Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Holy Zeus! Popular Botnet Rules As New Exploits Come Online

Trusteer, AVG identify new botnets with different features, both built on Zeus technology

If there's a "fashion trend" among botnet builders, Zeus is the new black -- but its popularity is making many users and security professionals see red.

Zeus, a Trojan horse that spreads bots quickly, can be adapted for multiple purposes, is available in botnet-building kits, and serves as the platform for a growing number of botnets and sub-botnets that are being exploited across the globe, according to experts. In the past two days, researchers at Trusteer and AVG revealed details about two new instances of Zeus-based botnets, suggesting the Trojan is becoming more popular than ever.

Trusteer today announced it uncovered a large Zeus version 2 botnet that is operated and controlled from Eastern Europe and is used to conduct financial fraud in the U.K.

"The botnet appears to be controlling more than 100,000 infected computers, 98 percent of which are U.K. Internet users," Trusteer says. "The criminals have been harvesting all manner of potentially lucrative and revenue-producing credentials, including online account IDs, plus login information to banks, credit and debit card numbers, account types plus balances, bank statements, browser cookies, client side certificates, login information for email accounts and social networks, and even FTP passwords."

Trusteer discovered the extent of the botnet after researchers gained access to the botnet's drop servers and command and control center, which contained "hundreds of thousands" of stolen credentials.

"This is just one out of many Zeus 2 botnets operating all over the world," says Amit Klein, Trusteer's CTO. "What is especially worrying is that this botnet doesn't just stop at user IDs and passwords. By harvesting client-side certificates and cookies, the cybercriminals can extract a lot of extra information on the user that can be used to augment their illegal access to those users' online accounts.

"Coupled with the ability to remotely control users' machines, download data, and run any file on them, this means that the fraudsters can insert partial or complete Internet pages into a live Web session, enabling them to inject transactions at will or extract even more data from the hapless victims," Klein says.

The Zeus implementation is "fraudsters' ultimate paradise," Klein says, "giving them hidden access to the users' online financial and allied activities as surely as if they sat at their shoulders watching their every keystroke, move, and online action."

Separately, researchers at AVG yesterday released a white paper (PDF) that outlines details on Mumba, a new Zeus-based botnet that immediately infected more than 35,000 computers when it launched in April.

The botnet has now collected at least 60 GB of information from some 55,000 computers, half of which are in the U.K. and Germany, according to an AVG analysis of a server that was used to collect the data.

The Mumba botnet is probably controlled by the Avalanche Group, which specializes in phishing sites as well as malware, AVG says. It uses at least four different variants of Zeus, which can be adapted to send spam, steal financial information, or spread malware, the researchers say.

"The Mumba botnet is probably one of the first to use the Avalanche operation in order to host its stolen goods as well as the malware infection," the white paper says. "This seems to be yet another step in the never ending arms race between the security industry and cybercriminals."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
US Sets $5 Million Bounty For Russian Hacker Behind Zeus Banking Thefts
Jai Vijayan, Contributing Writer,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-12-11
Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.
PUBLISHED: 2019-12-11
Yabasic 2.86.1 has a heap-based buffer overflow in the yylex() function in flex.c via a crafted BASIC source file.
PUBLISHED: 2019-12-11
On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices (with firmware through 6.0), denial of service can occur via PROFINET DCE-RPC endpoint discovery packets.
PUBLISHED: 2019-12-11
The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.
PUBLISHED: 2019-12-11
MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.