Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/8/2016
03:40 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Japanese Banks Targeted With New Rovnix Trojan

US organizations need to monitor such threats because cyber criminals can easily modify and migrate such threats for use here, IBM says.

The language barrier that for long protected Japanese banks from being targeted by Trojan attacks appears to have been decisively overcome by cybercrime groups if the sustained attacks against the nation’s financial institutions over the past few months are any indication.

The latest manifestation of that trend is Rovnix, an advanced malware tool that is currently being used to target customers at as many as 14 major Japanese banks.

IBM’s X-Force security researchers have been tracking the banking Trojan for the past several months and this week described the Rovnix campaign against the banks as “nothing short of an onslaught.” The infection campaigns, which began in early December, include the use of email messages with an attachment containing the Rovnix downloader. Recipients who click on the attachment -- typically disguised as a package delivery waybill from an international transport company -- end up downloading the malware on their systems.

Until recently, the operators of Rovnix have used the malware mainly to target banks in Europe. But more recently, Rovnix’ configuration file appears to have been uniquely adapted to target banks in Japan, IBM researchers found. The malware contains attack schemes that have been specifically customized for each of the targeted banks.

Rovnix uses a Web injection mechanism that is capable of perfectly imitating a targeted bank’s Web pages. When a user with an infected computer visits the web page of a targeted bank, Rovnix serves up Web pages that look and feel exactly like the bank’s actual site. The malware is even capable of adapting itself to whatever authentication process the user might employ to log into the account. For instance, Rovnix in some cases tries to get victims to download a malicious Android app on their smartphone so it can intercept authorization codes send via SMS by the bank.

“For each bank, the injections used by Rovnix modify large parts of the original page, which is designed to trick the victim into divulging the second password or token for the ensuing fraudulent transaction,” IBM cybersecurity evangelist Limor Kessem wrote.

The use of convincing-sounding Japanese language email messages to distribute Rovnix and the level of customization that has gone into the attacks suggests that the gang behind Rovnix has put some thought into its campaign in Japan, IBM noted. The malware continues a trend that began last summer when cybercrime gangs suddenly turned their attention on Japanese banks after mostly ignoring it for the past several years. Since then, financial services companies in the country have been hammered by a succession of banking Trojans including Shifu and Tsukuba.

Etay Maor, senior cybersecurity strategist at IBM Security, says US organizations need to keep an eye on threats like Rovnix because of the ease with which cybercriminals can modify such malware for use here.

“Companies should pay specific attention to the amount of effort the attackers have put into this campaign as it shows the attackers studied how individual banks work, uncovered their security measures, and developed specific schemes for them,” Maor says.

The attackers put in the effort because they knew they could generate significant revenue through the campaign, he says. “It’s important for banks and financial institutions to monitor for these types of threats and campaigns as they can be quickly migrated to target the United States – or wherever [the attackers] determine is worth the investment.”

The growing sophistication of such malware is also a worry. Rovnix, for instance, has employed extensive mechanisms to protect against known security tools. The malware also leverages digital signatures in all communications and even uses code before the malware reaches the device to detect any anti-virus software or security measures that may be present on it, Maor says. “It uses many different modules to look into the device and be persistent in its attack. “

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Can you smell me now?
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11844
PUBLISHED: 2020-05-29
There is an Incorrect Authorization vulnerability in Micro Focus Service Management Automation (SMA) product affecting version 2018.05 to 2020.02. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.
CVE-2020-6937
PUBLISHED: 2020-05-29
A Denial of Service vulnerability in MuleSoft Mule CE/EE 3.8.x, 3.9.x, and 4.x released before April 7, 2020, could allow remote attackers to submit data which can lead to resource exhaustion.
CVE-2020-7648
PUBLISHED: 2020-05-29
All versions of snyk-broker before 4.72.2 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users who have access to Snyk's internal network by appending the URL with a fragment identifier and a whitelisted path e.g. `#package.json`
CVE-2020-7650
PUBLISHED: 2020-05-29
All versions of snyk-broker after 4.72.0 including and before 4.73.1 are vulnerable to Arbitrary File Read. It allows arbitrary file reads to users with access to Snyk's internal network of any files ending in the following extensions: yaml, yml or json.
CVE-2020-7654
PUBLISHED: 2020-05-29
All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG.