NukeBot: New Ready-to-Attack Version of
Dangerous Banking Trojan Caught in the Wild
Dangerous Banking Trojan Caught in the Wild
25 July 2017
Kaspersky Lab researchers have detected
NukeBot – new malware which has been designed to steal the credentials of
online banking customers. Earlier versions of the Trojan were known to the
security industry as TinyNuke, but lacked the features necessary to launch
attacks. The latest versions however, are fully operable, and contain code to
target the users of specific banks.
NukeBot – new malware which has been designed to steal the credentials of
online banking customers. Earlier versions of the Trojan were known to the
security industry as TinyNuke, but lacked the features necessary to launch
attacks. The latest versions however, are fully operable, and contain code to
target the users of specific banks.
Although the appearance of a malware family in
the wild is not unusual, the fact that criminals have a ready-to-attack version
of the Trojan, means that soon they may initiate a wide-scale malicious
campaign, to infect multiple users. As an early warning to its customers and
other users, Kaspersky Lab has published a brief analysis of the malware.
the wild is not unusual, the fact that criminals have a ready-to-attack version
of the Trojan, means that soon they may initiate a wide-scale malicious
campaign, to infect multiple users. As an early warning to its customers and
other users, Kaspersky Lab has published a brief analysis of the malware.
NukeBot is a banking Trojan. Upon infection it
“injects” malicious code into the webpage of an online banking service
displayed in a victim’s browser and then steals user data, spoofs their
credentials, and more. According to Kaspersky Lab researchers, there are
already a number of compiled samples of this Trojan in the wild – shared on
underground hacking forums. Most of these are rough, barely operational malware
drafts; however, the company’s experts have managed to identify some that pose
a real threat.
“injects” malicious code into the webpage of an online banking service
displayed in a victim’s browser and then steals user data, spoofs their
credentials, and more. According to Kaspersky Lab researchers, there are
already a number of compiled samples of this Trojan in the wild – shared on
underground hacking forums. Most of these are rough, barely operational malware
drafts; however, the company’s experts have managed to identify some that pose
a real threat.
Around 5% of all samples found by
Kaspersky Lab were NukeBot’s new ‘combat versions’, which have improved source
codes and attacking capacities. Among other things these versions contain
injections – specific pieces of code, which mimic parts of user interface of
real online banking services. Based on the analysis of injections, Kaspersky
Lab experts believe the main targets of the new version of NukeBot are users of
several French and US banks.
Kaspersky Lab were NukeBot’s new ‘combat versions’, which have improved source
codes and attacking capacities. Among other things these versions contain
injections – specific pieces of code, which mimic parts of user interface of
real online banking services. Based on the analysis of injections, Kaspersky
Lab experts believe the main targets of the new version of NukeBot are users of
several French and US banks.
In addition, Kaspersky Lab researchers managed
to detect several NukeBot modifications that didn’t have web injection
functionality, and were designed to steal mail client and browser passwords.
This means that developers of new versions may aim to widen the functionality
of this malware family.
to detect several NukeBot modifications that didn’t have web injection
functionality, and were designed to steal mail client and browser passwords.
This means that developers of new versions may aim to widen the functionality
of this malware family.
“In 2016 the number of users attacked with
malware targeting financial data increased about 30.55% over the previous year,
bringing it to close to 1.1 Million attacks. While most of these attacks were
mostly towards regular users, approximately 17.7% of the attacks also targeted
corporate users. From our Financial Cyberthreats report for 2016, we found that
users in Russia, Germany, Japan, India, Vietnam and the US are the ones most
often attacked by banking malware. The trends show us that although
professional cybercriminal groups have indeed shifted a lot of their attention
to targeted attacks against large companies, regular users and smaller firms
are still being targeted” said Sylvia Ng, General Manager, South East Asia at
Kaspersky Lab.
malware targeting financial data increased about 30.55% over the previous year,
bringing it to close to 1.1 Million attacks. While most of these attacks were
mostly towards regular users, approximately 17.7% of the attacks also targeted
corporate users. From our Financial Cyberthreats report for 2016, we found that
users in Russia, Germany, Japan, India, Vietnam and the US are the ones most
often attacked by banking malware. The trends show us that although
professional cybercriminal groups have indeed shifted a lot of their attention
to targeted attacks against large companies, regular users and smaller firms
are still being targeted” said Sylvia Ng, General Manager, South East Asia at
Kaspersky Lab.
To protect yourself and your customers from
NukeBot attacks, Kaspersky Lab security specialists offer the following advice:
NukeBot attacks, Kaspersky Lab security specialists offer the following advice:
For financial organizations providing online
banking services:
banking services:
· Make sure you have an effective fraud prevention solution in
place, so that you can quickly and accurately spot unauthorized use of customer
accounts and irregular financial activity.
place, so that you can quickly and accurately spot unauthorized use of customer
accounts and irregular financial activity.
For customers of
online banking services:
online banking services:
· Use an Internet security solution with
tailored technologies to protect financial transactions, like Kaspersky
Lab’s Safe Money
tailored technologies to protect financial transactions, like Kaspersky
Lab’s Safe Money
· Regularly run a system scan to check for
possible infections.
possible infections.
Kaspersky Lab products detect the malware as
Trojan-Banker.Win32.TinyNuke.
Trojan-Banker.Win32.TinyNuke.
To learn more about the ‘combat versions’ of
NukeBot, read the blog post, available on
Securelist.com.
NukeBot, read the blog post, available on
Securelist.com.
About Kaspersky Lab
Kaspersky Lab is a global cybersecurity company celebrating its 20
year anniversary in 2017. Kaspersky Lab’s deep threat intelligence and security
expertise is constantly transforming into security solutions and services to
protect businesses, critical infrastructure, governments and consumers around
the globe. The company’s comprehensive security portfolio includes leading
endpoint protection and a number of specialized security solutions and services
to fight sophisticated and evolving digital threats. Over 400 million users are
protected by Kaspersky Lab technologies and we help 270,000 corporate clients
protect what matters most to them. Learn more at www.kaspersky.com.
year anniversary in 2017. Kaspersky Lab’s deep threat intelligence and security
expertise is constantly transforming into security solutions and services to
protect businesses, critical infrastructure, governments and consumers around
the globe. The company’s comprehensive security portfolio includes leading
endpoint protection and a number of specialized security solutions and services
to fight sophisticated and evolving digital threats. Over 400 million users are
protected by Kaspersky Lab technologies and we help 270,000 corporate clients
protect what matters most to them. Learn more at www.kaspersky.com.
For the LATEST tech updates,
FOLLOW us on our Twitter
LIKE us on our FaceBook
SUBSCRIBE to us on our YouTube Channel!
