Normally, it’s the initial release of malware that has security experts worried, but the free availability of tools to make the ZeusVM banking Trojan could send some firms into a panic.

Source code for the builder of ZeusVM — also known as KINS — as well as its control panel has been online since last month, according to MalwareMustDie!, a blog run by a security research organization of the same name. The binary generated by the builder that was leaked on the Internet is a newer version of the botnet-making tool.

As Computerworld pointed out, anything that helps cybercriminals make their own variant on the ZeusVM malware is a major concern, given its track record of stealing online financial credentials and other sensitive information. Provided they know how to alter the connectivity features of the Trojan’s command-and-control (C&C) server settings or browser URL settings, cybercriminals could create a powerful new weapon.

It’s possible law enforcement authorities or other officials could take down the leaked files, but as The Register suggested, it may already be too late to avoid what it described as a possible “bot-geddon,” or a huge wave of malware based on ZeusVM. Increased awareness among CISOs and their teams may be the only course of action, encouraging banks and other enterprises to be particularly vigilant in their monitoring for new attacks.

Already, at least six new botnets based on ZeusVM have been identified since the leak, SC Magazine reported, and version 3.0 of the malware is reasonably affordable for criminal collectives at a price point of $5,000 on the black market. Before the summer is over, it’s reasonable to expect the number of related threats could increase sharply, given that cybercriminals will probably take note of the news, as well.

Beyond looking over their shoulder, IT departments and security experts may want to study the ZeusVM data leak to see if they could use the information to build their own protection mechanisms. Videos embedded in a Softpedia post showed details on how malware would be hidden inside an encrypted JPEG file as well as an overview for building KINS botnets. It could be a race between malicious attackers and CISOs to see who makes the best use of this information first.

More from

How Do You Plan to Celebrate National Computer Security Day?

In October 2022, the world marked the 19th Cybersecurity Awareness Month. October might be over, but employers can still talk about awareness of digital threats. We all have another chance before then: National Computer Security Day. The History of National Computer Security Day The origins of National Computer Security Day trace back to 1988 and the Washington, D.C. chapter of the Association for Computing Machinery’s Special Interest Group on Security, Audit and Control. As noted by National Today, those in…

Abuse of Privilege Enabled Long-Term DIB Organization Hack

From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to an advanced cyberattack on a Defense Industrial Base (DIB) organization’s enterprise network. During that time frame, advanced persistent threat (APT) adversaries used an open-source toolkit called Impacket to breach the environment and further penetrate the organization’s network. Even worse, CISA reported that multiple APT groups may have hacked into the organization’s network. Data breaches such as these are almost always the result of compromised endpoints…

Deploying Security Automation to Your Endpoints

Globally, data is growing at an exponential rate. Due to factors like information explosion and the rising interconnectivity of endpoints, data growth will only become a more pressing issue. This enormous influx of data will invariably affect security teams. Faced with an enormous amount of data to sift through, analysts are feeling the crunch. Subsequently, alert fatigue is already a problem for analysts overwhelmed with security tasks. With the continued shortage of qualified staff, organizations are looking for automation to…

Worms of Wisdom: How WannaCry Shapes Cybersecurity Today

WannaCry wasn't a particularly complex or innovative ransomware attack. What made it unique, however, was its rapid spread. Using the EternalBlue exploit, malware could quickly move from device to device, leveraging a flaw in the Microsoft Windows Server Message Block (SMB) protocol. As a result, when the WannaCry "ransomworm" hit networks in 2017, it expanded to wreak havoc on high-profile systems worldwide. While the discovery of a "kill switch" in the code blunted the spread of the attack and newly…