March 22, 2016 By Limor Kessem 4 min read

IBM X-Force researchers continuously monitor and track the activity and migration of malicious banking Trojans around the world, and they recently observed that Singapore is becoming a rising target for cybercrime.

Due to the country’s unique demographics, which include a mix of Chinese-speaking and English-speaking businesses, many of the attacks seen in western countries as well as malware traditionally aimed at Asian targets have increasingly turned their sights to Singapore.

The trends that affect the country nowadays range from traditional site redirection and content overlay to the more advanced PC and mobile malware that intercept out-of-band authentication elements such as texted verification codes. In fact, just a few months ago the Association of Banks in Singapore warned Singaporean mobile phone users against mobile malware posing as a software update for the popular messaging app WhatsApp.

Why Singapore?

It’s no coincidence that threats increasingly target Singapore, which is one of Asia’s most advanced countries in digital banking. It reportedly has the highest variety of digital offerings in Asia, according to the DBS Research Group. In the global arena, Singapore has the second-highest inclination for digital banking, according to an A.T. Kearney and EFMA global banking study.

Furthermore, the perpetual growth of multinational corporations conducting business in Singapore makes the region even riper for financial cyberattacks due to a constant rise in the type of high-value accounts criminals are targeting. Due to the thriving growth of international business, most of the organizations in Singapore communicate in English, which pairs with the fact that most malware campaigns are launched in English.

However, IBM X-Force researchers are also seeing an increase of Chinese-language activity on the Dark Web in the region. This is yet another contributing factor to the increase of fraud directed at entities and individuals in Singapore because Mandarin is considered one of the country’s official languages. With these factors in place, it is clear that Singapore is proving to be a valuable geographic target for cybercriminals.

Here are some recent top malware campaigns targeting Singapore, based on IBM X-Force data and intelligence findings.

The Dridex Trojan: A Bugat Descendant

The Dridex banking Trojan, which was built on the Bugat code base, has been identified as the top malware family targeting Singaporean banks in 2016 so far. Moreover, Dridex represents 84 percent of attacks in the country over the past year. X-Force research suggested that the organized cybercrime gang behind this malware is adopting advanced attack methods such as Dyre’s trademark redirection technique as it continues to intensify its focus on high-value business accounts in the region.

Leveraging the redirection attack technique, Dridex victims are unknowingly sent to an entirely new, fake website when they try to access their online banking site. Since they are immediately redirected, they never actually access the bank’s true site. The power of this attack lies in its simplicity. By keeping users away from their bank’s site, the attacker can deceive them into divulging personal authentication codes without the bank’s counter-fraud systems recognizing that a customer’s session has been initiated or diverted.

These tactics have already been seen in other parts of the world and are now shifting to Singapore.

The Tinba v3 Trojan

X-Force researchers first discovered Tinba targeting Singaporean banks in 2015, and this malware continues to be one of the most active threats in the region today. In December 2015, Tinba v3 set its sights on business and corporate accounts held with nine major bank brands in Singapore.

These Singaporean banks became the top targets for the Asia-focused malware campaign, accounting for more than one-third of all Tinba-targeted brands. In fact, Singapore is in the cross hairs of Tinba v3 27 percent of the time, making it the most targeted country for the Tinba variety.

Tinba v3 continues to be an advanced, actively developed banking Trojan. Judging from ongoing IBM X-Force research into this malware’s evolution, it is likely to have a dedicated development team behind it.

GM Bot: Most Prolific Android Banking Trojan

GM Bot, mobile malware that affects Android-based devices, is the latest and most popular commercial malware that organizations in Singapore must be aware of. While it first emerged in the Russian-speaking cybercrime underground in 2014, GM Bot’s source code was recently leaked, making the Trojan accessible to potential attackers to use for free. With the code leaked, more cybercriminals can now recompile the code, create new variants and customize it for specific regions.

GM Bot is specifically designed to help fraudsters steal banking and payment credentials, as well as bypass verification techniques used in banking transaction authorization. For example, GM Bot can launch fake overlay windows to mimic bank applications to steal user login details and payment card information. Additionally, the malware can control a device’s SMS relay and voice calls to intercept verification code texts or calls incoming from a bank to the user.

How Can Singapore Fight Back?

IBM Security regularly works with customers around the globe to study and stop banking Trojan attacks launched by gangs that operate threats such as Dridex, Tinba and GM Bot. Singaporean organizations should consider using technologies that can adapt to emerging threats to detect infections and protect customer endpoints.

However, leveraging the right detection solutions is only part of the battle, and banks should also look to educate users, deploy solutions for the detection of redirection attacks and keep security teams ahead of emerging malware trends.

Keeping up to date is made easier by joining threat intelligence sharing platforms like the IBM X-Force Exchange to share critical threat information and understand how to react to ever-changing threats. As today’s cybercriminals continue to share information with each other on the Dark Web, those in the security community must also unite to combat these new breeds of increasingly sophisticated threats.

More from

CVE-2023-20078 technical analysis: Identifying and triggering a command injection vulnerability in Cisco IP phones

7 min read - CVE-2023-20078 catalogs an unauthenticated command injection vulnerability in the web-based management interface of Cisco 6800, 7800, and 8800 Series IP Phones with Multiplatform Firmware installed; however, limited technical analysis is publicly available. This article presents my findings while researching this vulnerability. In the end, the reader should be equipped with the information necessary to understand and trigger this vulnerability.Vulnerability detailsThe following Cisco Security Advisory (Cisco IP Phone 6800, 7800, and 8800 Series Web UI Vulnerabilities - Cisco) details CVE-2023-20078 and…

X-Force data reveals top spam trends, campaigns and senior superlatives in 2023

10 min read - The 2024 IBM X-Force Threat Intelligence Index revealed attackers continued to pivot to evade detection to deliver their malware in 2023. The good news? Security improvements, such as Microsoft blocking macro execution by default starting in 2022 and OneNote embedded files with potentially dangerous extensions by mid-2023, have changed the threat landscape for the better. Improved endpoint detection also likely forced attackers to shift away from other techniques prominent in 2022, such as using disk image files (e.g. ISO) and…

The compelling need for cloud-native data protection

4 min read - Cloud environments were frequent targets for cyber attackers in 2023. Eighty-two percent of breaches that involved data stored in the cloud were in public, private or multi-cloud environments. Attackers gained the most access to multi-cloud environments, with 39% of breaches spanning multi-cloud environments because of the more complicated security issues. The cost of these cloud breaches totaled $4.75 million, higher than the average cost of $4.45 million for all data breaches.The reason for this high cost is not only the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today