Banking malware proves tough to repel

Dridex, Bebloh, TinyBanker and Dyre abound, according to SecurityScorecard

SecurityScorecard found thousands of organizations infected with sophisticated banking malware, including one called Dridex.

SecurityScorecard found thousands of organizations infected with sophisticated banking malware, including one called Dridex.

Companies are finding it tough to keep out new types of banking malware, which continue to get better following the bar-raising threat known as Zeus.

The malicious programs all aim to swiftly and secretly steal credentials for online bank accounts, with some specializing in making large, unauthorized wire transfers from businesses using the ACH (Automated Clearing House) system.

A study by the firm SecurityScorecard, which specializes in tracking a company's risk of intrusion, found more than 4,700 organizations that were infected by some type of advanced banking malware.

SecurityScorecard collected the data in part by using sinkholes, or computers that researchers control which are part of a network of infected machines, known as a botnet. An analysis of those sinkholes can lend insight into how many machines may be infected with a particular type of malware.

The company also looks at spam campaigns, vulnerabilities in web applications, malware campaigns conducted using social media and monitors underground hacking forums, said Alex Heid, chief research officer.

"For hackers, you always want to look for the weakest link and pivot in," he said.

The study, conducted over the first five months of this year, found 11,952 infections affecting 4,703 organizations. Some of those organizations are customers of SecurityScorecard, while others are partners of those customers.

When SecurityScorecard evaluates a customer's network, the customer also shares information about their partners, who may also have access to their systems.

It's those relationships that are increasingly being targeted by hackers. Target and Home Depot both attributed large payment card breaches to the infiltration of third-party contractors whose credentials gave access to their systems.

The top banking malware families that have been circulating are Dridex, Bebloh and TinyBanker, Heid said.

Dridex spreads through spam that contains attachments to malicious XML files or Microsoft Office documents with macros, he said. Bebloh is hard to detect since it makes few changes to the computers it infects. TinyBanker -- named for its small 20K size -- is hard to find as well since its creators often change its digital footprint, which allows it to evade security products, he said.

Those distributing malware try to make sure their programs are FUD, or fully undetectable. They do that by using tools to encrypt the software called crypters or packers, which compress the file in a way that makes it hard to detect, Heid said.

SecurityScorecard also found instances of Dyre, another banking malware program that descended from the infamous Zeus software.

The U.S. Department of Justice, working with security researchers, managed to shut down the Gameover Zeus botnet in mid-2014. The botnet and associated malware stole as much as US$100 million.

Send news tips and comments to Follow me on Twitter: @jeremy_kirk

Join the CSO newsletter!

Error: Please check your email address.

Tags SecurityScorecardsecuritymalware

More about Department of JusticeHome DepotMicrosoftTwitter

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts