DanaBot, one of the most recent cyberthreats to hit the banking industry, has developed a way to avoid detection on virtual machines as it shifts focus from Australia to Poland.

The malware’s upgraded capabilities mean that DanaBot will not run its executable within a virtual machine (VM) environment, making it even more difficult to detect with basic security tools, according to research from IBM Trusteer.

DanaBot surfaced in May 2018, with initial attacks involving Australian financial institutions that fell for a bogus invoice issued from a legitimate, local accounting software firm called MYOB. Like other financial cyberthreats, DanaBot can steal access to user accounts and remotely control devices to commit fraud. The most recent activity, however, shows the banking Trojan is now being aimed at Polish banks and cryptocurrency exchange platforms.

Tracking DanaBot’s Evolution

Compared to Ramnit, TrickBot and other financial cyberthreats, DanaBot is still a relatively minor player. However, the anti-VM feature shows how quickly the malware is evolving into more sophisticated forms. Even before this adaptation, DanaBot was largely invisible to antivirus software, and researchers noted that more stealth updates are likely to come soon.

Perhaps more importantly, DanaBot is not a piece of privately owned code operated by a single group of cybercriminals. It is commercially available, which means the shift from Australia to Poland might be just the beginning if DanaBot draws interest from malicious actors targeting other parts of the world.

How to Fend Off Financial Cyberthreats

DanaBot uses malware spam to break into financial institutions, where employees may be too preoccupied to notice suspicious links or websites. There’s also a lot might not catch with the naked eye, including scripts, document object model data and other elements.

IBM experts suggest combining analytics with machine learning tools that can more readily detect phishing attempts, including image-based attacks that use screenshots of otherwise legitimate-looking bank websites coupled with online forms to steal usernames and passwords. As DanaBot rises through the ranks of financial cyberthreats, a cognitive approach to protecting endpoints is critical.

More from

Why Cybersecurity Risk Assessment Matters in the Banking Industry

When customers put money in a bank, they need to trust it will stay there. Because of the high stakes involved for the customer, such as financial loss, and how long it takes to resolve fraud and potential identity theft, customers are sensitive to the security of the bank as well as fraud prevention measures. Banks that experience high volumes of fraud are likely to lose customers and revenue. The key is to protect customers and their accounts before problems…

What CISOs Should Know About CIRCIA Incident Reporting

In March of 2022, a new federal law was adopted: the Cyber Incident Reporting Critical Infrastructure Act (CIRCIA). This new legislation focuses on reporting requirements related to cybersecurity incidents and ransomware payments. The key takeaway: covered entities in critical infrastructure will now be required to report incidents and payments within specified time frames to the Cybersecurity and Infrastructure Security Agency (CISA). These new requirements will change how CISOs handle cyber incidents for the foreseeable future. As a result, CISOs must…

Will the 2.5M Records Breach Impact Student Loan Relief?

Over 2.5 million student loan accounts were breached in the summer of 2022, according to a recent Maine Attorney General data breach notification. The target of the breach was Nelnet Servicing, a servicing system and web portal provider for the Oklahoma Student Loan Authority (OSLA) and EdFinancial. An investigation determined that intruders accessed student loan account registration information between June and July 2022. The stolen data includes names, addresses, emails, phone numbers and social security numbers for 2,501,324 student loan…

Containers, Security, and Risks within Containerized Environments

Applications have historically been deployed and created in a manner reminiscent of classic shopping malls. First, a developer builds the mall, then creates the various stores inside. The stores conform to the dimensions of the mall and operate within its floor plan. In older approaches to application development, a developer would have a targeted system or set of systems for which they intend to create an application. This targeted system would be the mall. Then, when building the application, they would…