Less than a month after Security Intelligence announced the discovery of the brand-new and highly advanced banking Trojan Shifu, our predictions materialized and the malware has spread from Japan and begun actively attacking U.K. banks and wealth management firms.

Shifu, which is suspected to have been created by Russian-speaking malware authors, only targeted 14 Japanese banks at the time of its discovery and also focused on a select set of electronic banking platforms used across Europe. However, due to the threat’s level of sophistication, IBM Security X-Force researchers predicted it would spread into new territories in the near future. As of Sept. 22, that prediction is a reality, with the U.K. receiving its very own Shifu configuration with 18 new targets.

Read the white paper: Accelerating growth and digital adoption with seamless identity trust

Shifu Moves to the UK

X-Force researchers confirmed that Shifu is actively attacking online banking customers in order to perform fraudulent transactions.

The Shifu Trojan may be new crimeware, but its inner workings are not entirely unfamiliar. The malware relies on a few tried-and-true Trojan mechanisms from other infamous crimeware codes. It appears that Shifu’s internal makeup is being composed by savvy developers who are intimately familiar with other types of banking malware.

Beyond dressing Shifu with select features from the more nefarious codes known to information security professionals, these developers are already working on internal changes to Shifu. These are designed to ensure the Trojan’s security evasion mechanisms continue to perform.

For example, in its new, U.K.-dedicated samples, Shifu no longer injects into the explorer.exe process. Rather, it has modified its action path to launch a new svchost instance and performs all actions from that process instead.

Infection Campaign Status

Shifu began spreading to U.K.-based endpoints in mid-September 2015, with a few machine infections per day. By Sept. 22, it became clear that an actual infection campaign was taking place and hundreds of endpoints were infected per day.

Although one relatively modest campaign has already taken place, IBM X-Force researchers believe more widespread infection sprees are yet to come in the U.K. This is likely to be followed with future propagation into other parts of Europe and the U.S.

To infect users, online banking and wealth management customers are being led to poisoned websites hosting the Angler exploit kit (EK), likely through links in email spam.

The Shifu crew uses the Angler EK, a commercially available kit sold in the cybercrime underground. This kit emerged in 2013, quickly gaining momentum as an alternative to the infamous BlackHole EK, whose vendors were arrested that year. Angler is rather diverse and effective since it exploits a variety of different code vulnerabilities, including HTML, Java, JavaScript, Adobe Flash and Silverlight, to name a few.

Although Angler is used by many cybercriminals, they all rely on its ability to evade security mechanisms and its multistep attack technique. To keep automated security off its tracks, Angler attacks are based on a redirection scheme that begins with a clean page or advertising banner and eventually lands on an Angler-poisoned page. The victim’s endpoint is then scanned for the corresponding vulnerabilities, followed by exploitation and the eventual payload drop.

As more information about the evolution of the Shifu Trojan develops, be sure to check back for updated findings and reports.

Read the white paper: Accelerating growth and digital adoption with seamless identity trust

More from Malware

RansomExx Upgrades to Rust

IBM Security X-Force Threat Researchers have discovered a new variant of the RansomExx ransomware that has been rewritten in the Rust programming language, joining a growing trend of ransomware developers switching to the language. Malware written in Rust often benefits from lower AV detection rates (compared to those written in more common languages) and this may have been the primary reason to use the language. For example, the sample analyzed in this report was not detected as malicious in the…

Raspberry Robin and Dridex: Two Birds of a Feather

IBM Security Managed Detection and Response (MDR) observations coupled with IBM Security X-Force malware research sheds additional light on the mysterious objectives of the operators behind the Raspberry Robin worm. Based on a comparative analysis between a downloaded Raspberry Robin DLL and a Dridex malware loader, the results show that they are similar in structure and functionality. Thus, IBM Security research draws another link between the Raspberry Robin infections and the Russia-based cybercriminal group 'Evil Corp,' which is the same…

The Ransomware Playbook Mistakes That Can Cost You Millions

If there is one type of cyberattack that can drain the color from any security leader’s face, it’s ransomware. A crippling, disruptive, and expensive attack to recover from, with final costs rarely being easy to foretell. Already a prevalent threat, the number of ransomware attacks rose during the pandemic and nearly doubled in the year between 2020 and 2021, continuing to rise since. Focusing on the extortion price of these attacks, the cost of a ransomware attack can appear finite…

From Ramnit To Bumblebee (via NeverQuest): Similarities and Code Overlap Shed Light On Relationships Between Malware Developers

A comparative analysis performed by IBM Security X-Force uncovered evidence that suggests Bumblebee malware, which first appeared in the wild last year, was likely developed directly from source code associated with the Ramnit banking trojan. This newly discovered connection is particularly interesting as campaign activity has so far linked Bumblebee to affiliates of the threat group ITG23 (aka the Trickbot/Conti group), who are not known to have had a previous connection with Ramnit. This year has so far proven tumultuous…