We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Banking Trojan uses money mules

URLzone plays tricks with investigators

A sophisticated Trojan horse program designed to empty bank accounts has a new trick up its sleeve: it lies to investigators about where the money is going.

First uncovered by Finjan Software last week, the URLzone Trojan is already known to be very advanced. It rewrites bank pages so that the victims don't know that their accounts have been emptied, and it also has a sophisticated command-and-control interface that lets cybercriminals pre-set what percentage of the account balance they want to clear out.

But Finjan isn't the only company looking into URLzone. RSA Security researchers say the software uses several techniques to spot machines that are run by investigators and law enforcement. Researchers typically create their own programs that are designed to mimic the behaviour of real Trojans. When URLzone identifies one of these, it sends it bogus information, according to Aviv Raff, RSA's FraudAction research lab manager.

Security experts have long published research into the inner workings of malicious computer programs such as URLzone, Raff said. "Now the other side knows that they are being watched and they're acting," he said.

When URLzone spots a researcher's program, instead of simply disconnecting from the researcher's computer, the server tells it to do a money transfer. But instead of transferring the money into one of the criminal's money mules - people who have been recruited to move cash overseas - it chooses an innocent victim. Typically, these are people who have received legitimate money transfers from other hacked computers on the network, Raff said.

So far, more than 400 legitimate accounts have been used in this way, RSA said.

The idea is to confuse researchers and to prevent the criminal's real money mules from being discovered.

Banking Trojans such as Zeus and Clampi have been emptying accounts for years now, but Finjan dubbed URLzone the first of a new, smarter generation of the crimeware.

According to Finjan, URLzone infected about 6,400 computer users last month and was clearing about €12,000 per day.

See more:

PC security advice

IDG UK Sites

Sky to offer mobile phone contracts with O2: Will Vodafone make a move?

IDG UK Sites

Good news for Apple, bad news for Samsung (and the rest of us)

IDG UK Sites

Do we need to fight the government again over design and art education?

IDG UK Sites

How to make money selling books on the iBookstore, publish your book in Apple's book store