Slashdot is powered by your submissions, so send in your scoop


Forgot your password?
Crime Security IT

Cybercriminals Shifting To Bugat 48 48

wiredmikey writes "Cybercriminals are changing up their weapons, trying to diversify their attack tools using a platform that is less well known and therefore harder to detect and block. With so much focus on the ZeuS Trojan, recent attacks utilized a variant of 'Bugat,' another Trojan horse that steals information from a compromised computer and sends it to a remote host. Bugat was first discovered in January of this year but, like ZeuS, has seen some different variants. In last week's attack, LinkedIn users received emails alerting them of a 'Contact Request,' and encouraging them to click through to a malicious URL where a java applet fetched and installed the Bugat executable."
This discussion has been archived. No new comments can be posted.

Cybercriminals Shifting To Bugat

Comments Filter:
  • Make Up Your Mind (Score:3, Informative)

    by WrongSizeGlass (838941) on Tuesday October 12, 2010 @10:34AM (#33869626)
    In the linked article they claim "Bugat" was being distributed via the recent attack targeting LinkedIn users but the article [] they use as their reference clearly states the LinkedIn spam was distributing "ZeuS". Make up your mind, M'kay?
  • Re:Make Up Your Mind (Score:4, Informative)

    by cerberusss (660701) on Tuesday October 12, 2010 @10:53AM (#33869916) Homepage Journal

    The reference article has been updated:

    Update - 10/12/10 9:50AM - There have been reports that this attack used "Bugat" Malware instead of Zeus (More)

  • by tsu doh nimh (609154) * on Tuesday October 12, 2010 @11:09AM (#33870112)
    Wondering how much this "story" actually differs from the Trusteer press release, below: NEWS RELEASE FOR IMMEDIATE DISTRIBUTION
    Trusteer Researchers Find Criminals are Diversifying Financial Attacks with New Version of Bugat Malware

    Bugat Quietly Distributed in Recent LinkedIn Phishing Assault; Unlike Zeus Trojan, it is Less Well Known and Harder to Detect

    NEW YORK, Oct. 12, 2010 -Trusteer, the leading provider of secure browsing services, today announced that its researchers have discovered a new version of the Bugat financial malware used to commit online fraud. Bugat was distributed in the recent phishing campaign targeting LinkedIn users, which was generally considered to be trying to infect machines with the more common Zeus Trojan. The emergence of this new version of Bugat appears to be an attempt by criminals to diversify their attack tools using a platform that is less well known and therefore harder to detect and block.

    Bugat is similar in functionality to its better known financial malware brethren Zeus, Clampi and Gozi. It targets Internet Explorer and Firefox browsers and harvests information during online banking sessions. The stolen financial credentials are used to commit fraudulent Automated Clearing House

    (ACH) and wire transfer transactions mostly against small to midsized businesses, which result in high-value losses. Bugat is three times more common in the US than Europe, but its distribution is still fairly low.

    In last week's attack, LinkedIn users received emails reminding them of pending messages in their account and providing a malicious URL. When a victim clicked on the link they were directed to a fraudulent website where a java applet fetched and installed the Bugat executable. LinkedIn spam email is an effective tool to push malware to enterprise users, and is being used to gather credentials for commercial bank accounts and other sensitive services used by businesses.

    "Criminals are stepping up their malware distribution efforts by continuously updating configurations of well known malware like Zeus, and using new versions of less common Trojans like Bugat, to avoid detection,"

    said Mickey Boodaei, CEO of Trusteer. "We are in an arms race with criminals. Although Zeus gets a lot of attention from law enforcement, banks and the security industry, we need to be vigilant against new forms of financial malware like Bugat and SpyEye which are just as deadly and quietly expanding their footprint across the internet."

    Trusteer warns that the recent industry focus on Zeus is making it easier for other Trojans, like Bugat, SpyEye, and Carberp which are less wide spread but equally sophisticated, to avoid detection. Carberp currently targets nine banks in the United States, Denmark, The Netherlands, Germany, and Israel. These lesser known financial malware platforms are expected to increasingly compete with the Zeus toolkit to become the new Trojan of choice for criminal groups.

    Blocking and Removing Bugat

    The Trusteer Secure Browsing Service protects banking and other online sessions by blocking attacks and then disinfecting machines that are infected with Bugat and other financial malware including Zeus, SpyEye, and Carberp. When a Trusteer user browses to sensitive websites such as internet banking, Webmail, or online payment pages, the service immediately locks down the browser and creates a tunnel for safe communication with the web site. This prevents malware like Bugat from injecting data and stealing information entered and presented in the browser. The service is directly connected to the bank (or other online business protected by Trusteer) and to Trusteer's 24x7 fraud analysis service. Attempts to steal money from consumers protected by Trusteer are immediately detected by the bank or operator of the website and are blocked using various layers of protection.
  • Running Mac OS... (Score:3, Informative)

    by Chris Tucker (302549) on Tuesday October 12, 2010 @12:17PM (#33871400) Homepage a user account when online, NEVER as Root, and Little Snitch [] is ALWAYS running in the background in ALL accounts, especially Root.

    Ad Block Plus is also running at all times, that helps to eliminate the threat posed by hijacked banner or other ads.

    Yes, the potential for the Mac to be compromised is there, but I'd have to do something really stupid to get malicious code onto the machine.

    (Insert your own gratuitous but not unwarranted slams against the Windows OS here.)

I've finally learned what "upward compatible" means. It means we get to keep all our old mistakes. -- Dennie van Tassel