Two recent discoveries by IBM Security X-Force researchers indicate that the U.K. is seeing an increased wave of banking Trojan attacks from two families linked with the Zeus Trojan: Sphinx and Kronos.

In the former case, X-Force researchers are the first to confirm that, beyond observing cybercriminals selling a new Zeus variant dubbed Sphinx on dark web forums, this malware actually exists and is actively attacking banks in the wild.

Sphinx is commercial malware sold to anyone willing to pay for it, which means its targets can vary. The most current identified configuration is targeting several major U.K. banks and one Polish bank. X-Force’s analysis of Sphinx shows it is, for the most part, a replica of Zeus v2 variants.

The second case has to do with the Kronos Trojan. Kronos is a known banking malware threat that emerged in mid-2014. Surprisingly, this malware has gone silent for the past few months and has just reemerged, showing no technical advancements but a change in turf that focuses on U.K. banks and one bank in India.

The U.K. is, and has been for many years, a preferred target for cybercrime because of its prosperous economy and strong adoption of internet-based services for banking and payments. While the U.K. is already the most targeted area for banking Trojan malware configurations (per IBM Trusteer data), the past few months have shown more activity than usual. Banking Trojans such as Shifu, Zeus Sphinx and Kronos are configured to launch into action upon access to consumer, corporate and even wealth management accounts.

This post brings more information about Zeus Sphinx and Kronos, both of which are current threats trending in the global cybercrime arena.

Learn more about Staying ahead of threats with global threat intelligence

Zeus Sphinx — It’s Real

Zeus Sphinx is crimeware that emerged in underground fraud forums in late August 2015, offered for sale by a Russian-speaking vendor for $500 per binary — without a malware builder. This means that Sphinx’s vendor is not enabling fraudsters to independently generate new malware files. Instead, they would have to buy a new variant generated by the vendor every time their current version is detected as malicious by signature-based security solutions.

In a post selling Sphinx to other cybercriminals, its vendor indicated the malware communicates via the anonymizing Tor network, making it harder to sinkhole, avoiding IP address-based blacklisting and evading ZeusTrackers.

Sphinx’s General M.O.

Zeus Sphinx is used for the theft of online banking authentication elements such as user credentials, cookies and certificates. These elements are subsequently used by fraudsters in illicit online transactions typically performed from the user’s own device. Connection to the endpoint is facilitated via backconnect hidden virtual network computing (VNC), which means the infected endpoint will initiate a remote access connection to the criminal’s endpoint. This feature allows the attacker to gain user-grade access to the device even through firewall protection.

In most cases, Sphinx is configured to only harvest username and password combinations from the victim, both in a generic manner and when triggered by the websites users visit. The fraudsters that use this minimal configuration to test attack possibilities may be using the basic authentication or simply selling the harvested data to other criminals.

In some cases, Sphinx was specifically configured to further deploy webinjections with social engineering content designed to lure victims into divulging two-factor authentication (2FA) codes generated by a card reader.

Sphinx-enabled fraudulent transactions typically originate from the victim’s endpoint via VNC connection; this tactic is used to bypass fingerprint-based security features.

Sphinx’s Current Targets

While this Trojan can be sold to anyone — and thus configuration file contents can differ from one another — current variants of Sphinx target banks in the U.K. and Poland, as well as a popular online payments system.

Figure 1: The Zeus Sphinx Trojan’s current targets worldwide.

Technical Details

Additional details from the vendor’s post advertising Zeus Sphinx (originally in Russian) claim it has the following malware features:

  • Form grabber and webinjects for the latest Internet Explorer (IE) and Mozilla versions using the standard Zeus webinjection mechanism;
  • Firefox and Tor browser with cookie grabber and transparent page redirect (webfakes);
  • VNC module that can backconnect to the attacker;
  • SOCKS 4/4a/5 Proxy with UDP and IPv6 support;
  • FTP, POP3 grabber;
  • Certificate grabber;
  • Keylogger.

The vendor’s post was simultaneously found in the underground by a few intelligence analysts, including IBM Security X-Force researchers, but at that time, no security vendor was able to confirm that Zeus Sphinx was real or active in the wild.

This has now officially changed. By mid-September 2015, X-Force researchers found an actual Sphinx sample in the wild and confirmed that Zeus Sphinx not only exists, but is actively attacking online banking customers.

Analysis of the Sphinx variant shows that the malware indeed features the same installation flow as typical Zeus v2 variants, writing itself to the Application Data folder and establishing persistence via Windows\Currentversion\Run. The configuration file is stored in the Windows Registry using randomized file names.

Sphinx captures GET/POST requests by hooking the ntdll!NtDeviceIoControlFile process. Unlike Zeus, this method resembles the Gootkit Trojan’s method of grabbing user credentials on the fly. Sphinx also sports the Zeus PHP botnet classic control panel interface.

When browsing their bank’s website, Sphinx’s webfakes redirection scheme seamlessly sends victims to a phishing page without seeing the URL change. Each client-side bot is designed to deploy with the minimal user privilege level; each user on the same endpoint can be attributed a different bot ID.

The author of the Sphinx variation has made sure to protect botnet communications with a unique encryption key. Traffic is encrypted with a self-signed SSL certificate in the same manner used by malware such as Dyre and Shifu.

Kronos Is Back

Right around the same time that Sphinx materialized and Shifu set its sights on the U.K., the Kronos banking Trojan returned from a hiatus, switching its configuration triggers to a list that distinctly focuses on U.K. banks.

In a rather unusual occurrence, Kronos went silent for the past few months, shutting down the command-and-control servers that communicated with its infected botnets. As of September 2015, this has changed. Someone on the Kronos server side has flipped the lights back on, reconnecting with infected bots and sending them a brand new configuration file — only this time, it is attacking U.K. banks as well as one bank in India.

Stay ahead of threats with global threat intelligence and automated protection

About Kronos

Kronos, banking malware named after the father of Zeus, emerged on underground cybercrime boards in mid-2014, when it was offered for sale by a Russian-speaking vendor to the cybercrime community for a whopping $7,000 USD.

At first, there was no actual proof that the malware was indeed active in the wild, but by July 2014 it was clear that Kronos was primarily attacking banks in France.

Kronos samples analyzed by X-Force researchers in 2014 confirmed that the malware was a user-mode rootkit that could hook popular browsers, featuring the typical Trojan mechanisms designed to facilitate online banking fraud. Some of those features are:

  • Encrypted configuration file with URL targets and webinjections;
  • Form grabbing to steal user credentials on the fly;
  • A Zeus-compatible webinjection mechanism;
  • A VNC module to remotely control infected endpoints;
  • Hefty anti-research and anti-AV features.

New post-hiatus Kronos samples seem to operate in the exact same manner as they did before, indicating that the malware was not retired for development purposes. This is rather logical since Kronos is a commercial offering; it is therefore possible that its current operators are not actual developers who regularly make changes to their code to keep it stealthy over time.

For Kronos, the only behavioral change observed by X-Force is an unexpected crash of the Chrome browser on machines infected with the malware. This issue can stem from a difficulty Kronos may have with injecting into Chrome, making it crash accidentally — or it could be deliberate in order to force infected users to browse via IE or Firefox, where all its webinjections work properly.

Kronos’ Change of Turf

On top of changing its target list to focus on the U.K., Kronos’ new configuration includes more strategic updates, including elaborate webinjection schemes for some of the banks it targets. In new phishing-type injections, Kronos displays completely new web pages to its victims, aiming to harvest their online banking credentials, telephone banking passwords and credit card information. At this time, Kronos is after personal banking accounts, likely spreading via email spam.

Fighting Evolving Threats

Fighting emerging threats like the Zeus Sphinx Trojan or evolving threats like Kronos is easy with malware detection solutions. With protection layers adapted to the ever-changing threat landscape, financial organizations can gain access to a malware intelligence network that provides real-time insight into fraudster techniques and capabilities.

More from Malware

New Hive0117 phishing campaign imitates conscription summons to deliver DarkWatchman malware

8 min read - IBM X-Force uncovered a new phishing campaign likely conducted by Hive0117 delivering the fileless malware DarkWatchman, directed at individuals associated with major energy, finance, transport, and software security industries based in Russia, Kazakhstan, Latvia, and Estonia. DarkWatchman malware is capable of keylogging, collecting system information, and deploying secondary payloads. Imitating official correspondence from the Russian government in phishing emails aligns with previous Hive0117 campaigns delivering DarkWatchman malware, and shows a possible significant effort to induce a sense of urgency as…

ITG10 likely targeting South Korean entities of interest to the Democratic People’s Republic of Korea (DPRK)

7 min read - In late April 2023, IBM Security X-Force uncovered documents that are most likely part of a phishing campaign mimicking credible senders, orchestrated by a group X-Force refers to as ITG10, and aimed at delivering RokRAT malware, similar to what has been observed by others. ITG10's tactics, techniques and procedures (TTPs) overlap with APT37 and ScarCruft. The initial delivery method is conducted via a LNK file, which drops two Windows shortcut files containing obfuscated PowerShell scripts in charge of downloading a…

Ransomware renaissance 2023: The definitive guide to stay safer

2 min read - Ransomware is experiencing a renaissance in 2023, with some cybersecurity firms reporting over 400 attacks in the month of March alone. And it shouldn’t be a surprise: the 2023 X-Force Threat Intelligence Index found backdoor deployments — malware providing remote access — as the top attacker action in 2022, and aptly predicted 2022’s backdoor failures would become 2023’s ransomware crisis. Compounding the problem is the industrialization of the cybercrime ecosystem, enabling adversaries to complete more attacks, faster. Over the last…

BlackCat (ALPHV) ransomware levels up for stealth, speed and exfiltration

9 min read - This blog was made possible through contributions from Kat Metrick, Kevin Henson, Agnes Ramos-Beauchamp, Thanassis Diogos, Diego Matos Martins and Joseph Spero. BlackCat ransomware, which was among the top ransomware families observed by IBM Security X-Force in 2022, according to the 2023 X-Force Threat Intelligence Index, continues to wreak havoc across organizations globally this year. BlackCat (a.k.a. ALPHV) ransomware affiliates' more recent attacks include targeting organizations in the healthcare, government, education, manufacturing and hospitality sectors. Reportedly, several of these incidents resulted…