Forest Global Training Partners

Cyber Risks · Krebs on Security

At the Crossroads of eThieves and Cyberspies

Summary: A new Citadel Trojan variant, an offshoot of ZeuS, was found controlling a botnet of more than 3,400 PCs, most in the United States, and instructing each infected machine to run network diagnostic commands such as net view, osql -L, ipconfig /all, and queries dumping Windows users and groups. CrowdStrike co-founder Dmitri Alperovitch called the development troubling and said the hackers may be mapping out victims as a precursor to selling access to those machines, noting such default reconnaissance is rare in traditional cybercrime.

Bottom line: The commands this botnet ran by default are the same ones APT operators use to map a victim organization, which points to a market where access to 3,400 already-compromised corporate PCs could be sold rather than cashed out - and Alperovitch's stated obstacle to that trade is that the two communities don't know how to find each other, not that they wouldn't.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related