Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/8/2016
03:40 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Japanese Banks Targeted With New Rovnix Trojan

US organizations need to monitor such threats because cyber criminals can easily modify and migrate such threats for use here, IBM says.

The language barrier that for long protected Japanese banks from being targeted by Trojan attacks appears to have been decisively overcome by cybercrime groups if the sustained attacks against the nation’s financial institutions over the past few months are any indication.

The latest manifestation of that trend is Rovnix, an advanced malware tool that is currently being used to target customers at as many as 14 major Japanese banks.

IBM’s X-Force security researchers have been tracking the banking Trojan for the past several months and this week described the Rovnix campaign against the banks as “nothing short of an onslaught.” The infection campaigns, which began in early December, include the use of email messages with an attachment containing the Rovnix downloader. Recipients who click on the attachment -- typically disguised as a package delivery waybill from an international transport company -- end up downloading the malware on their systems.

Until recently, the operators of Rovnix have used the malware mainly to target banks in Europe. But more recently, Rovnix’ configuration file appears to have been uniquely adapted to target banks in Japan, IBM researchers found. The malware contains attack schemes that have been specifically customized for each of the targeted banks.

Rovnix uses a Web injection mechanism that is capable of perfectly imitating a targeted bank’s Web pages. When a user with an infected computer visits the web page of a targeted bank, Rovnix serves up Web pages that look and feel exactly like the bank’s actual site. The malware is even capable of adapting itself to whatever authentication process the user might employ to log into the account. For instance, Rovnix in some cases tries to get victims to download a malicious Android app on their smartphone so it can intercept authorization codes send via SMS by the bank.

“For each bank, the injections used by Rovnix modify large parts of the original page, which is designed to trick the victim into divulging the second password or token for the ensuing fraudulent transaction,” IBM cybersecurity evangelist Limor Kessem wrote.

The use of convincing-sounding Japanese language email messages to distribute Rovnix and the level of customization that has gone into the attacks suggests that the gang behind Rovnix has put some thought into its campaign in Japan, IBM noted. The malware continues a trend that began last summer when cybercrime gangs suddenly turned their attention on Japanese banks after mostly ignoring it for the past several years. Since then, financial services companies in the country have been hammered by a succession of banking Trojans including Shifu and Tsukuba.

Etay Maor, senior cybersecurity strategist at IBM Security, says US organizations need to keep an eye on threats like Rovnix because of the ease with which cybercriminals can modify such malware for use here.

“Companies should pay specific attention to the amount of effort the attackers have put into this campaign as it shows the attackers studied how individual banks work, uncovered their security measures, and developed specific schemes for them,” Maor says.

The attackers put in the effort because they knew they could generate significant revenue through the campaign, he says. “It’s important for banks and financial institutions to monitor for these types of threats and campaigns as they can be quickly migrated to target the United States – or wherever [the attackers] determine is worth the investment.”

The growing sophistication of such malware is also a worry. Rovnix, for instance, has employed extensive mechanisms to protect against known security tools. The malware also leverages digital signatures in all communications and even uses code before the malware reaches the device to detect any anti-virus software or security measures that may be present on it, Maor says. “It uses many different modules to look into the device and be persistent in its attack. “

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
What the FedEx Logo Taught Me About Cybersecurity
Matt Shea, Head of Federal @ MixMode,  6/4/2021
Edge-DRsplash-10-edge-articles
A View From Inside a Deception
Sara Peters, Senior Editor at Dark Reading,  6/2/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23394
PUBLISHED: 2021-06-13
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
CVE-2021-34682
PUBLISHED: 2021-06-12
Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature.
CVE-2021-31811
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-31812
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-32552
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.