Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

7/26/2018
05:10 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Kronos Banking Trojan Resurfaces

Re-emergence of malware consistent with overall surge in banking malware activity this year, Proofpoint says.

Like a bad penny, the notorious Kronos banking Trojan has turned up again after disappearing from the threat landscape for well more than a year.

Security vendor Proopoint this week said it had recently observed a new variant of Kronos being used in separate campaigns against users in Germany, Japan, and Poland. A fourth campaign involving the malware appears to be in the works and is currently being tested.

The new variant is very similar to older versions except for the fact that it now uses the Tor anonymizing network for hiding its command-and-control (C&C) server.

Otherwise, the new version uses the same Windows API hashing techniques and hashes, encryption technique, C&C encryption mechanism, Zeus webinject format, and C&C panel layout. The new malware even includes a self-identifying string labeling it as Kronos.

The sudden reappearance is consistent with a broader resurgence in malicious activity involving banking Trojans so far this year, says Sherrod DeGrippo, director of emerging threats at Proofpoint. "We can only speculate on the reasons for the disappearance [of Kronos], but banking Trojans have come to dominate the threat landscape over the first half of 2018," she says.

One reason could be that ransomware has fallen out of favor among cybercriminals because of the volatility in prices of the cryptocurrencies used to make ransom payments, DeGrippo notes. Development activity around banking Trojans has surged even as threat actors' interest in ransomware has declined.

According to Proofpoint, a recent advertisement in an underground forum suggests that the authors of the latest Kronos variant are attempting to pass it off as a new banking Trojan dubbed Osiris. The description for Osiris — including the fact that it is written in C++, has keylogging and form-grabbing capabilities, and uses Tor and Zeus-formatted webinjects — suggests that the malware is simply the latest Kronos variant with a new name.

"This is essentially a rebranding of the old version of Kronos," DeGrippo says. "The use of Tor is really the only new feature of significance."

Kronos first surfaced in 2014 and is designed to steal the credentials and other information people use to log into their online banking accounts. The malware uses man-in-the-browser (MITB) techniques and webinjects to stealthily modify the Web pages of the financial institution a user might be attempting to log into in order to grab that person's credentials and later use it to steal money from the account.

The FBI has accused British security researcher Marcus Hutchins — the individual credited with stopping the WannaCry outbreak last year — of developing Kronos and distributing it to others between 2014 and 2015. Hutchins was arrested in August 2017 and is currently awaiting trial in the US on charges related to this and another malware kit dubbed Upas.

Kronos is similar to several other successful banking Trojans in many ways. But it does appear to have a habit of re-emerging every now and then, DeGrippo says. "Like Dridex, Zeus, Ursnif, and other bankers with substantial staying power, it comes down to malware authors and threat actors who are willing to invest in development and maintenance, as well as distribution and configuration of injects," she says.

The campaigns in Germany, Poland, and Japan that Proofpoint recently observed all involve the new Kronos variant but use slightly different techniques to infect end user systems. In Germany, users are being targeted via emails purporting to be from financial companies and seemingly pertaining to account updates and other accounts reminders. The emails contain Word documents with malicious macros that, if enabled, download the new Kronos variant.

The campaign in Japan has involved the use of a malvertising chain to send victims to a site with malicious JavaScript injections that redirect them to the RIG exploit kit, which then dumps the new Kronos variant on their systems. Polish users, meanwhile, are being targeted with emails containing a malicious attachment that, when executed, exploits CVE-2017-11882, a memory corruption issue in Microsoft Office, to download Kronos. Like the campaign in Germany, the emails in Poland come with subject headers designed to fool recipients into opening the attachments.

Banking Trojans are very hard for banks themselves to address since the malware operates on the client side and typically uses MITB-style attacks, DeGrippo says.

Much of the onus must fall on individuals to prevent infection in the first place. "While banks can implement two-factor authentication for some degree of protection, even this is not a panacea for modern, sophisticated banking Trojans and is often considered too burdensome by consumers," she says.

Related Content:

 

 

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
7 SMB Security Tips That Will Keep Your Company Safe
Steve Zurier, Contributing Writer,  10/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: The old using of sock puppets for Shoulder Surfing technique. 
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8071
PUBLISHED: 2019-10-17
Adobe Download Manager versions 2.0.0.363 have an insecure file permissions vulnerability. Successful exploitation could lead to privilege escalation.
CVE-2019-10752
PUBLISHED: 2019-10-17
Sequelize, all versions prior to version 4.44.3 and 5.15.1, is vulnerable to SQL Injection due to sequelize.json() helper function not escaping values properly when formatting sub paths for JSON queries for MySQL, MariaDB and SQLite.
CVE-2019-12611
PUBLISHED: 2019-10-17
An issue was discovered in Bitdefender BOX firmware versions before 2.1.37.37-34 that affects the general reliability of the product. Specially crafted packets sent to the miniupnpd implementation in result in the device allocating memory without freeing it later. This behavior can cause the miniupn...
CVE-2019-13657
PUBLISHED: 2019-10-17
CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security.
CVE-2019-15626
PUBLISHED: 2019-10-17
The Deep Security Manager application (Versions 10.0, 11.0 and 12.0), when configured in a certain way, may transmit initial LDAP communication in clear text. This may result in confidentiality impact but does not impact integrity or availability.