A New Kid Topples Zeus as Most Active Banking Malware

Quarters one and two of 2018 have been a busy time for banking malware distributors. IBMs X-Force Threat Intelligence Index has found a switch in which of the many variants has taken the top spot thus far. For the past several reporting periods, the family of Zeus has been most active. However, they’ve been toppled by one that has been lurking in number three and two spots for a while: Gozi (aka Ursnif).

Not only is Gozi up 5% over its competition (which also includes Dridex, Trickbot, Ramnit, Zeus Panda, Qak Bot, and many others), but it’s also been seen joining forces with the Iced ID gang to distribute other malware. It’s always a big cause for concern when these “families” join forces.

There are ways to lower the risk of infection:

• Be aware of what comes into your email inbox. Studies have shown that users are more at risk of becoming phishing victims at work than at home. That’s because the phishers are now using lures such as invoices, tracking information, or wire transfer instructions, for example, to trick users into downloading the malware. If you’re not expecting any of these things or any other type of link or attachment, delete it or confirm its legitimacy first. Do that by placing a phone call or paying a personal visit to the sender. Don’t reply to these emails, as those replies often end up in the bad actors’ hands.

• Remember that text messages and SMS are also vulnerable to phishing and other attacks. If you don’t know the sender, use caution when reading and don’t click links.

• Instead of unsubscribing to spam, mark it as spam using your email client. That will help keep your email address private. Those who steal email addresses and use spam botnets to distribute massive quantities of spam will know it’s a legitimate address if you unsubscribe.

• Consider using an ad-blocking product to block online ads. These are often infested with malware and an accidental click can infect you.

• Delete apps and software that is not in use. Not only does that save your company money in licensing fees, but it can help prevent the products from becoming outdated and unsupported, which leaves them more vulnerable to attacks.

• Avoid using public Wi-Fi to perform sensitive transactions, such as financial transactions. Even if the Wi-Fi is password protected, it doesn’t’ mean it’s safe. Remember, you’re not the only visitor on that Wi-Fi to have the password.

• Always keep your operating systems and software updated with the latest security patches. If it makes sense for you, set them to automatically update. Then you won’t forget to do it.

• Make sure there is security software or apps installed on your devices. These will catch a lot of malware.

• Don’t sideload apps. Download them from the official stores for your device.

• Never grant administrator permissions to apps unless you are 100% sure they need them. The vast majority of the time, they don’t. Also make sure the app needs any access it’s requesting. If it’s a weather app, it probably doesn’t need access to your camera or microphone.

In case you are interested in the stats, Gozi took 28% of the malware family pie chart. Zeus and variants of it were close behind with 24%. Then Dridex was a distant third, with 12%.