Avalanche botnet moves from distributing spam to Zeus lures

By on
Avalanche botnet moves from distributing spam to Zeus lures

"An ominous development".

The world's most prolific phishing gang is now using a major botnet to distribute messages to lure victims into being infected with Zeus.

Researchers from the Anti Phishing Working Group (APWG) found that while the Avalanche botnet infrastructure had been used to launch conventional spam-based phishing attacks over the past two years, the messages had been replaced with spam that infects users' PCs with the Zeus Trojan.

Previously the Avalanche botnet was used for conventional spam-based phishing attacks to provoke a user into visiting a counterfeit website and enter their credentials. This accounted for two-thirds of all global phishing attacks in the second half of 2009.

However APWG research found that Avalanche was involved in just four conventional phishing attacks in the month of July 2010, with its operators ramping up a concerted campaign of crimeware propagation to fool victims into receiving the Zeus crimeware.

Lures, generally in the form of faked messages from tax authorities or as alerts/updates from social networking sites, take victims to drive-by download sites where they are infected.

Once a machine is infected, the criminals can remotely access it, steal the personal information stored on it, and intercept passwords and online transactions. The criminals can even log into the victim's machine to perform online banking transactions.

Co-author of the study, Rod Rasmussen called the shift of Avalanche from spam to the distribution of Zeus "an ominous development in the e-crime landscape".

“Their spamming and other activities to target victims continues at high levels, implying they are finding malware distribution a more effective and profitable tactic than traditional phishing,” he said.

Co-author Greg Aaron said: “The Avalanche criminals recently rented a large botnet called Cutwail to send out massive amounts of spam lures. Those spams led unsuspecting internet users to Zeus crimeware hosted on the Avalanche botnet. So this is a good example of how e-criminals don't work in isolation, and often use multiple tools like spam, malware, botnets and phishing to do their work.”

Amichai Shulman, CTO of Imperva, said: “What is apparent from our research is that the Avalanche cyber crime gang are also using advanced programming techniques. The problem is that the banks and users don't realise that the client browser is actually under the control of the hacker. So although a user is in fact authenticated to the bank, all transactions are actually being performed from that moment on by the trojan.

“Until the banks are able to prevent against this type of complex malware-driven fraud, the cyber criminal gangs will continue to evolve their already sophisticated strategies to beat the banks and their customers.”

See original article on scmagazineus.com

Copyright © SC Magazine, US edition
Tags:

Most Read Articles

You must be a registered member of iTnews to post a comment.
| Register

Poll

New Windows 10 users, are you upgrading from...
Windows 8
Windows 7
Windows XP
Another operating system
Windows Vista
How should the costs of Australia's piracy scheme be split?
Rights holders should foot the whole bill
50/50
ISPs should foot the whole bill
Government should chip in a bit
Other
View poll archive

Whitepapers from our sponsors

What will the stadium of the future look like?
What will the stadium of the future look like?
New technology adoption is pushing enterprise networks to breaking point
New technology adoption is pushing enterprise networks to breaking point
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
The next era of business continuity: Are you ready for an always-on world?
The next era of business continuity: Are you ready for an always-on world?

Log In

Username:
Password:
|  Forgot your password?