Only two months have passed since the international joint operation to bring down the Gameover Zeus (GOZ) botnet. In a combined effort, law enforcement and service providers were able to disrupt the botnet operation and apprehend several of those responsible. The GOZ malware was known for its peer-to-peer-based (P2P) infrastructure, large number of infected devices and sophisticated crime logic that successfully defrauded banks across the globe.

IBM Trusteer’s advanced malware researchers have now detected a new variant of the Bugat malware that uses almost identical (and somewhat upgraded) GOZ HTML injections starting to spread throughout the United Kingdom and the Middle East.

While Bugat’s (aka, Feodo, Geodo and Cridex) fundamental infrastructure did not change and does not utilize the same P2P infrastructure approach as GOZ, the HTML injections used are very similar — and in some cases identical — to GOZ; that is, the HTML injections and scripts as well as the structure of the attack used by Bugat to target banking applications are GOZ-like.

There are two possible explanations for this. First, someone from the GOZ group could have moved to the Bugat team. This would not be the first time something like this has happened, which we’ve witnessed in other cases involving Zeus and Citadel; however, it is not very likely in this case since Bugat and GOZ are essentially competitors, while Zeus and Citadel are closely related. The second and more likely explanation is that the Bugat team could have analyzed and perhaps reversed the GOZ malware before copying the HTML injections that made GOZ so highly profitable for its operators.

What’s in the New Bugat Malware Variant?

The new Bugat malware attack on banking applications includes multiple elements for stealing credentials, overcoming two-factor authentication, dealing with IP reputation and other counter-security measures. In some of the attacks, once infected users direct their browser to a bank targeted by the new Bugat variant, the following happens:

  1. Users never reach the real bank login page. Instead, they are directed to a malicious site and are requested to provide their login information.
  2. In real time, the criminal captures the credentials and connects to the bank via the victim’s IP address. This is achieved by Bugat’s back-connect capability, which helps the attacker defeat IP reputation security checks.
  3. In case the bank requests more information from the criminal during the transaction process, the criminal can obtain these data elements by using social engineering and HTML injection. These requests are presented to victims in real time. Such requests can include secret questions and two-factor authentication such as one-time passwords.

IBM Trusteer research teams have seen a dramatic drop in the number of GOZ-infected devices and number of successful fraud attempts using this technique since the joint operation against GOZ. However, with this new variant of Bugat malware, the same successful approach seems to be coming back to life by a competing Trojan.

To stay protected, organizations can partner with a third-party security company to prevent and detect this new Bugat malware variant and identify its techniques. This is not the first time that the Bugat team copied or reused other proven attack methods, so IBM researchers will continue to monitor and analyze new malware variants for both original and borrowed fraud techniques.

More from Malware

RansomExx Upgrades to Rust

IBM Security X-Force Threat Researchers have discovered a new variant of the RansomExx ransomware that has been rewritten in the Rust programming language, joining a growing trend of ransomware developers switching to the language. Malware written in Rust often benefits from lower AV detection rates (compared to those written in more common languages) and this may have been the primary reason to use the language. For example, the sample analyzed in this report was not detected as malicious in the…

Raspberry Robin and Dridex: Two Birds of a Feather

IBM Security Managed Detection and Response (MDR) observations coupled with IBM Security X-Force malware research sheds additional light on the mysterious objectives of the operators behind the Raspberry Robin worm. Based on a comparative analysis between a downloaded Raspberry Robin DLL and a Dridex malware loader, the results show that they are similar in structure and functionality. Thus, IBM Security research draws another link between the Raspberry Robin infections and the Russia-based cybercriminal group 'Evil Corp,' which is the same…

The Ransomware Playbook Mistakes That Can Cost You Millions

If there is one type of cyberattack that can drain the color from any security leader’s face, it’s ransomware. A crippling, disruptive, and expensive attack to recover from, with final costs rarely being easy to foretell. Already a prevalent threat, the number of ransomware attacks rose during the pandemic and nearly doubled in the year between 2020 and 2021, continuing to rise since. Focusing on the extortion price of these attacks, the cost of a ransomware attack can appear finite…

From Ramnit To Bumblebee (via NeverQuest): Similarities and Code Overlap Shed Light On Relationships Between Malware Developers

A comparative analysis performed by IBM Security X-Force uncovered evidence that suggests Bumblebee malware, which first appeared in the wild last year, was likely developed directly from source code associated with the Ramnit banking trojan. This newly discovered connection is particularly interesting as campaign activity has so far linked Bumblebee to affiliates of the threat group ITG23 (aka the Trickbot/Conti group), who are not known to have had a previous connection with Ramnit. This year has so far proven tumultuous…