News Categories

Kaspersky Lab detects latest Trojan malware ‘NukeBot,’ alerts customers

By Jonnah Pante - on 24 Jul 2017, 6:49pm

Kaspersky Lab detects latest Trojan malware ‘NukeBot,’ alerts customers

NukeBot which aims to steal the credentials of online banking customers was detected by the Kaspersky Lab.

Image from Kaspersky Lab

Unlike the previous versions of the Trojan, the TinyNuke, which was lacking the necessary features in able to launch, for these latest versions, the criminals have prepared ready-to-attack Trojan that may cause a wide-scale, malicious campaign to infect multiple users.

Therefore, Kaspersky Lab immediately released a brief analysis of the malware to warn its customers and users.

Kaspersky Lab emphasized NukeBot as a banking Trojan that “injects” malicious code into the webpage of an online banking service displayed in a victim’s browser and then steals user data, spoofs their credentials, and more.

“While criminals behind recent versions of this malware currently are not actively distributing NukeBot, this may, and likely will, change very soon. We’ve already seen this before with some other malware families: after a short testing period of a ready-to-attack malware, criminals start distributing it widely through infected websites, spam and phishing,” Sergey Yunakovsky, security expert at Kaspersky Lab, said.

Kaspersky Lab researchers already found several compiled samples of this spreading Trojan, and have identified malware drafts that pose a real threat.

According to the company’s experts, among five percent of these samples were NukeBot’s new ‘combat versions’ which have upgraded source codes and attacking capacities, and also, consist of injections that have specific pieces of code. These pieces of codes can mimic parts of user interface of real online banking services.

Based on the analysis of injection shown, Kaspersky Lab experts perceived that users of French and US banks are the main targets of the new version of NukeBot.

“So far we have seen NukeBot versions which are ready to attack the customers of at least six banks located in France and the US, however this list of targets looks like only the beginning. The goal of our brief research is to warn the banking community and online banking customers about a potentially emerging threat. We urge interested parties to use the results of our research in order to protect themselves from this threat in advance,” Yunakovsky added.

Sylvia Ng, General Manager at Kaspersky Lab Southeast Asia, recalled that in 2016, 30.55% increase in the number of users were attacked over the previous year with malwares targeting financial data, estimating the attacks to 1.1 million.

“While most of these attacks were mostly towards regular users, approximately 17.7% of the attacks also targeted corporate users,” Ng said.

She cited the Financial Cyberthreat report for 2016 that found Russia, Germany, Japan, India, Vietnam and the US as the countries often targeted by banking malware.

“The trends show us that although professional cybercriminal groups have indeed shifted a lot of their attention to targeted attacks against large companies, regular users and smaller firms are still being targeted,” she explained.

With these, Kaspersky Lab advises both online banking services and their customers how to protect themselves from NukeBot attacks.

They advise financial organizations providing online banking services to make sure you have an effective fraud prevention solution in place, so that you can quickly and accurately spot unauthorized use of customer accounts and irregular financial activity.

While the customers of online banking services to 1)Use an Internet security solution with tailored technologies to protect financial transactions, like Kaspersky Lab’s Safe Money; and 2)Regularly run a system scan to check for possible infections.

Kaspersky Lab products recognized the malware as Trojan-Banker.Win32.TinyNuke.

- Lorraine Mae Nevado (OJT)