Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

KRBanker Targets South Korea Through Adware and Exploit Kits

Summary: Unit 42 reports that KRBanker, also known as Blackmoon, targets banks in the Republic of Korea and has been distributed through the KaiXin exploit kit and the NEWSPOT adware program. Researchers identified close to 2,000 unique KRBanker samples and more than 200 pharming server addresses in the last six months, with the malware using process hollowing and Proxy Auto-Config to redirect victims to forged banking sites.

What's compelling: KRBanker pulls its pharming server address from the nickname field of a Qzone profile rather than hard-coding it, so blocking a known IP does little against a campaign that has produced roughly 2,000 samples in six months.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Mentions
CVE-2014-0569CVE-2015-3133
Related