RSA recently discovered a new malware variant it dubbed Prinimalka-Gozi, which reportedly will be used in a massive, coordinated attack on U.S. banks called Project Blitzkrieg. After analyzing Prinimalka-Gozi, IBM Security determined that it is a distant relative of the Gozi malware. According to our findings, the installation and HTML injection designation method it uses resembles Gozi. However, many implementation details such as the format of the HTML injection, certain configuration elements and the machine code injected into the browser process appear to be completely different than those of Gozi.

According to the RSA report regarding the planned Trojan attack campaign, criminals will first steal victims’ online banking credentials and account balances and then clone their computers using a novel virtual-machine-syncing module. Later, botmasters will prioritize their targets according to account balances. Last, a session will be initiated from the cloned remote computer and proxied through the victim’s machine to take on the genuine (victim) IP address when authenticating to the online banking site.

Krebs on Security posted a detailed article on this cyber criminal campaign, named Project Blitzkrieg by its alleged mastermind, “vorVzakon.” The article provides the following quote from a blog post by VorVzakon: “The goal — together, en-masse and simultaneously process large amounts of the given material before anti-fraud measures are increased.”

Why Existing Anti-Fraud Measures Fail to Prevent Project Blitzkrieg

Back in 2005, the Federal Financial Institutions Examination Council mandated that banks enhance their security controls beyond the static username and password authentication scheme for online banking login in its “Authentication in an Internet Banking Environment” guidance. However, many U.S. banks still use static credentials. High operational costs and poor user experience have deterred many U.S. banks from implementing strong authentication. Instead, banks have deployed other server-based anti-fraud measures, such as device fingerprinting.

The new device-cloning feature included in Prinimalka-Gozi (i.e., virtual-machine-syncing module) is specifically designed to aid in evading device-fingerprinting fraud prevention solutions. This feature allows fraudsters to create a cloned computer with settings identical to those of the victim’s device — including the same device fingerprint. Fraudsters can also route or proxy all Web communication from the cloned computer through the victim’s device by using the victim’s IP address. The net effect is that both the device and IP address seem to belong to the genuine user (victim).

Some device-fingerprinting solutions have added features that can alert the bank when a proxy is being used. However, since proxies are also used for legitimate purposes (e.g., in enterprises and public networks), this feature alone will generate many false alarms.

Furthermore, the attack tactics used by Prinimalka-Gozi may change over time. Once the criminals have an end user’s genuine login credentials, they do not necessarily have to proxy all communication through the victim’s device. Fraudulent transactions can be submitted from a cloned device on a new IP or a new device. Since many users switch computers and access online banking while traveling, device-fingerprinting solutions cannot prevent the submission of all transactions from a new device or location.

Protecting Against Project Blitzkrieg

Unlike device fingerprinting and other clientless fraud prevention mechanisms, IBM Security takes a different approach with a clientless solution that combines device fingerprinting, proxy detection and malware infection detection. When a user infected with malware accesses an online banking site protected by IBM Security Trusteer Pinpoint Malware Detection, it identifies the infection and malware type (e.g., “User Steve is infected with Prinimalka-Gozi”), alerts the bank and flags the user’s credentials as compromised.

Once notified, banks can immediately contact the end users to have them install IBM Security Trusteer Rapport, which will remove the malware. IBM Security Trusteer Pinpoint Criminal Detection also fingerprints the device and checks for the use of proxies. Users accessing the online banking application from a new device — or a proxied device — shortly after malware was detected on their endpoint is a strong indication of account takeover fraud.

For end users who have already installed Trusteer Rapport, we have validated that Trusteer Rapport protects against the Prinimalka-Gozi malware by removing it from infected machines and preventing data theft, such as form grabbing and HTML injection. For endpoints that do not have Trusteer Rapport installed, we have validated that Trusteer Pinpoint identified machines infected with Prinimalka-Gozi.

More from Malware

Ransomware Renaissance 2023: The Definitive Guide to Stay Safer

2 min read - Ransomware is experiencing a renaissance in 2023, with some cybersecurity firms reporting over 400 attacks in the month of March alone. And it shouldn’t be a surprise: the 2023 X-Force Threat Intelligence Index found backdoor deployments — malware providing remote access — as the top attacker action in 2022, and aptly predicted 2022’s backdoor failures would become 2023’s ransomware crisis. Compounding the problem is the industrialization of the cybercrime ecosystem, enabling adversaries to complete more attacks, faster. Over the last…

2 min read

BlackCat (ALPHV) Ransomware Levels Up for Stealth, Speed and Exfiltration

9 min read - This blog was made possible through contributions from Kat Metrick, Kevin Henson, Agnes Ramos-Beauchamp, Thanassis Diogos, Diego Matos Martins and Joseph Spero. BlackCat ransomware, which was among the top ransomware families observed by IBM Security X-Force in 2022, according to the 2023 X-Force Threat Intelligence Index, continues to wreak havoc across organizations globally this year. BlackCat (a.k.a. ALPHV) ransomware affiliates' more recent attacks include targeting organizations in the healthcare, government, education, manufacturing and hospitality sectors. Reportedly, several of these incidents resulted…

9 min read

Ex-Conti and FIN7 Actors Collaborate with New Backdoor

15 min read -   April 27, 2023 Update This article is being republished with modifications from the original that was published on April 14, 2023, to change the name of the family of malware from Domino to Minodo. This is being done to avoid any possible confusion with the HCL Domino brand. The family of malware that is described in this article is unrelated to, does not impact, nor uses HCL Domino or any of its components in any way. The malware is…

15 min read

When the Absence of Noise Becomes Signal: Defensive Considerations for Lazarus FudModule

7 min read - In February 2023, X-Force posted a blog entitled “Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers” that details the capabilities of a sample attributed to the Lazarus group leveraged to impair visibility of the malware’s operations. This blog will not rehash analysis of the Lazarus malware sample or Event Tracing for Windows (ETW) as that has been previously covered in the X-Force blog post. This blog will focus on highlighting the opportunities for detection of the FudModule within the…

7 min read