Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Banking Trojans: Ursnif Global Distribution Networks Identified

Summary: Unit 42 reported that the Ursnif (Gozi) banking Trojan has been used against Japan for more than a year, delivered mainly through spam email with a malicious attachment that downloads the executable from a remote site, and that Tokyo Metropolitan Police and the Japan Cybercrime Control Center have issued public warnings about it. The distribution network has two parts - a spam botnet and a set of compromised web servers - and analysis found 75 unique Shiotob variants across 7 million spam emails, more than 200 malicious files on 74 servers used from April 2015 to January 2017, and top target countries of Italy, Japan, Spain, Poland and Germany.

Why it matters: The hosting infrastructure was mostly compromised personal and small-business websites in Europe whose owners had not maintained them for years, and the actor copied files across multiple servers so takedowns of any single one would not stop delivery.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related