The cyber crime underground provides a robust marketplace for buying and selling different malware variants. Some of the major malware families, such as Zeus, Citadel, Ramnit, Spyeye and others, are well known financial malware. Lurking in the dark shadows of the Internet, some cyber criminal groups prefer to keep a low profile and not sell their tool of choice to the general underground public; Torpig, aka Sinowal, is one example of such a case. Trusteer’s security team has identified a new offering in a Russian cyber crime forum, a malware variant that, until now, has been working incognito: the i2Ninja malware.

i2Ninja Malware Unmasked

According to a post on the Russian cyber crime forum, i2Ninja offers a similar set of capabilities to those offered by other major financial malware: HTML injection and form-grabbing for all major browsers (Internet Explorer, Firefox and Chrome), a FTP grabber and a soon-to-be-released Virtual Network Connection (VNC) module. In addition, the malware also provides a PokerGrabber module, which targets major online poker sites, and an email grabber.

The i2Ninja takes its name from the malware’s use of I2P, a networking layer that uses cryptography to allow secure communication between its peer-to-peer users. While this concept is somewhat similar to TOR and TOR services, I2P was designed to maintain a true Darknet, an Internet within the Internet where secure and anonymous messaging and use of services can be maintained. The I2P network also offers HTTP proxies to allow anonymous Internet browsing.

Using the I2P network, i2Ninja can maintain secure communications between the infected devices and command and control server. Everything from delivering configuration updates to receiving stolen data and sending commands is done via the encrypted I2P channels. The i2Ninja malware also offers buyers a proxy for anonymous Internet browsing, promising complete online anonymity.

View on-demand webinar: Cybercriminals Never Sleep

Another feature of I2P used by i2Ninja is an integrated help desk via a ticketing system within the malware’s command and control. A potential buyer can communicate with the authors/support team, open tickets and get answers, all while enjoying the security and anonymity provided by I2P’s encrypted messaging. While some malware offerings have featured an interface with a support team in the past (Citadel and Neosploit, to name two), i2Ninja’s 24/7 secure help desk channel is a first.

Below is a translation from Russian of the original post introducing the capabilities of i2Ninja:

We would like to introduce a unique product to you, a bot by the name of i2Ninja, and tell about its various advantages. First and foremost is its use of the I2P network for botnet control, commands, updates, injection upgrade, removing and adding different modules. 1. Product Functionality: 24/7 I2PTicket system for supporting customers (communication with our support is done straight from the admin panel. All messages, are — naturally — encrypted) 2. Module Kit: Formgrabber (IE/FF/Chrome, all versions) HTTP/HTTPS injections (Stable in all IE/FF/Chrome browsers) I2P Proxy (Access the Web through I2P and it’s impossible to trace you. No other proxy server will give you such a level of security. No matter how secure proxy server operators will position themselves to be, your IP is still logged somewhere in the process!) FTPgrabber (33 clients) PokerGrabber (The most popular clients — 88poker, Absolute Poker, Cake Poker, Full Tilt Poker, Party Poker, PokerStars, Titan Poker) MailGrabber (16 services) Schedule DLL or EXE loading tasks. (This is scheduled through the control panel. LoadLibrary, regsvr32, run from memory without the need to encrypt.) FILESEARCH (Another built-in module that allows searching/removing files or, according to preferences, sending them to admin panel. It’s possible to task collection/removal of all files with a certain extension or an exact file name.) 3. Coming Soon: VNC (hidden session)

Malware for Sale

This post was actually copied from a different source and shared within this forum on a thread discussing P2P Trojans. The cyber criminal who originally made the offer commented on this thread and confirmed that this malware is indeed for sale at this time. As the thread progressed, that same cyber criminal requested that the thread be shut down since he received many requests to purchase the i2Ninja malware.

With increasing black market activity and the release of various malware source codes, we expect to see new malware variants and new underground offerings in 2014. i2Ninja has already been discussed in several Russian-language cyber crime forums, and IBM Security’s security team (formerly Trusteer) is actively monitoring for a live variant of this malware. Once such an attack is identified and researched, we will update with new technical details.

More from Banking & Finance

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

Why Cybersecurity Risk Assessment Matters in the Banking Industry

When customers put money in a bank, they need to trust it will stay there. Because of the high stakes involved for the customer, such as financial loss, and how long it takes to resolve fraud and potential identity theft, customers are sensitive to the security of the bank as well as fraud prevention measures. Banks that experience high volumes of fraud are likely to lose customers and revenue. The key is to protect customers and their accounts before problems…

Cost of a Data Breach: Banking and Finance

The importance of cybersecurity has touched almost every industry. Beyond that, robust cybersecurity is table stakes for several sectors, particularly health care and the banking and finance industry. Not only is financial data at risk, but so is customer trust. In banking and finance, trust means everything. Yet, consumers are hesitant to share their confidential data. A recent McKinsey survey revealed that no industry achieved a trust rating of 50% for data protection. Here’s the most sobering stat: 87% of…

What Do Financial Institutions Need to Know About the SEC’s Proposed Cybersecurity Rules?

On March 9, the U.S. Securities and Exchange Commission (SEC) announced a new set of proposed rules for cybersecurity risk management, strategy and incident disclosure for public companies. One intent of the rule changes is to provide “consistent, comparable and decision-useful” information to investors. Not yet adopted, these new rules – published in the Federal Register on March 23 – could change reporting requirements. Take a look at some of the big-ticket items and what your organization needs to know.…