RSA: Cybergang Hid Money Trail Behind 'Fake' Mules

Turns out the bad guys using a sophisticated banking Trojan that covers its tracks also hid the identities of the money mule accounts they used.

Researchers from RSA's FraudAction Research Team discovered that the cybergang recently exposed in a report by Finjan knew its URLZone crimeware was being scrutinized, so the group set up decoy mule accounts in an attempt to dupe researchers and keep them from the real money-mule account information.

"The fraudsters check if the computer used by the researcher is part of the 'legitimate' botnet of URLzone-infected machines. If the computer is deemed to be a 'foreign' one -- in other words, if the criminals do not know the computer -- they deliver a fake mule account to the computer used by the researcher," RSA researchers blogged last night. "This is the way they prevent their real mules from being exposed."

Finjan had exposed how a group of attackers was using the so-called URLZone Trojan, which calls back to its command and control server for specific instructions on exactly how much to steal from the victim's bank account without raising any suspicion, and to which money mule account to send it the money. It also forges the victim's on-screen bank statements so the victim and bank don't see the unauthorized transaction. The bad guys had stolen around 200,000 euro each day from several European bank customers during a period of 22 days in August.

Money mules basically serve as the conduits for the stolen funds. They are typically unsuspecting users who believe they're performing a legitimate funds transfer for a job they were offered online. Shutting down those channels stops the money from moving, so keeping their information hidden keeps the flow of fraud alive.

But RSA says it turns out the money-mule information the cybergang "showed" was phony. The bad guys prevented researchers and investigators from seeing the actual mule accounts, instead displaying 400-plus legitimate accounts that do not actually belong to the gang's money mules. "The 'fake mules' method was conceived in order to ensure that the Trojans' real mule accounts are not exposed and subsequently blocked," RSA blogged.

And adding insult to injury, the fake mule accounts aimed at foiling researchers shows real bank account details from victims of the URLZone attacks. "The details of these payee accounts are screened by the Trojan according to various criteria to determine whether they should be added to the list of fake mule accounts. As long as PCs are infected with the Trojan, and victims continue to initiate online wire transfers, URLZone continues to replace payee details through MITB [man-in-the-browser] attacks and is growing a longer and longer list of fake mules," RSA says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.