According to IBM X-Force data on the activity of financial malware operated by organized cybercrime groups, the Ursnif (aka Gozi) banking Trojan was the most active malware code in the financial sector in 2016 and has maintained its dominance through 2017 to date.

Ursnif’s activity is marked by both frequent code modifications and campaign activity in North America, Europe and Australia. But one of its most popular targets in 2017 has been Japanese banks, where Ursnif’s operators were very active in late Q3 2017, starting in September. The threat actors continue to spam users in the region regularly as we move into Q4.

Read the white paper: How digital banking is transforming fraud detection

Ursnif’s Focus on Japanese Targets

In terms of targets, Ursnif malware configurations can be a mixed bag at times, but those targeting Japan are specific to banks and payment card providers in the country. That list of targets remained unchanged through the different campaigns, suggesting that the same actors are likely behind it.

In addition to banks, the active Ursnif variant in Japan also targets user credentials for local webmail, cloud storage, cryptocurrency exchange platforms and e-commerce sites.

In terms of the attack tactics employed against Japanese users, X-Force analysis points to data grabbing from secure sessions, webinjection attacks and, in some cases, page redirections. Previous tactics, such as video grabbing, are not presently featured, which could suggest that the actors are local or quite familiar with the banking systems in Japan.

The delivery method of Ursnif payloads in Japan has been rather consistent throughout the campaigns observed this summer, featuring fake attachments purporting to come from financial services and payment card providers in Japan.

Figure 1: Email with malicious attachment carrying Ursnif payload (Source: IBM X-Force)

In other malspam versions, users receive an HTML link that leads to an archive (.zip) file containing JavaScript, which launches a PowerShell script that fetches the payload from a remote server and infects the user with Ursnif. The payload appears to be served from web resources the attackers registered to serve the malicious code, not from hijacked domains.

Figure 2: Email with malicious link leading to Ursnif payload (Source: IBM X-Force)

Recent Ursnif malspam campaigns used a macro evasion technique that launches PowerShell only after the user closes the malicious file. This method helps the malware evade sandbox detection.

X-Force data revealed that campaign email spikes take place in cyclical weekly rounds, usually peaking on Tuesday evenings. Attempted infections peak on Thursdays and Fridays and are relatively low during the weekend and early weekdays.

Ursnif’s operators do not exclusively use malspam. In other regions where they target banks, such as the U.K., they work with the RIG exploit kit to infect users via malvertising campaigns.

Why Japan?

Why do organized crime groups spread to new geographies? In most cases of malware migration, cybercriminal groups with adequate resources are looking for easier money, less security and an element of surprise for users who are less accustomed to their spam ploys and social engineering during the banking session.

The history of organized cybercrime in Japan is not very long. The past five years featured more generic malware and local attackers using proxy changers more than anything else. The situation took a turn for the worse in the summer of 2015, when the Shifu Trojan emerged and made Japan one of its top targets.

Shifu’s activity in Japan died out slowly and eventually faded in 2017, but it was one of the pivotal organized cybercrime groups that opened the floodgates to other cybercrime actors such as URLZone, Rovnix and a step-up in Ursnif attacks. Shifu did that by setting up the spamming and social engineering foundations for other malware that came after it, often copying its tools and likely collaborating with the same local groups.

So why have other organized groups such as Dridex and TrickBot, both of which target banks in as many as 40 countries, largely stayed away from Japan? The answer could lie in the connections other gangs have with local cybercrime and money-laundering groups. Even on the internet, gangs often stick to their own turf.

About Ursnif

When Ursnif was discovered in 2007, it was operated by an exclusive group of threat actors to perpetrate online banking wire fraud in English-speaking countries. In 2010, one of the developers working on an upgrade to Ursnif v2 accidentally leaked the code, which was repurposed by other fraudsters to create banking Trojans such as Vawtrak and Neverquest.

Toward the end of 2010, the original Ursnif v2 began using webinjection techniques against banks in Europe, the U.K. and the U.S. The malware operators added a master boot record (MBR) rootkit in mid-2013 to create high persistency through the computer’s MBR.

Ursnif v2’s online fraud capabilities are enabled through:

  • Script-based browser manipulation;
  • Webinjections and man-in-the-browser (MitB) functionality;
  • Form grabbing;
  • Screen capture and session video grabbing; and
  • Hidden VNC and SOCKS proxy attacks.

Ursnif v2 leverages the hVNC feature, which can essentially be activated at the attacker’s discretion. X-Force researchers analyzed Ursnif’s VNC module to uncover its architecture and inner workings.

Another known Ursnif module is the use of Tor to route the malware’s communications through an anonymized service. In one notable case, Ursnif was linked with another banking Trojan when its fraud module was built into the GozNym hybrid, which IBM X-Force Research discovered in April 2016.

GozNym’s code is made of the Nymaim malware embedded with the Gozi financial fraud module, effectively creating a two-headed beast that was believed to be operated by an organized cybergang. The arrest of one of its members led to GozNym’s demise in late 2016.

Global Perspective

The following chart lists the most prolific banking malware families in 2017 per attack volume.

Figure 3: Most prevalent financial malware families (Source: X-Force, October 2017 YTD)

After the decline of Neverquest activity in 2017, Ursnif climbed up to the third, then second rank globally. Ursnif’s prevalence is also connected with its widening geographical scope. In 2017, for example, the malware presented configurations targeting banks in Bulgaria, Poland, Spain and the Czech Republic, in addition to its targets in North America, Australia and Japan.

In terms of its development cycles, Ursnif was the most active malware project in 2016, topping other banking Trojans with the largest number of updates made to its loader and binary to evade security research and detection. It has kept its position so far in 2017.

IBM X-Force noted that Ursnif has been one of the most active banking Trojans in Japan over the past five years. Our researchers have also been tracking a third version of Ursnif targeting banks in Australia. Stay tuned for upcoming information.

Read the white paper: How digital banking is transforming fraud detection

More from Malware

New Hive0117 phishing campaign imitates conscription summons to deliver DarkWatchman malware

8 min read - IBM X-Force uncovered a new phishing campaign likely conducted by Hive0117 delivering the fileless malware DarkWatchman, directed at individuals associated with major energy, finance, transport, and software security industries based in Russia, Kazakhstan, Latvia, and Estonia. DarkWatchman malware is capable of keylogging, collecting system information, and deploying secondary payloads. Imitating official correspondence from the Russian government in phishing emails aligns with previous Hive0117 campaigns delivering DarkWatchman malware, and shows a possible significant effort to induce a sense of urgency as…

ITG10 likely targeting South Korean entities of interest to the Democratic People’s Republic of Korea (DPRK)

7 min read - In late April 2023, IBM Security X-Force uncovered documents that are most likely part of a phishing campaign mimicking credible senders, orchestrated by a group X-Force refers to as ITG10, and aimed at delivering RokRAT malware, similar to what has been observed by others. ITG10's tactics, techniques and procedures (TTPs) overlap with APT37 and ScarCruft. The initial delivery method is conducted via a LNK file, which drops two Windows shortcut files containing obfuscated PowerShell scripts in charge of downloading a…

Ransomware renaissance 2023: The definitive guide to stay safer

2 min read - Ransomware is experiencing a renaissance in 2023, with some cybersecurity firms reporting over 400 attacks in the month of March alone. And it shouldn’t be a surprise: the 2023 X-Force Threat Intelligence Index found backdoor deployments — malware providing remote access — as the top attacker action in 2022, and aptly predicted 2022’s backdoor failures would become 2023’s ransomware crisis. Compounding the problem is the industrialization of the cybercrime ecosystem, enabling adversaries to complete more attacks, faster. Over the last…

BlackCat (ALPHV) ransomware levels up for stealth, speed and exfiltration

9 min read - This blog was made possible through contributions from Kat Metrick, Kevin Henson, Agnes Ramos-Beauchamp, Thanassis Diogos, Diego Matos Martins and Joseph Spero. BlackCat ransomware, which was among the top ransomware families observed by IBM Security X-Force in 2022, according to the 2023 X-Force Threat Intelligence Index, continues to wreak havoc across organizations globally this year. BlackCat (a.k.a. ALPHV) ransomware affiliates' more recent attacks include targeting organizations in the healthcare, government, education, manufacturing and hospitality sectors. Reportedly, several of these incidents resulted…