CamuBot Banking Trojan Returns In Targeted Attacks

guest · Feb 5, 2020

CamuBot Banking Trojan Returns In Targeted Attacks
February 5, 2020
https://threatpost.com/camubot-banking-trojan-targeted-attacks/152604/

The CamuBot malware, known for targeting Brazilian bank customers, has returned in a slew of recent offensives. The latest wave of attacks are highly personalized and, unlike previous campaigns, target victims’ mobile banking apps as an extra step to evade detection when making fraudulent transfers.

Researchers said they’ve observed the CamuBot malware being distributed in two highly targeted campaigns over the past six months, including one from August to September, and then another from October to November.

“Some observations from the campaigns are that the adversary operating CamuBot handpicks potential victims and remains as targeted as possible, [...]” said IBM X-Force researchers Chen Nahman and Limor Kessem, in an analysis this week.
New Tactic
While in the previous 2018 campaign, attackers would at that point utilize the victims’ credentials to log into their accounts and make fraudulent transactions, recent campaigns take the attack a step further.

“Rather, we have been seeing that business accounts are being accessed through the bank’s mobile application.”
While attackers already have the online banking credentials, “the attacker in this case wants the victim to authorize activity from the app on the mobile device,” researchers told Threatpost.
Click to expand...

Rise of CamuBot
Researchers said that the tactics of CamuBot are in line with TTPs used by organized cybercrime groups such as TrickBot, IcedID and Ursnif, each of which focuses on business banking and blends social engineering with malware-assisted account and device takeover.

This is different from other popular malware strains in Brazil that utilize more traditional tactics, like remote overlay trojans, to facilitate device takeover and consumer account fraud.
Click to expand...

IBM X-Force: CamuBot Resurfaces With Cross-Channel, Targeted Attacks in Brazil

Log in or Sign up

CamuBot Banking Trojan Returns In Targeted Attacks

guest Guest

Log in or Sign up

CamuBot Banking Trojan Returns In Targeted Attacks

guest Guest

Useful Searches