Forest Global Training Partners

Cyber Risks · Krebs on Security

Haunted by the Ghosts of ZeuS & DNSChanger

Summary: RSA Security announced it had spotted KINS, a ZeuS Trojan variant it called a new professional-grade banking Trojan, while Fox-IT reported KINS had been used in private since at least December 2011 against financial institutions in Germany and The Netherlands and is fully based on leaked ZeuS source code with only minor additions. Separately, a seller on a semi-private forum pitched Trend DNSChanger Bot, a modified DNSChanger that hijacks DNS settings to extract ransomware payments via MoneyPak, PaySafe or Ukash vouchers and mimics the victim's own ISP in its lock screen.

Key Takeaway: Fox-IT found many KINS users had already moved to yet another ZeuS variant, and forum members greeted the DNSChanger clone with skepticism - a reminder that underground 'new' threats are often repackaged code, and the author of Trend DNSChanger Bot says he was part of the team behind the original DNSChanger that once infected millions of PCs.

Read the original at Krebs on Security ↗

Topics
Malware
Related