Banking trojan victims transformed into hapless mules

The URLzone Trojan rewrites bank pages to that victims can't tell their accounts are being emptied.
10/7/2009 6:00:00 AM By: Robert MacMillan

When URLzone spots a researcher's program, instead of simply disconnecting from the researcher's computer, the server tells it to do a money transfer. But instead of transferring the money into one of the criminal's money mules -- people who have been recruited to move cash overseas -- it chooses an innocent victim. Typically, these are people who have received legitimate money transfers from other hacked computers on the network, Raff said.

So far, more than 400 legitimate accounts have been used in this way, RSA said.

The idea is to confuse researchers and to prevent the criminal's real money mules from being discovered.

Banking Trojans such as Zeus and Clampi have been emptying accounts for years now, but Finjan dubbed URLzone the first of a new, smarter generation of the crimeware.

According to Finjan, URLzone infected about 6,400 computer users last month and was clearing about €12,000 (US$17,500) per day.

Source: Computerworld

share: