Kronos Banking Trojan Sets Its Sights On New Territory

In 2014, the Kronos Trojan (another Zeus variant) is joining the newly materialized Sphinx in targeting financial institutions.

Kronos was previously big news not only because of what it did, but also because it was being marketed by a Russian-speaking vendor in the underground community for $7,000US. It was found to target French banks at that time and then just stopped being seen. Researchers determined that the command-and-control centers that were the communication point for infected botnets were shut down. Apparently recently, someone thought it was time to revive them.

The features of Kronos were that it would take over banking web pages to capture login credentials. It could also bypass anti-malware detection measures.

However, just because anti-malware may not find it, does not mean you should not install anti-malware software and keep it updated. All security involves several measures to keep information secure and anti-malware is an important part of that strategy.

In addition, make sure you can identify phishing attempts and that any time you login to your online banking, or any online site, you are the page you expect to be at. Kronos and another recently discovered Trojan in the wild, Sphinx, will try to trick users into entering usernames and passwords into fake banking web pages. If yours looks strange or unfamiliar to you in any way, do not continue. Contact your financial institution and let them know of your concern.

Phishing web pages have similar characteristics to phishing email messages. So look out for any of these signs to determine if you may about to be hooked:

• Typos, grammatical and punctuation errors, and incorrect use of the language;
• Slight changes of the logo or other usual identifying images and markings;
• Poor quality images and changes in colors;
• Requests for identifying information before logging in;
• Requests for user name and password information somewhere other than where you would typically find it;
• Some sense of urgency that you respond right away.

Kronos now reports back to its command-and-control center to get new configuration files with these previously mentioned new targets. So far, it seems that besides this, it has only one behavioral change; it may crash Chrome browsers. It is unknown if this is accidental or intended in order to force infected users to switch from it to one where it works properly. Those would be Firefox or Internet Explorer.

Which brings up another tip. Keep your browsers updated as well.