IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Zeus resurfaces to steal credit card details

Cybercriminals resurrect old malware to snaffle online credentials.

The Zeus malware has re-emerged and is being used by criminals to steal financial information, according to IT security company Trend Micro.

The firm claims the malware has re-appeared amidst a spike in numbers of active threats in the wild and has predicted that this year will be characterised by slightly modified old threats resurfacing, with new features added in order to avoid detection and infect more systems.

The Zeus or ZBOT variants began to increase from the beginning of February, according to Trend Micro's Jay Yaneza.

"ZBOTvariants surged in the beginning of February and continued to be active up to this month. It even peaked during the middle of May 2013. The malware is designed to steal online credentials from users, which can be banking information or other personally identifiable information (PII)," said Yaneza in a blog post.

Yaneza warned that this variant of the Zeus malware was now more dangerous as it uses advanced techniques to avoid detection by security systems.

"ZBOTmalware of this generation are found to be mostly either Citadel or GameOver variants. Unlike earlier versions, the mutex name is randomly generated," said Yaneza.

"Both variants send DNS queries to randomised domain names. The difference in GameOver variant is that it opens a random UDP port and sends encrypted packets before sending DNS queries to randomised domain names. Zbot malware connects to a remote site to download its encrypted configuration file."

He said that these configuration files contain banks and other financial institutions that ZBOTs monitor in browsers.

"Since configuration files are downloaded from remote sites, the contents of these files may change any time. Malicious actors can change the list of sites they want to monitor on the affected system."

The firm said that there are ways to stop the Zeus malware in its tracks.

"There are several avenues for detecting ZBOT variants. First, as the malware tries to write to the registry Userinit' entry in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. Secondly, detecting the call-back routine to the remote site upon execution, as it acquires its configuration file," he said.

Yaneza said that old threats like ZBOT can always make a comeback because cybercriminals profit from these. "Peddling stolen banking and other personal information from users is a lucrative business in the underground market," he said. "It is important to be careful in opening email messages or clicking links. Bookmark trusted sites and avoid visiting unknown ones."

Featured Resources

AI for customer service

IBM Watson Assistant solves customer problems the first time

View now

Solve cyber resilience challenges with storage solutions

Fundamental capabilities of cyber-resilient IT infrastructure

Free Download

IBM FlashSystem 5000 and 5200 for mid-market enterprises

Manage rapid data growth within limited IT budgets

Free download

Leverage automated APM to accelerate CI/CD and boost application performance

Constant change to meet fast-evolving application functionality

Free Download

Recommended

'Potentially unsecured' SMBs are propping up an IT supply chain riddled with ransomware
ransomware

'Potentially unsecured' SMBs are propping up an IT supply chain riddled with ransomware

6 Sep 2022
The secure cloud configuration imperative
Whitepaper

The secure cloud configuration imperative

7 Mar 2022
The secure cloud configuration imperative
Whitepaper

The secure cloud configuration imperative

7 Mar 2022
Trend Micro Worry-Free Business Security review: Great cloud-managed malware protection
endpoint security

Trend Micro Worry-Free Business Security review: Great cloud-managed malware protection

7 Dec 2021

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

15 Nov 2022
The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

14 Nov 2022
Windows users now able to run Linux apps and distros natively
Microsoft Windows

Windows users now able to run Linux apps and distros natively

24 Nov 2022