October 11, 2012 By Amit Klein 3 min read

RSA recently discovered a new malware variant it dubbed Prinimalka-Gozi, which reportedly will be used in a massive, coordinated attack on U.S. banks called Project Blitzkrieg. After analyzing Prinimalka-Gozi, IBM Security determined that it is a distant relative of the Gozi malware. According to our findings, the installation and HTML injection designation method it uses resembles Gozi. However, many implementation details such as the format of the HTML injection, certain configuration elements and the machine code injected into the browser process appear to be completely different than those of Gozi.

According to the RSA report regarding the planned Trojan attack campaign, criminals will first steal victims’ online banking credentials and account balances and then clone their computers using a novel virtual-machine-syncing module. Later, botmasters will prioritize their targets according to account balances. Last, a session will be initiated from the cloned remote computer and proxied through the victim’s machine to take on the genuine (victim) IP address when authenticating to the online banking site.

Krebs on Security posted a detailed article on this cyber criminal campaign, named Project Blitzkrieg by its alleged mastermind, “vorVzakon.” The article provides the following quote from a blog post by VorVzakon: “The goal — together, en-masse and simultaneously process large amounts of the given material before anti-fraud measures are increased.”

Why Existing Anti-Fraud Measures Fail to Prevent Project Blitzkrieg

Back in 2005, the Federal Financial Institutions Examination Council mandated that banks enhance their security controls beyond the static username and password authentication scheme for online banking login in its “Authentication in an Internet Banking Environment” guidance. However, many U.S. banks still use static credentials. High operational costs and poor user experience have deterred many U.S. banks from implementing strong authentication. Instead, banks have deployed other server-based anti-fraud measures, such as device fingerprinting.

The new device-cloning feature included in Prinimalka-Gozi (i.e., virtual-machine-syncing module) is specifically designed to aid in evading device-fingerprinting fraud prevention solutions. This feature allows fraudsters to create a cloned computer with settings identical to those of the victim’s device — including the same device fingerprint. Fraudsters can also route or proxy all Web communication from the cloned computer through the victim’s device by using the victim’s IP address. The net effect is that both the device and IP address seem to belong to the genuine user (victim).

Some device-fingerprinting solutions have added features that can alert the bank when a proxy is being used. However, since proxies are also used for legitimate purposes (e.g., in enterprises and public networks), this feature alone will generate many false alarms.

Furthermore, the attack tactics used by Prinimalka-Gozi may change over time. Once the criminals have an end user’s genuine login credentials, they do not necessarily have to proxy all communication through the victim’s device. Fraudulent transactions can be submitted from a cloned device on a new IP or a new device. Since many users switch computers and access online banking while traveling, device-fingerprinting solutions cannot prevent the submission of all transactions from a new device or location.

Protecting Against Project Blitzkrieg

Unlike device fingerprinting and other clientless fraud prevention mechanisms, IBM Security takes a different approach with a clientless solution that combines device fingerprinting, proxy detection and malware infection detection. When a user infected with malware accesses an online banking site protected by IBM Security Trusteer Pinpoint Malware Detection, it identifies the infection and malware type (e.g., “User Steve is infected with Prinimalka-Gozi”), alerts the bank and flags the user’s credentials as compromised.

Once notified, banks can immediately contact the end users to have them install IBM Security Trusteer Rapport, which will remove the malware. IBM Security Trusteer Pinpoint Criminal Detection also fingerprints the device and checks for the use of proxies. Users accessing the online banking application from a new device — or a proxied device — shortly after malware was detected on their endpoint is a strong indication of account takeover fraud.

For end users who have already installed Trusteer Rapport, we have validated that Trusteer Rapport protects against the Prinimalka-Gozi malware by removing it from infected machines and preventing data theft, such as form grabbing and HTML injection. For endpoints that do not have Trusteer Rapport installed, we have validated that Trusteer Pinpoint identified machines infected with Prinimalka-Gozi.

More from Malware

Ongoing ITG05 operations leverage evolving malware arsenal in global campaigns

13 min read - Summary As of March 2024, X-Force is tracking multiple ongoing ITG05 phishing campaigns featuring lure documents crafted to imitate authentic documents of government and non-governmental organizations (NGOs) in Europe, the South Caucasus, Central Asia, and North and South America. The uncovered lures include a mixture of internal and publicly available documents, as well as possible actor-generated documents associated with finance, critical infrastructure, executive engagements, cyber security, maritime security, healthcare, business, and defense industrial production. Beginning in November 2023, X-Force observed…

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

12 min read - For the last year and a half, IBM X-Force has actively monitored the evolution of Hive0051’s malware capabilities. This Russian threat actor has accelerated its development efforts to support expanding operations since the onset of the Ukraine conflict. Recent analysis identified three key changes to capabilities: an improved multi-channel approach to DNS fluxing, obfuscated multi-stage scripts, and the use of fileless PowerShell variants of the Gamma malware. As of October 2023, IBM X-Force has also observed a significant increase in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today