New Malware Campaign Targets Financials, Retailers

The attack uses a legitimate remote access system as well as several families of malware.

Dark Reading Staff, Dark Reading

April 18, 2019

1 Min Read
Dark Reading logo in a gray background | Dark Reading

A new wave of cyberattacks uses legitimate remote access software to take over user accounts in financial services and retail organizations. 

According to CyberInt Research Lab, the attack is using the same tools and tactics used in earlier campaigns against financial institutions in Chile, India, Italy, Malawi, Pakistan, and South Korea, and against retailers in the US.

The current attack uses an off-the-shelf commercial remote administration tool called Remote Manipulator System (RMS), developed by a Russian-based company, as one of the malicious payload delivered through a spear-phishing campaign. Malware families including Gussdoor, Xrat, and Vimditator are also being delivered through the targeted malicious email messages.  

The cybercrime group behind the attack, TA505, has been active since 2014 and has been involved in campaigns using Dridex and Shifu banking trojans, as well as Locky ransomware and the Neutrino botnet/exploit kit. CyberInt says that an analysis of the code used in all the attacks leads them to believe that the financially motivated gang is made up of native-Russian speakers.

For more, read here.

About the Author

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights