Review of Some of the Most Notorious Banking Trojans

Banking Trojans are one of the top tools cyberthieves deploy in order to make a buck. These are strictly designed to steal login credentials and/or to take the money right out of a victim’s bank account. They also often target other financial applications that are connected to financial accounts, such as PayPal. Some of the most notorious ones are worth mentioning separately.

The below list, more than anything, is a solid warning to adopt the best possible cybersecurity education, awareness, and practices. Everyone, whether at work or home, should live by strict security guidelines:

1. Don't Click - Unknown and/or unexpected email links and attachments should never be opened. This is by far the most common way devices are infected with malware causing any number of bad outcomes. 

2. Verify - If you receive an email with a link, attachment, or sensitive request (W2, wire funds) from someone you know but you were not expecting, verify the email by calling the person or sending a separate email to the person. Don't reply to that email as it may be spoofed and the criminal will absolutely tell you it is legitimate.

3. Update - Keep all devices updated to prevent criminals from taking advantage of weaknesses in software and hardware.

4. Antivirus/Anti-malware - It is recommended that everyone run both solutions and they are kept up to date. If possible, set the software to auto-update.

5. Don't Sideload Apps - Use official app stores like Amazon, Apple, and Google Play. Installing apps from other sources have a high probability of being infected with malware. 

2

Zeus is not only the name of a mythological god, it’s also a dangerous of malware that according to CNN Money has been responsible for helping cyberthieves steal over $3 million from U.S. banks alone. It’s also referred to as Zbot. Its code has been used as the foundation for several other iterations of it including Gameover Zeus (GOZ) and more recently, Atmos, which was active initially in France, but likely to spread. 

SpyEye, while short-lived, was nasty. It was able to not only steal login credentials, but could also initiate banking transactions. It could evade detections systems and could complete transactions faster than a human could do it manually. It was used in an attack against Verizon’s online billing page and infected Android devices.

Fortunately, three people were arrested in conjunction with this one in 2012, which essentially ended its activity.

Citadel was particularly damaging. It could avoid detection, block access to security sites, and record videos. It was created as sort of an “open source” product so that other malware developers could review it, share ideas, and make improvements. Fortunately, it was mostly put down when Microsoft collaborated with other companies. Unfortunately, before that could happen it had infected over 11 million computers.

Carberp is not new, but has evolved over time from its initial purpose of strictly stealing login credentials to being able to sit undetected on a device for long periods of time to removing anti-malware software of infected computers. It eventually evolved to infect Android devices. In 2013, the source code was leaked sparking fears of more dangerous iterations and is believed to have spawned the hybrid Trojan Zberp.

Carberp was blamed for the loss of an estimated $250 million to banks.

Russian authorities did arrest and charge several people in conjunction with this banking Trojan. However, since the source code was leaked, there are likely more dangerous ones to come.