Citadel Banking Malware Evolving, Spreading Rapidly
A computer trojan targeting online banking software is rapidly spreading and evolving thanks to the open source development model being utilized by its creators.
Called Citadel, the new piece of malware is based on ZeuS, one of the oldest and most popular online banking Trojans. ZeuS was abandoned by its creator in late 2010, and its source code leaked online a few months later.
Since its public release, the ZeuS source code has served as base for the development other Trojans, including Ice IX and now Citadel.
“Seculert’s Research Lab discovered the first indication of a Citadel botnet on December 17th, 2011,” the security company said Wednesday in a blog post. “The level of adoption and development of Citadel is rapidly growing.”
Seculert has identified over 20 botnets that use different versions of this Trojan. “Each version added new modules and features, some of which were submitted by the Citadel customers themselves,” the company said.
The most interesting aspect of Citadel is its development process, which is similar to the ones behind community-supported open source projects. “Similar to legitimate software companies, the Citadel authors provide their customers with a User Manual, Release Notes and a License Agreement,” Seculert said.
Like its parent, Citadel is sold as a crimeware toolkit on the underground market. The tookit allows fraudsters to customize the Trojan according to their needs and command and control infrastructure.
However, the Citadel authors went even further and developed an online platform where customers can request features, report bugs, and even contribute modules.
So is a new trend in malware being seen? Seculert believes it is.
The security company believes that the success of this Trojan could drive other malware writers to adopt the open source model. “This recent development may be an indication of a trend in malware evolution,” Seculert said.
- Researchers Warn:Trojan evolving through ‘open source’ development (netsecurityit.wordpress.com)
- Collaboration Fuels Rapdid Growth of Citadel Trojan (krebsonsecurity.com)
Posted on February 15, 2012, in attacks, botnets, Cybersecurity, Hacking, malware, Security breach and tagged Citadel, Ice IX, Online banking, Open source, Seculert, Source code, Trojan Horses, ZeuS. Bookmark the permalink. Comments Off on Citadel Banking Malware Evolving, Spreading Rapidly.