Russian Trojan targets bank account

SecureWorks warned a Russian criminal organization is using the Gozi trojan to steal personal information by exploiting an Internet Explorer vulnerability.

According to a recent report, the trojan has been specifically designed to bypass banks' protection systems and has stolen information about 10,000 records.

A spokesman for SecureWorks, the first security firm that discovered Gozi said that in its code there are components that trick the account validation system used by banks. SecureWorks calls on the financial community to be alert to the next attacks.

Analysts from SecureWorks said Gozi started operations on December 13, 2006. It was only discovered 50 days later, when it stole about 10,000 records, with personal information of about 5,200 people and about 2,000 social security cards.

Russian Trojan targets bank account Picture 1 SecureWorks also provides data collected from banking applications, student forums, online job search software, electronic taxation tools, government applications and infected online phone stations. infected.

' Interestingly, many banks that have customers attacked have a user identity system .' The representative of SecureWorks said via e-mail: ' However, the information that Gozi collected allows people to pass through the security system quite easily '. Stolen information includes account numbers and passwords of users at the world's leading banks, money transfer services and retailers. In addition, hackers also obtained login information of employees to bypass law applications. These data were sold by Russian hackers for about $ 2 million.

Don Jackson, a specialist at SecureWorks, said many home computers are infected when users visit online gaming and entertainment forums.

SecureWorks said it had informed the US authorities in February, and is continuing to support the investigation.

Mr. Jackson confirmed that the mother server dispersed Gozi is located in Russia, belonging to a record business network 'not very clean' and is considered the gathering point of those who distribute trojans, spyware, phishing tools, . Places. Only selling stolen data has been deleted but the server is still active and continues to receive new data from Gozi.

Hoang Minh

Marvin Fry

Update 26 May 2019

You should read it

May be interested

Use SEO to bring Google search results to bank trojans
when you think you know all the tricks, malware teachers always have new tricks that surprise you.
How to check the balance of Maritime Bank account
for those who are using maritime bank account, there will be 5 different ways to easily look up account balance in your bank card.
The Ministry of Public Security warned users to warn of bank account theft when withdrawing money at ATMs
according to the ministry of public security, the operation of criminals using high technology is increasingly sophisticated. they can use high-tech devices located at many public atms to steal bank account information to hijack cardholders' assets or use fake bank cards to withdraw money at atms. .
Anti-hacker steal bank account
bitdefender's global data security analysis department said nearly 80 people were arrested in the us and uk for using the zeus trojan ...
Trojan.Peskyspy sneaks Skype calls
symantec's team has discovered the appearance of a trojan code that targets skyke's voip (voice over ip) service users.
Hacker took advantage of the vulnerability in SS7 to steal bank accounts
the ss7 telecommunications vulnerability is no stranger when it not only has the ability to control applications but also steal your bank account information.
Detected 4 banking trojans in 11 apps on Google Play Store
banking trojans are designed to steal banking credentials and other sensitive data.
Russia recognizes Bitcoin and cryptocurrencies as currency
as russian newspaper kommersant reported this morning, the russian government and central bank have reached a new agreement on how to regulate cryptocurrencies.
Carefully stolen information with Trojan - How to disable Trojan
you are using the internet with a password only you know, but somehow you are still using someone else's account. you suspect your mailbox has been previewed by other people even though you did not go to a public internet service to get it, so you cannot reveal your login information. if so, it is very likely that your computer has been installed or infected with trojan.
What is a Trojan? How to avoid trojan attack?
a trojan is not a virus, but its severity and impact are not different from viruses.

Russian Trojan targets bank account

You should read it

May be interested

Virus Removal - Spyware