has fallen out of favor among cybercriminals because of the volatility in prices of the cryptocurrencies used to make ransom payments, DeGrippo notes. Development activity around banking Trojans has surged even as threat actors' interest in ransomware has declined.

According to Proofpoint, a recent advertisement in an underground forum suggests that the authors of the latest Kronos variant are attempting to pass it off as a new banking Trojan dubbed Osiris. The description for Osiris — including the fact that it is written in C++, has keylogging and form-grabbing capabilities, and uses Tor and Zeus-formatted webinjects — suggests that the malware is simply the latest Kronos variant with a new name.

"This is essentially a rebranding of the old version of Kronos," DeGrippo says. "The use of Tor is really the only new feature of significance."

Kronos first surfaced in 2014 and is designed to steal the credentials and other information people use to log into their online banking accounts. The malware uses man-in-the-browser (MITB) techniques and webinjects to stealthily modify the Web pages of the financial institution a user might be attempting to log into in order to grab that person's credentials and later use it to steal money from the account.

The FBI has accused British security researcher Marcus Hutchins — the individual credited with stopping the WannaCry outbreak last year — of developing Kronos and distributing it to others between 2014 and 2015. Hutchins was arrested in August 2017 and is currently awaiting trial in the US on charges related to this and another malware kit dubbed Upas.

Kronos is similar to several other successful banking Trojans in many ways. But it does appear to have a habit of re-emerging every now and then, DeGrippo says. "Like Dridex, Zeus, Ursnif, and other bankers with substantial staying power, it comes down to malware authors and threat actors who are willing to invest in development and maintenance, as well as distribution and configuration of injects," she says.

The campaigns in Germany, Poland, and Japan that Proofpoint recently observed all involve the new Kronos variant but use slightly different techniques to infect end user systems. In Germany, users are being targeted via emails purporting to be from financial companies and seemingly pertaining to account updates and other accounts reminders. The emails contain Word documents with malicious macros that, if enabled, download the new Kronos variant.

The campaign in Japan has involved the use of a malvertising chain to send victims to a site with malicious JavaScript injections that redirect them to the RIG exploit kit, which then dumps the new Kronos variant on their systems. Polish users, meanwhile, are being targeted with emails containing a malicious attachment that, when executed, exploits CVE-2017-11882, a memory corruption issue in Microsoft Office, to download Kronos. Like the campaign in Germany, the emails in Poland come with subject headers designed to fool recipients into opening the attachments.

Banking Trojans are very hard for banks themselves to address since the malware operates on the client side and typically uses MITB-style attacks, DeGrippo says.

Much of the onus must fall on individuals to prevent infection in the first place. "While banks can implement two-factor authentication for some degree of protection, even this is not a panacea for modern, sophisticated banking Trojans and is often considered too burdensome by consumers," she says.

Related Content:

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Jim, stop pretending you're drowning in tickets."
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3571
PUBLISHED: 2019-07-16
An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed with a wrong extension.
CVE-2019-6160
PUBLISHED: 2019-07-16
A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API.
CVE-2019-9700
PUBLISHED: 2019-07-16
Norton Password Manager, prior to 6.3.0.2082, may be susceptible to an address spoofing issue. This type of issue may allow an attacker to disguise their origin IP address in order to obfuscate the source of network traffic.
CVE-2019-12990
PUBLISHED: 2019-07-16
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.
CVE-2019-12991
PUBLISHED: 2019-07-16
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).