Trend Micro has noted multiple reports of a new botnet named Kneber and has confirmed that this new botnet is a specific ZBOT compromise. ZeuS, ZBOT and Kneber all relate to the ZeuS Trojan/Bot, an established crimeware bot known to be leveraged by many botnets and is possibly the most pernicious Trojan/Bot currently in operation.
The ZeuS bot, which is primarily designed for data theft or to steal account information related to online banking transactions, may arrive as a spammed message or it may be unknowingly downloaded by users via compromised websites. Majority of the ZBOT detections have been found to be targeting bank-related websites. However, recent spam runs have shown an increasing diversity in targets which include TROJ_ZBOT.SVR, TSPY_ZBOT.JF which targeted AIM users and TSPY_ZBOT.CCB which targets social networking site Facebook. The ZBOT makes detection difficult because of its rootkit capabilities. “ZBOT is primarily designed for data theft or to steal account information from various sites, like online banking sites, social networking sites, ecommerce sites, among others. It generates a list of bank-related websites or financial institutions from which it attempts to steal sensitive online banking information, such as user names and passwords. It then monitors the user’s web browser activity (both HTTP and HTTPS), using the browser window title or address bar URL as the trigger for its attack. This routine risks the exposure of the user’s account information, which may then lead to the unauthorised use of the stolen data,” commented Amit Nath, Country Manager, Trend Micro India. Since 2007, Trend Micro has been closely monitoring the ZBOT family and it is observed that the number of ZBOT detections has been growing substantially over the years. To date, Trend Micro has seen over 2,000 ZBOT detections and the numbers continue to rise. Â
Â
