London: Trusteer Intelligence researchers have discovered a clever new use of the Citadel malware platform (a descendent of the Zeus Trojan) to deliver code ransomware that poses as the US Department of Justice and highjacks victims’ computers. This ransomware, named Reveton, freezes the compromised machine’s operating system and demands a $100 payment to unlock it. Reveton was observed a few weeks ago being used as a standalone attack, but has now been coupled with the Citadel platform. This is another example of financial malware expanding beyond online banking fraud and being used as a launch pad for other types of cyber-attacks. Citadel is able to target employees to steal enterprise credentials, and in this example targets victims directly to steal money from them, instead of their financial institution.
The attack begins with the victim being lured to a drive-by download website. Here a dropper installs the Citadel malware on the target machine which retrieves the ransomware DLL from its command and control server.
Once installed on the victim’s computer, the ransomware locks-up the targeted machine and displays a warning message notifying the user that they have violated United States Federal Law. The web inject screen (below) claims the IP address belonging to the infected machine was identified by the Computer Crime & Intellectual Property Section as having visited websites that contain child pornography and other illegal content.
In order to unlock their computer, the victim is instructed to pay a $100 fine to the US Department of Justice using prepaid money card services. The payment service options presented to the victim are based on the geographic location of their IP address. For example, users with US IP addresses must pay using MoneyPak or Paysafecard.
Independent of the Reveton ransomware secondary payload, Citadel continues to operate on the compromised machine on its own. Therefore it can be used by fraudsters to commit online banking and credit card fraud by enabling the platform’s man-in-the-browser, key-logging and other malicious techniques.
“It is clear from this and similar attacks Trusteer has discovered recently that financial malware has achieved a technological level of sophistication which enables it to be used to carry out virtually any type of cyber-attack,” said Trusteer CTO Amit Klein. “Through a combination of social engineering, data capturing and communication tampering these attacks are being used by criminals to target applications, systems and networks belonging to financial institutions, enterprises, and government agencies in order to commit fraud or steal sensitive information. We have to recognize that cyber-crime and cyber-security protection begins with the endpoint now more than ever.”
Comment on SOCA take down of 36 websites
Below is a comment from Rob Rachwald, Director of Security Strategy from Imperva regarding the news that 36 websites have been taken down as they were trading stolen credit card information:
“The UK's Serious Organised Crime Agency (SOCA) has shut down 36 web sites that it said were trading in stolen credit card information, including http://ccstore.biz and http://cvvplaza.com.
Here's a twitpic of what the suspended websites look like: http://twitpic.com/9e0166/full.
This is significant. Although hacktivism has gotten a ton of attention in recent months, for-profit hacking continues at a costly rate and taking these sites offline is a serious blow.
Interestingly, law enforcement seems to be conducting arrests in batches--arresting or suspending criminal gangs as a network vs individually. Just as all of Lulzsec was arrested, now a network of carder sites is paralyzed. And this approach makes sense since it can help eliminate a swath of criminal activity while potentially scaring others from filling the void.”