Banking Botnet Profit Share

Instead of ripping each other's malware out of victim systems, the groups behind Trickbot and IcedID are playing nice with each other, says the risk intelligence firm, FlashpointIn what could be the beginning of a significant new trend, the operators of two separate banking botnets appear to have begun collaborating with each other in targeting systems and stealing money from victims.

Flashpoint says it has evidence suggesting the operators of the Trickbot and IcedID botnets have gotten into some kind of a profit-sharing arrangement in which they are using each other's malware and infrastructure to cash out victim bank accounts.

Such partnerships are extremely rare in the cyber-crime world where rival groups are more likely to rip each other's malware out of victim systems than collaborate on a malicious campaign. For enterprises, the trend could spell new trouble.

"This collaboration indicates that sophisticated botnet malware operators will … team up to defeat anti-fraud measures in place when [a] reasonable profit-sharing agreement can be reached amongst various groups," says Vitali Kremez, director of research at Flashpoint.

According to the vendor, some malware samples that it has recently analyzed suggest that computers infected with IcedID are also downloading the Trickbot banking Trojan.

IcedID is a banking malware sample that first popped up in the wild last April and is being massively distributed via spam email. Its victims have included financial services companies, retailers, and technology firms.

Up to now, IcedID has typically been installed on systems via a downloader called Emotet. But Flashpoint says that it now appears IcedID is being sent directly as spam. When the malware is installed on a system, it then acts as a downloader for Trickbot, which in turn installs other malware modules on the compromised system.

"IcedID is a primarily banking malware with downloader capabilities to install additional malware," Kremez says.

One of its key features is its ability to maintain persistence on infected machines. TrickBot is more of a multi-modular banking malware that has targeted victims in a slew of industries. The group behind it has used infected systems for a range of different malicious activities including bank account hijacking and for cryptocurrency mining.

"It is considered to be the successor to the Dyre banking malware and contains various credential-stealing, cryptocurrency mining as well as network propagation [features], amongst others," Kremez notes.

Flashpoint says the collaboration between the IcedD and Trickbot groups has given the pair significant new capabilities. The two groups are using their respective malware tools to steal credentials for breaking into bank accounts belonging to the owners of infected systems and stealing money from them.

Members from the two groups monitor infected systems for activities that are of specific interest. For instance, when the owner of a system that is infected with Trickbot and IcedID malware tries to log into a bank account of interest, the botmaster grabs the login credentials and other details and passes it on to affiliates.

The affiliates then use the login credentials and other information required to access the victim's account and transfer money out of it to rogue accounts previously opened by money mules. The mules often open the fraudulent bank accounts in the same financial institution and same geographic location as the victim's own account.

"The group botmasters collaborate on cashing out compromised bank accounts and share profits from their infections," Kremez says.

IcedID appears to be more focused on banking account-stealing operation, while TrickBot group also deploys additional modules to maximize profits from the compromised machines. Each compromised machine bears indicators of who exactly delivered the infection so it is easier to share the spoils.

Based on how the collaboration between IcedID and Trickbot has been working so far and the shared infrastructure they have built, it is quite likely that the operators of the two groups will continue to partner, Flashpoint said.

Expect to see more malware developers and fraud masters try and foster such collaborative partnerships if doing so can help them bypass the latest anti-fraud measures.

Dark Reading

You Might Also Read: 

Botnets Are Here To Stay:

Interpol Located & Shut Down 9,000 Command Servers
 

 

« Ukraine Detects A Cyber Attack On A NATO Member
Russia Is Building A Separate Military Cloud »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Redcentric

Redcentric

Redcentric is a leading UK IT managed services provider. We deliver managed IT, cloud computing, data backup, information security services and managed networks.

CS Group

CS Group

CS Group offers a complete range of security solutions from consultancy to security maintenance and from secure infrastructure design to security governance.

DocAuthority

DocAuthority

DocAuthority automatically discovers and accurately identifies unprotected, sensitive documents, enabling a broad yet business-friendly security policy.

RazorSecure

RazorSecure

RazorSecure offers products and services to enhance railway cyber security, by protecting and monitoring networks and key systems.

Matias Consulting Group (MCG)

Matias Consulting Group (MCG)

Your Business needs competitive and resilient ICT solutions. MCG defines, deploy & support them enabling you to focus on your core business.

Vehere

Vehere

Vehere specialises in mission critical signals aquisition and analytics platform and cyber defence systems.

Stratus Cyber

Stratus Cyber

Stratus Cyber is a premier Cyber Security company specializing in Managed Security Services. Our services include Blockchain Security, Pentesting, and Compliance Assessments.

Fairfirst Insurance

Fairfirst Insurance

Fairfirst Cyber Insurance protects your business assets against the complexity of cyber threats.

Yoti

Yoti

Yoti offer a suite of business solutions that span identity verification, age estimation, e-signing and AI anti-spoofing technologies.

AirITSystems

AirITSystems

AirITSystems offer companies comprehensive IT security solutions that take all security considerations into account and are tailored to your business.

watchTowr

watchTowr

Continuous Attack Surface Testing, with the watchTowr Platform. The future of Attack Surface Management.

Capgemini

Capgemini

Capgemini is one of the world's foremost providers of consulting, technology and outsourcing services. Areas of expertise include Cybersecurity.

Mercury Systems

Mercury Systems

Mercury Systems is the leader in making trusted, secure mission-critical technologies profoundly more accessible to aerospace and defense.

RightSec

RightSec

RightSec is an emerging market leader and solution provider for cybersecurity and digital resiliency. We provide end to end solutions to suit your specific business lifecycle.

Cribl

Cribl

Cribl, the Data Engine for IT and Security, empowers organizations to transform their data strategy.

Omnex

Omnex

Omnex provides consulting and training services in Quality, Environmental, and Health and Safety standards-based management systems including Automotive Cybersecurity.