Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Holy Zeus! Popular Botnet Rules As New Exploits Come Online

Trusteer, AVG identify new botnets with different features, both built on Zeus technology

If there's a "fashion trend" among botnet builders, Zeus is the new black -- but its popularity is making many users and security professionals see red.

Zeus, a Trojan horse that spreads bots quickly, can be adapted for multiple purposes, is available in botnet-building kits, and serves as the platform for a growing number of botnets and sub-botnets that are being exploited across the globe, according to experts. In the past two days, researchers at Trusteer and AVG revealed details about two new instances of Zeus-based botnets, suggesting the Trojan is becoming more popular than ever.

Trusteer today announced it uncovered a large Zeus version 2 botnet that is operated and controlled from Eastern Europe and is used to conduct financial fraud in the U.K.

"The botnet appears to be controlling more than 100,000 infected computers, 98 percent of which are U.K. Internet users," Trusteer says. "The criminals have been harvesting all manner of potentially lucrative and revenue-producing credentials, including online account IDs, plus login information to banks, credit and debit card numbers, account types plus balances, bank statements, browser cookies, client side certificates, login information for email accounts and social networks, and even FTP passwords."

Trusteer discovered the extent of the botnet after researchers gained access to the botnet's drop servers and command and control center, which contained "hundreds of thousands" of stolen credentials.

"This is just one out of many Zeus 2 botnets operating all over the world," says Amit Klein, Trusteer's CTO. "What is especially worrying is that this botnet doesn't just stop at user IDs and passwords. By harvesting client-side certificates and cookies, the cybercriminals can extract a lot of extra information on the user that can be used to augment their illegal access to those users' online accounts.

"Coupled with the ability to remotely control users' machines, download data, and run any file on them, this means that the fraudsters can insert partial or complete Internet pages into a live Web session, enabling them to inject transactions at will or extract even more data from the hapless victims," Klein says.

The Zeus implementation is "fraudsters' ultimate paradise," Klein says, "giving them hidden access to the users' online financial and allied activities as surely as if they sat at their shoulders watching their every keystroke, move, and online action."

Separately, researchers at AVG yesterday released a white paper (PDF) that outlines details on Mumba, a new Zeus-based botnet that immediately infected more than 35,000 computers when it launched in April.

The botnet has now collected at least 60 GB of information from some 55,000 computers, half of which are in the U.K. and Germany, according to an AVG analysis of a server that was used to collect the data.

The Mumba botnet is probably controlled by the Avalanche Group, which specializes in phishing sites as well as malware, AVG says. It uses at least four different variants of Zeus, which can be adapted to send spam, steal financial information, or spread malware, the researchers say.

"The Mumba botnet is probably one of the first to use the Avalanche operation in order to host its stolen goods as well as the malware infection," the white paper says. "This seems to be yet another step in the never ending arms race between the security industry and cybercriminals."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio


Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.