IBM X-Force researchers analyzed the activity of a relatively new banking Trojan known as BackSwap. BackSwap emerged in March 2018 and, until recently, had only targeted Polish banks. The malware’s target list now features six major banks in Spain.

According to X-Force analysis, BackSwap is its own malware project, but it is based on features that existed within the Tinba Trojan. The malware’s operators keep the code as their own project; in that sense, it is considered gang-owned and not commercial malware.

A Twist in the Tale

Overall, BackSwap is no more sophisticated than any other active banking Trojan. Its highlight is its webinjection mechanism. Instead of using the more common method of hooking browser functions, then creating different versions for each architecture, BackSwap injects JavaScript into the address bar.

By simulating user input to access the browser’s address bar and inserting the malicious script directly there, BackSwap can execute the script using JavaScript protocol URLs and bypass protections of both the browser and the bank’s third-party security controls.

In terms of what BackSwap does with the injections, this is where the novelty ends. Just as malware such as Zeus has been doing for over a decade, BackSwap uses malicious scripts to modify what victims see on their bank’s website in classic man-in-the-browser (MitB) style:

  • Scripts wait for a minimum amount of data to be transferred before replacing the destination account number.
  • Scripts inject mule account numbers on the fly via MitB.
  • Scripts hide the mule account number that the money will go to and instead present the original destination account the victim entered.

BackSwap’s Fraud Method

The likely fraud scenario based on BackSwap’s capabilities is in-session fraud automated by MitB malware scripts. The malware’s scripts wait for the user to go to a page where a transaction is to take place. When the victim initiates activity that’s interesting to the attacker, such as adding a payee or starting a money transfer, the malware replaces the destination account with a mule account number.

Figure 1: The BackSwap function responsible for account number replacement

Using MitB scripts to alter transaction details sent to the bank is not a new method. What’s new here is the way BackSwap implements it to circumvent third-party security on the bank’s website. This method can be more successful with banks that don’t require two-factor authentication (2FA) or out-of-band transaction authorization (OOBA) from customers moving money to other accounts.

Malware Spam and Then Some

BackSwap is most often delivered to users via malware spam, concealed in an attachment of a productivity file like Microsoft Word or bundled inside other programs. BackSwap favors popular freeware or open source programs and plants its code in the initialization phase of the program. When run during an early stage of the program’s execution, the code replaces the installation routine with malicious instructions that execute BackSwap instead. One interesting choice was Ollydbg.exe, which is a program often used by malware researchers.

Testing Attack Turfs

The malware’s attack scope has thus far been limited to a few banks in Poland and some banks in Spain, specifically targeting personal banking.

The limited number of banks in each country so far may suggest that BackSwap is still in testing. Our research team expects to see more testing in other geographies in the coming weeks, and possibly a wider scope of attack for this Trojan in the fourth quarter of 2018.

Will we see BackSwap on the top 10 list of financial malware in 2019? IBM X-Force will keep updating its information on BackSwap via the X-Force Exchange.

Figure 2: Top most prevalent financial malware families (2018 YTD)

Indicators of Compromise (IoCs)

Command-and-control (C&C) server IPs:

  • hxxps://5[.]61[.]47[.]74/batya/give.php
  • hxxps://103[.]242[.]117[.]248/batya/give.php
  • hxxps://mta116[.]megaonline[.]in
  • hxxps://czcmail[.]com (IP: 119[.]23[.]128[.]176)

Recent sample MD5s:

  • 180721A8551FBBCD763C320E7034E36C (WinGraph32.exe)
  • F44D28F852A99821B681C3EAF044C8D3 (OllyDbg.exe)

Interested in emerging security threats? Read the latest IBM X-Force Research

More from Banking & Finance

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

Why Cybersecurity Risk Assessment Matters in the Banking Industry

When customers put money in a bank, they need to trust it will stay there. Because of the high stakes involved for the customer, such as financial loss, and how long it takes to resolve fraud and potential identity theft, customers are sensitive to the security of the bank as well as fraud prevention measures. Banks that experience high volumes of fraud are likely to lose customers and revenue. The key is to protect customers and their accounts before problems…

Cost of a Data Breach: Banking and Finance

The importance of cybersecurity has touched almost every industry. Beyond that, robust cybersecurity is table stakes for several sectors, particularly health care and the banking and finance industry. Not only is financial data at risk, but so is customer trust. In banking and finance, trust means everything. Yet, consumers are hesitant to share their confidential data. A recent McKinsey survey revealed that no industry achieved a trust rating of 50% for data protection. Here’s the most sobering stat: 87% of…

What Do Financial Institutions Need to Know About the SEC’s Proposed Cybersecurity Rules?

On March 9, the U.S. Securities and Exchange Commission (SEC) announced a new set of proposed rules for cybersecurity risk management, strategy and incident disclosure for public companies. One intent of the rule changes is to provide “consistent, comparable and decision-useful” information to investors. Not yet adopted, these new rules – published in the Federal Register on March 23 – could change reporting requirements. Take a look at some of the big-ticket items and what your organization needs to know.…