Kaspersky Detects NukeBot; A Ready-to-Attack Version of Dangerous Banking Trojan
Kaspersky Lab researchers have detected a dangerous malware ‘NukeBot’ which was developed by the hackers to steal the confidential information of online banking customers.
Although, the earlier versions of the Trojan known as TinyNuke lacked necessary features to launch attacks, the latest versions are feature laden and fully operable; and also contain code to malice the specific customers.
“While criminals behind recent versions of this malware currently are not actively distributing NukeBot, this may, and likely will, change very soon. We’ve already seen this before with some other malware families: after a short testing period of a ready-to-attack malware, criminals start distributing it widely through infected websites, spam and phishing. So far we have seen NukeBot versions which are ready to attack the customers of at least six banks located in France and the US, however this list of targets looks like only the beginning. The goal of our brief research is to warn the banking community and online banking customers about a potentially emerging threat. We urge interested parties to use the results of our research in order to protect themselves from this threat in advance,” said Sergey Yunakovsky, security expert at Kaspersky Lab.
Now as the criminals are empowered by a ready-to-attack version of Trojan, there is a threat that they may initiate a large-scale attack anytime very soon.
How NukeBot works:
NukeBot is a banking Trojan. Upon infection it “injects” malicious code into the webpage of an online banking service displayed in a victim’s browser and then steals user data, spoofs their credentials, and more. According to Kaspersky Lab researchers, there are already a number of compiled samples of this Trojan in the wild – shared on underground hacking forums. Most of these are rough, barely operational malware drafts; however, the company’s experts have managed to identify some that pose a real threat.
Around 5% of all samples found by Kaspersky Lab were NukeBot’s new ‘combat versions’, which have improved source codes and attacking capacities. Among other things these versions contain injections – specific pieces of code, which mimic parts of user interface of real online banking services. Based on the analysis of injections, Kaspersky Lab experts believe the main targets of the new version of NukeBot are users of several French and US banks.
In addition, Kaspersky Lab researchers managed to detect several NukeBot modifications that didn’t have web injection functionality, and were designed to steal mail client and browser passwords. This means that developers of new versions may aim to widen the functionality of this malware family.
