Banking malware proves tough to repel

Dridex, Bebloh, TinyBanker and Dyre abound, according to SecurityScorecard

SecurityScorecard found thousands of organizations infected with sophisticated banking malware, including one called Dridex.

SecurityScorecard found thousands of organizations infected with sophisticated banking malware, including one called Dridex.

Companies are finding it tough to keep out new types of banking malware, which continue to get better following the bar-raising threat known as Zeus.

The malicious programs all aim to swiftly and secretly steal credentials for online bank accounts, with some specializing in making large, unauthorized wire transfers from businesses using the ACH (Automated Clearing House) system.

A study by the firm SecurityScorecard, which specializes in tracking a company's risk of intrusion, found more than 4,700 organizations that were infected by some type of advanced banking malware.

SecurityScorecard collected the data in part by using sinkholes, or computers that researchers control which are part of a network of infected machines, known as a botnet. An analysis of those sinkholes can lend insight into how many machines may be infected with a particular type of malware.

The company also looks at spam campaigns, vulnerabilities in web applications, malware campaigns conducted using social media and monitors underground hacking forums, said Alex Heid, chief research officer.

"For hackers, you always want to look for the weakest link and pivot in," he said.

The study, conducted over the first five months of this year, found 11,952 infections affecting 4,703 organizations. Some of those organizations are customers of SecurityScorecard, while others are partners of those customers.

When SecurityScorecard evaluates a customer's network, the customer also shares information about their partners, who may also have access to their systems.

It's those relationships that are increasingly being targeted by hackers. Target and Home Depot both attributed large payment card breaches to the infiltration of third-party contractors whose credentials gave access to their systems.

The top banking malware families that have been circulating are Dridex, Bebloh and TinyBanker, Heid said.

Dridex spreads through spam that contains attachments to malicious XML files or Microsoft Office documents with macros, he said. Bebloh is hard to detect since it makes few changes to the computers it infects. TinyBanker -- named for its small 20K size -- is hard to find as well since its creators often change its digital footprint, which allows it to evade security products, he said.

Those distributing malware try to make sure their programs are FUD, or fully undetectable. They do that by using tools to encrypt the software called crypters or packers, which compress the file in a way that makes it hard to detect, Heid said.

SecurityScorecard also found instances of Dyre, another banking malware program that descended from the infamous Zeus software.

The U.S. Department of Justice, working with security researchers, managed to shut down the Gameover Zeus botnet in mid-2014. The botnet and associated malware stole as much as US$100 million.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securitymalwareSecurityScorecard

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?