Forest Global Training Partners

Cyber Risks · Krebs on Security

Collaboration Fuels Rapid Growth of Citadel Trojan

Summary: Citadel, an open-source variant of the ZeuS Trojan, runs a customer resource management portal where licensed buyers vote on and comment about proposed modules, including a file-search plugin and a 'mini-antivirus' that removes competing malware from victim PCs. Seculert researchers said they observed at least five new Citadel versions since first spotting it on Dec. 17, 2011, a pace of roughly one release per week that Aviv Raff said only 'SpyZeus' had approached, while ZeuS itself took a month to several months per version.

Bottom line: A malware kit shipping a new build about once a week, driven by buyer votes and a help desk that closes on weekends, compresses the window between a new evasion technique appearing and it reaching criminal customers. The 'mini-antivirus' module is the detail to sit with: Citadel is built to clear other parasites off a host so it can operate cleanly and stealthily, meaning an infected machine may look cleaner than it is.

Read the original at Krebs on Security ↗

Topics
Malware
Related