Ramnit Rears Its Ugly Head Again, Targets Major UK Banks
IBM X-Force researchers recently reported that the Ramnit Trojan has relaunched, targeting six major banks in the U.K.
After a silent period of about eight months, researchers observed that Ramnit’s operators set up two new live attack servers and a new command-and-control (C&C) server. They launched an infection campaign in the U.K. and are spreading new Trojan configurations to equip the malware with webinjections designed to target personal banking users.
Internally, the Ramnit payload does not appear to have changed in any significant way; its operation, architecture and encryption algorithms remained the same. Some parts were updated, such as the “Hooker” module, which saw some renovation and was renamed “Grabber.” Also known as a Spy Module, this module is designed to hook the browser, monitoring URL access, enabling data theft in real time and displaying webinjections to the victims.
Ramnit’s DriveScan module remained unchanged. This component enables the Trojan to scan the drive for files with interesting keywords, such as “wallet,” “passwords,” and the names of banks targeted in the configurations. Ramnit’s operators gather that extra information to ensure they don’t miss out on any financial details or credentials victims may be keeping on their endpoints.
Although Ramnit originally features a virtual network computing (VNC) module, it does not seem to deploy it immediately. Nonetheless, a VNC module can be dynamically fetched from the malware’s control server at the attacker’s discretion and launched for use at any point.
The configuration side is where we can see that Ramnit has been preparing for the next phase, with new attack schemes built for real-time fraud attacks targeting online banking sessions. Not all attacks have to happen in real time or from the victim’s device; Ramnit’s operators can also gather credentials from infected users and use them to commit account takeover fraud from other devices at a later time.
Ramnit is an evolving, persistent banking Trojan that emerged in 2010 in the more simplistic form of a self-replicating worm. As the malware project evolved, Ramnit’s developers chose to morph it into a banking Trojan and, in 2011, Ramnit donned on-the-fly data theft modules alongside webinjection capabilities borrowed from the Zeus Trojan’s exposed source code. It has been an active banking Trojan ever since, with remote control capabilities and extensive target lists that even included mule recruitment in the past.
According to X-Force Research, this malware saw its most prolific bank fraud phase in 2014, when it was named the fourth most active financial Trojan in the world behind Dyre, Neverquest and Dridex.
The Ramnit banking Trojan is an evolving threat. It is designed to manipulate online banking sessions to steal user credentials and perform money transfer fraud attacks. To help stop Ramnit, banks and service providers can use adaptive malware detection solutions and protect customer endpoints with malware intelligence that provides real-time insight into fraudster techniques and capabilities.
Most cases of malware infections, including Ramnit, begin with a malware-laden spam email that lures victims into opening an attachment by indicating it is an invoice or another important document. If users are not expecting this document, their best bet is to delete the email immediately and then directly check their accounts or contact their service provider to look into the matter.
Those who frequently bank away from home are advised to never access any of their personal accounts from public computers. Online banking should be carried out from trusted devices that are protected by security solutions.
Ramnit’s new attacks were discovered by X-Force researcher Ziv Eli.
source | securityintelligence