We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Banking Trojan uses money mules

URLzone plays tricks with investigators

A sophisticated Trojan horse program designed to empty bank accounts has a new trick up its sleeve: it lies to investigators about where the money is going.

First uncovered by Finjan Software last week, the URLzone Trojan is already known to be very advanced. It rewrites bank pages so that the victims don't know that their accounts have been emptied, and it also has a sophisticated command-and-control interface that lets cybercriminals pre-set what percentage of the account balance they want to clear out.

But Finjan isn't the only company looking into URLzone. RSA Security researchers say the software uses several techniques to spot machines that are run by investigators and law enforcement. Researchers typically create their own programs that are designed to mimic the behaviour of real Trojans. When URLzone identifies one of these, it sends it bogus information, according to Aviv Raff, RSA's FraudAction research lab manager.

Security experts have long published research into the inner workings of malicious computer programs such as URLzone, Raff said. "Now the other side knows that they are being watched and they're acting," he said.

When URLzone spots a researcher's program, instead of simply disconnecting from the researcher's computer, the server tells it to do a money transfer. But instead of transferring the money into one of the criminal's money mules - people who have been recruited to move cash overseas - it chooses an innocent victim. Typically, these are people who have received legitimate money transfers from other hacked computers on the network, Raff said.

So far, more than 400 legitimate accounts have been used in this way, RSA said.

The idea is to confuse researchers and to prevent the criminal's real money mules from being discovered.

Banking Trojans such as Zeus and Clampi have been emptying accounts for years now, but Finjan dubbed URLzone the first of a new, smarter generation of the crimeware.

According to Finjan, URLzone infected about 6,400 computer users last month and was clearing about €12,000 per day.

See more:

PC security advice

IDG UK Sites

Best January sales 2015 UK tech deals LIVE: Best New Year bargains and savings on phones, tablets,...

IDG UK Sites

Chromebooks: ready for the prime time (but not for everybody)

IDG UK Sites

Best Photoshop Tutorials 2014: 10 inspiring step-by-step guides to creating amazing art,...

IDG UK Sites

Complete guide to iPhone and iPad settings: Get to know iOS 8 Settings UPDATED