Russian Authorities Arrest Eight in Carberp Banking Trojan Scam

datarishik · Mar 22, 2012

http://securitywatch.pcmag.com/malware/295642-russian-authorities-arrest-eight-in-carberp-banking-trojan-scam

Details Behind Carberp
Carberp exploits browser vulnerabilities, usually in Java and Flash plug-ins, to launch a man-in-the-browser attack in which it sniffs and intercepts passwords and related information typed into the browser. The Trojan could also manipulate traffic to serve up phishing sites to unsuspecting users.

Later versions of Carberp killed other types of malware residing on victim computers, disabled installed anti-malware software, and encrypted all malicious traffic, according to an analysis of the Trojan by Seculert.

Carberp has been commonly linked with the Blackhole exploit kit and is often installed onto victim computers as part of a drive-by-install attack. Drive-by attacks generally exploit unpatched vulnerabilities in software to download and install malware without the user's knowledge. Drive-bys automatically launch when the user lands on a malicious Web page; the user doesn't have to click on anything to trigger the attack.

The gang allegedly hacked popular news media Websites and online stores and launched distributed denial of service attacks. They posted links to malicious Web sites on popular online bookmarking services to trick users into visiting the malware-laden pages.

Carberp also made the rounds on Facebook earlier this year, tricking users into paying a ransom to unlock their profiles.
Click to expand...

Baserk · Mar 24, 2012

'Russian authorities have arrested eight men accused of creating and distributing the Carberp banking Trojan in Russia and the Netherlands.
...It's rare that authorities can identify and apprehend "the entire criminal chain, including the head of this group and owner of a botnet, those conducting fraudulent transactions, and those directly involved in cashing the stolen funds," said Group-iB.'

Quite silly it seems, to harvest in their own backyard.
There's a reason why certain malware specifically checks a box for russian/cyrillic keyboard (layout) and if so, becomes inactive. It's to keep the FSB of the coders/distributors back.
Perhaps these guys thought they could outsmart them or just didn't care, now they'll likely have up to 10 years in a russian jail to reflect on this...

Log in or Sign up

Russian Authorities Arrest Eight in Carberp Banking Trojan Scam

datarishik Registered Member

Baserk Registered Member

Log in or Sign up

Russian Authorities Arrest Eight in Carberp Banking Trojan Scam

datarishik Registered Member

Baserk Registered Member

Useful Searches