Holy Zeus! Popular Botnet Rules As New Exploits Come Online

If there's a "fashion trend" among botnet builders, Zeus is the new black -- but its popularity is making many users and security professionals see red.

Zeus, a Trojan horse that spreads bots quickly, can be adapted for multiple purposes, is available in botnet-building kits, and serves as the platform for a growing number of botnets and sub-botnets that are being exploited across the globe, according to experts. In the past two days, researchers at Trusteer and AVG revealed details about two new instances of Zeus-based botnets, suggesting the Trojan is becoming more popular than ever.

Trusteer today announced it uncovered a large Zeus version 2 botnet that is operated and controlled from Eastern Europe and is used to conduct financial fraud in the U.K.

"The botnet appears to be controlling more than 100,000 infected computers, 98 percent of which are U.K. Internet users," Trusteer says. "The criminals have been harvesting all manner of potentially lucrative and revenue-producing credentials, including online account IDs, plus login information to banks, credit and debit card numbers, account types plus balances, bank statements, browser cookies, client side certificates, login information for email accounts and social networks, and even FTP passwords."

Trusteer discovered the extent of the botnet after researchers gained access to the botnet's drop servers and command and control center, which contained "hundreds of thousands" of stolen credentials.

"This is just one out of many Zeus 2 botnets operating all over the world," says Amit Klein, Trusteer's CTO. "What is especially worrying is that this botnet doesn't just stop at user IDs and passwords. By harvesting client-side certificates and cookies, the cybercriminals can extract a lot of extra information on the user that can be used to augment their illegal access to those users' online accounts.

"Coupled with the ability to remotely control users' machines, download data, and run any file on them, this means that the fraudsters can insert partial or complete Internet pages into a live Web session, enabling them to inject transactions at will or extract even more data from the hapless victims," Klein says.

The Zeus implementation is "fraudsters' ultimate paradise," Klein says, "giving them hidden access to the users' online financial and allied activities as surely as if they sat at their shoulders watching their every keystroke, move, and online action."

Separately, researchers at AVG yesterday released a white paper (PDF) that outlines details on Mumba, a new Zeus-based botnet that immediately infected more than 35,000 computers when it launched in April.

The botnet has now collected at least 60 GB of information from some 55,000 computers, half of which are in the U.K. and Germany, according to an AVG analysis of a server that was used to collect the data.

The Mumba botnet is probably controlled by the Avalanche Group, which specializes in phishing sites as well as malware, AVG says. It uses at least four different variants of Zeus, which can be adapted to send spam, steal financial information, or spread malware, the researchers say.

"The Mumba botnet is probably one of the first to use the Avalanche operation in order to host its stolen goods as well as the malware infection," the white paper says. "This seems to be yet another step in the never ending arms race between the security industry and cybercriminals."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.