I received reports this week of emails that reference transactions of which the recipients have no knowledge. The  email includes a link for more detail, which then attempts to download a ZIP attachment. Nothing new here; most savvy users would know better than to open an attachment in an unsolicited email.

The interesting thing about this email, however, is that it includes a password previously used by the recipient. Seeing private data in an email like this would definitely raise suspicions that the sender has some kind of connection to the recipient, or worse, has comprised their account details. The ultimate goal for the sender is that the user’s curiosity would be piqued sufficiently to open the attachment which would, of course, deliver the inevitable malware payload.

Symantec detects the file as Trojan.Zbot, also called Zeus, which is a Trojan horse that...

Banking Trojans are nothing new. They have been around for many years, considering detections such as the Infostealer.Bancos family date back to 2003. As more and more people moved to perform banking transactions online, Bancos created a huge and lucrative target for would be criminals to exploit.

Traditionally, banking Trojans typically just captured data traffic exchanged between the user and the online banking website. The captured information included the authentication information, which is collected and sent to the attacker by the Trojan for their use or to sell on to other parties for a profit. For as long as there has been banking Trojans, there has been a cat and mouse game between the banks and the criminals as each side respond to each other’s move to thwart the actions of the other. More sophisticated banking Trojans employ a man-in-the-browser (MITB) method...

Zbot, otherwise known as the Zeus botnet, has been around for a quite a while and has been called the "King of Bots"; it has infected millions of computers worldwide. The Zbot construction kit is on-sale and widely available in the underground community. Other botnet kits are also being sold and are challenging Zbot peddlers. This means that the Zbot authors have no choice but to update the construction kits to accommodate the needs of their criminal client base to stay ahead of their rivals and hold on to the title of the King of the Bots, the result of which appears to be samples discovered recently that Symantec detects as Trojan.Zbot.B and Trojan.Zbot.B!inf.

The Zeus Trojan is back in the media spotlight once more, and for good reason. Last week the FBI’s  Operation Trident Breach made worldwide headlines with over 100 arrests related to organized cybercrime operation activities  in the US, UK, and the Ukraine. The arrests relate to Cybercriminals and  money mules involved in stealing up to $70m from bank accounts through the use of the Zeus crimeware toolkit. The operation initiated by the FBI involved unprecedented partnerships between international law enforcement, such as the Netherlands Police Agency, the Security Service of Ukraine (...