A new ready-to-attack version of banking Trojan NukeBot is spotted

Kaspersky Lab has detected NukeBot – a new malware which has been designed to steal the credentials of online banking customers. Earlier versions of the Trojan were known to the security industry as TinyNuke, but lacked the features necessary to launch attacks. The latest versions however, are fully operable, and contain code to target the users of specific banks.

Although the appearance of a malware family in the wild is not unusual, the fact that criminals have a ready-to-attack version of the Trojan, means that soon they may initiate a wide-scale malicious campaign, to infect multiple users. As an early warning to its customers and other users, Kaspersky Lab has published a brief analysis of the malware.

NukeBot is a banking Trojan. Upon infection it “injects” malicious code into the webpage of an online banking service displayed in a victim’s browser and then steals user data, spoofs their credentials, and more.

Around 5 percent of all samples found by Kaspersky Lab were NukeBot’s new ‘combat versions’, which have improved source codes and attacking capacities. Among other things these versions contain injections – specific pieces of code, which mimic parts of user interface of real online banking services. Based on the analysis of injections, Kaspersky Lab experts believe the main targets of the new version of NukeBot are users of several French and US banks.

Moreover, Kaspersky Lab researchers managed to detect several NukeBot modifications that didn’t have web injection functionality, and were designed to steal mail client and browser passwords. This means that developers of new versions may aim to widen the functionality of this malware family.

"So far we have seen NukeBot versions which are ready to attack the customers of at least six banks located in France and the US, however this list of targets looks like only the beginning. The goal of our brief research is to warn the banking community and online banking customers about a potentially emerging threat. We urge interested parties to use the results of our research in order to protect themselves from this threat in advance,” said Sergey Yunakovsky, security expert at Kaspersky Lab.

For financial organizations providing online banking services, Kaspersky says that make sure you have an effective fraud prevention solution in place, so that you can quickly and accurately spot unauthorized use of customer accounts and irregular financial activity. For customers, it says use an Internet security solution with tailored technologies to protect financial transactions, like Kaspersky Lab’s Safe Money and regularly run a system scan to check for possible infections.