{"id":14990,"date":"2014-08-05T18:13:39","date_gmt":"2014-08-05T18:13:39","guid":{"rendered":"http:\/\/kasperskydaily.com\/b2b\/?p=2332"},"modified":"2020-02-26T10:54:23","modified_gmt":"2020-02-26T15:54:23","slug":"critters-evolving-trojans-on-the-rise-in-q2","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/critters-evolving-trojans-on-the-rise-in-q2\/14990\/","title":{"rendered":"Critters evolving: Trojans on the rise in Q2"},"content":{"rendered":"

Kaspersky Lab has just released its quarterly malware report \u201cIT Threat Evolution Q2 2014\u201d<\/strong>, which is full of formidable figures. Most of them don\u2019t look too enjoyable: both common and corporate users are attacked often and hit hard. For instance, in Q2 2014, 927,568 computers running Kaspersky Lab products were attacked by banking malware, which is a problem for both businesses and individuals. A total of 3,455,530 notifications about attempts to infect those computers with financial malware were received.<\/p>

Luuuk, MiniDuke, Brazilian megascam \u2013 Q2 didn\u2019t look encouraging.<\/p>Tweet<\/a><\/blockquote>\n

The document itself is pretty large, so we\u2019d rather focus on business-related highlights. Such as Luuuk campaign<\/a>, covered earlier \u2013 a long-running attack against the clients of a large European bank that resulted in the theft of half a million euros in just one week. Kaspersky Lab\u2019s experts identified 190 victims in total, most of them located in Italy and Turkey. The sums stolen from each victim ranged from \u20ac1,700 to \u20ac39,000 and amounted to \u20ac500,000. Unfortunately, the culprits apparently detected cybersecurity experts\u2019 attention and withdrew, removing all the sensitive components from the server they used as a \u201cbase of operations\u201d. So there was little to analyze. Apparently fraudsters used some flavor of a banking Trojan that performed \u2018Man-in-the-Browser\u2019 operations to steal the victims\u2019 credentials through a malicious web injection. Based on the information available in some of the log files, the malware stole usernames, passwords and one-time passcodes (OTP) in real time.<\/p>\n

\n<\/p>

\u00a0<\/p>\n

Yet another large-scale threat was detected in Q2: MiniDuke<\/a>, an APT campaign from early 2013 reignited, bringing in some serious and novel additions.<\/p>\n

The targets of the new MiniDuke operation (known also as TinyBaron and CosmicDuke) include government, diplomatic, energy, military and telecom operators, which means that commercial contractors of the major players in these areas are probably endangered.<\/p>\n

Unusually, the list of victims also includes those involved in the trafficking and reselling of illegal substances, including steroids and hormones. The reason for this isn\u2019t clear. It\u2019s possible that the customizable backdoor is available as so-called \u2018legal spyware\u2019. But it may simply be that it\u2019s available in the underground market and has been purchased by various competitors in the pharmaceutical business to spy on each other.<\/p>\n

The campaign targets countries across the world, including Australia, Belgium, France, Germany, Hungary, the Netherlands, Spain, Ukraine, and the USA.<\/p>\n

\"financial_malware_attacks_on_PC_in_q2_2014\"<\/a><\/p>\n

\u00a0<\/p>\n

A large-scale fraud campaign had been detected on the trails of FIFA World Cup, with Brazilian criminals working with special thoroughness. They staged their attacks from the domains they had registered using the names of well-known local brands \u2013 including credit card companies, banks and online stores. The sites fraudsters had created were professionally designed and they gave their sites an even greater feel of authenticity by buying SSL certificates from Certification Authorities such as Comodo, EssentialSSL, Starfield, Register.com and others. Clearly, a site with a \u2018legitimate\u2019 SSL certificate is likely to fool even security conscious consumers. And these sites indeed fooled some people, serving them with malware.<\/p>\n

They also sent out messages offering free World Cup tickets, but the link led to a banking Trojan. Some of these e-mails contained personal details, stolen from a breached database, to add credibility to the bogus offer.<\/p>\n

The mobile security situation is also bleak. In the second quarter of 2014 the following were detected:<\/p>\n