Hackers are testing out this updated banking malware with added stealthy attacks

A new version of the Ursnif banking Trojan is being tested get into the wild with code modifications and new attack techniques that plan to build it even simpler.


Part of a similar malware family as Gozi, the new edition of Ursnif comes with redirection attacks that use faux versions of banking websites to steal login data and monetary information from victims.

Researchers at IBM X-Force aforementioned that a number of the foremost vital changes within the third incarnation of Ursnif area unit in its code-injecting mechanism; it has been altered to such Associate in Nursing extent that this version of the malware has doubtless been designed by completely different developers to the second version.

The new edition of Ursnif was 1st noticed in August in what researchers have known because the begin of a testing amount during which those behind the malware are careful to stay the malware hidden, to such Associate in Nursing extent that the resources behind it were taken offline once every trial. It's thought that Ursnif version 3 continues to be in its test period, as a result of version 2 continues to be active within the wild.

It seems that those behind Ursnif area unit following within the footsteps of different banking Trojans like Dridex and Trickbot by adding redirection attacks to the attack formula. Researchers note that the redirection theme is enforced through the configuration file and not embedded into the code itself.

When active, the Ursnif attack seems to the victim as if it's connecting to their real bank web site, all the whereas handing their credentials to the cybercriminals behind the theme.

"The malware maintains a live reference to the bank's legitimate webpage to make sure that its real uniform resource locator and digital certificate seem within the victim's address bar," aforementioned Limor Kessem, government security adviser at IBM.

See also: what's phishing? Everything you would like to understand to guard yourself from scam emails and additional

"At that time, the malicious actors will use internet injections to steal login credentials, authentication codes and different in person distinctive data (PII) while not tripping the bank's fraud detection mechanisms," she value-added.

The trials of the third version of Ursnif have seen those behind the Trojan victimisation its redirection attacks against business and company banking customers in Australia.

Meanwhile, researchers at FireEye have conjointly discovered a separate new technique being used by Ursnif within the kind of deploying malicious TLS (thread native storage) callbacks.

TLS callbacks area unit a regular a part of the Windows software, and area unit designed to supply extra support for data formatting and termination for per-thread information structures. However, the new edition of Ursnif is manipulating TLS callbacks as Associate in Nursing anti-analysis trick.

Like several malicious campaigns, Ursnif is delivered to victims through phishing emails. during this instance, researchers found the malware was being distributed in messages claiming to be a confirmation of Associate in Nursing order, and asking targets to open and sign a review document. If the review document is clicked on, it will begin the method of malware infection.

Researchers say the Ursnif's new techniques demonstrate however cybercriminals area unit regularly redeveloping malware so as to form it simpler.

Recent and connected coverage

Hacking back could be a terrible plan, however firms area unit still keen to do it

It's tempting to require revenge on hackers, however the downsides way outweigh any edges.

You can still obtain onerous drives jam-packed with different people's information, however SSDs area unit less risky

Kroll Ontrack bought onerous drives and SSDs on eBay and located virtually [*fr1] still had business and private information on them.

Shipping firm warns that hackers might leak steer

Global shipbroker says it fell victim to a 'cybersecurity incident' and is contacting people who might need had their data taken by attackers.