Japanese Banks Targeted With New Rovnix Trojan

The language barrier that for long protected Japanese banks from being targeted by Trojan attacks appears to have been decisively overcome by cybercrime groups if the sustained attacks against the nation’s financial institutions over the past few months are any indication.

The latest manifestation of that trend is Rovnix, an advanced malware tool that is currently being used to target customers at as many as 14 major Japanese banks.

IBM’s X-Force security researchers have been tracking the banking Trojan for the past several months and this week described the Rovnix campaign against the banks as “nothing short of an onslaught.” The infection campaigns, which began in early December, include the use of email messages with an attachment containing the Rovnix downloader. Recipients who click on the attachment -- typically disguised as a package delivery waybill from an international transport company -- end up downloading the malware on their systems.

Until recently, the operators of Rovnix have used the malware mainly to target banks in Europe. But more recently, Rovnix’ configuration file appears to have been uniquely adapted to target banks in Japan, IBM researchers found. The malware contains attack schemes that have been specifically customized for each of the targeted banks.

Rovnix uses a Web injection mechanism that is capable of perfectly imitating a targeted bank’s Web pages. When a user with an infected computer visits the web page of a targeted bank, Rovnix serves up Web pages that look and feel exactly like the bank’s actual site. The malware is even capable of adapting itself to whatever authentication process the user might employ to log into the account. For instance, Rovnix in some cases tries to get victims to download a malicious Android app on their smartphone so it can intercept authorization codes send via SMS by the bank.

“For each bank, the injections used by Rovnix modify large parts of the original page, which is designed to trick the victim into divulging the second password or token for the ensuing fraudulent transaction,” IBM cybersecurity evangelist Limor Kessem wrote.

The use of convincing-sounding Japanese language email messages to distribute Rovnix and the level of customization that has gone into the attacks suggests that the gang behind Rovnix has put some thought into its campaign in Japan, IBM noted. The malware continues a trend that began last summer when cybercrime gangs suddenly turned their attention on Japanese banks after mostly ignoring it for the past several years. Since then, financial services companies in the country have been hammered by a succession of banking Trojans including Shifu and Tsukuba.

Etay Maor, senior cybersecurity strategist at IBM Security, says US organizations need to keep an eye on threats like Rovnix because of the ease with which cybercriminals can modify such malware for use here.

“Companies should pay specific attention to the amount of effort the attackers have put into this campaign as it shows the attackers studied how individual banks work, uncovered their security measures, and developed specific schemes for them,” Maor says.

The attackers put in the effort because they knew they could generate significant revenue through the campaign, he says. “It’s important for banks and financial institutions to monitor for these types of threats and campaigns as they can be quickly migrated to target the United States – or wherever [the attackers] determine is worth the investment.”

The growing sophistication of such malware is also a worry. Rovnix, for instance, has employed extensive mechanisms to protect against known security tools. The malware also leverages digital signatures in all communications and even uses code before the malware reaches the device to detect any anti-virus software or security measures that may be present on it, Maor says. “It uses many different modules to look into the device and be persistent in its attack. “