Security experts at ESET have recently observed a surge in activity of DanaBot banking Trojan that was first spotted earlier this year.
DanaBot is a multi-stage modular banking Trojan written in Delphi, the malware allows operators to add new functionalities by adding new plug-ins.
Below some plug-ins that have been used in previous attacks against Australian banks in May 2018:
When it was analyzed by Proofpoint, its experts speculated the threat has been under active development.
The banking Trojan initially targeted Australia and Poland users, then it has expanded in other countries, including Italy, Germany, Austria, and as of September 2018, Ukraine.
The campaign targeting Poland is still ongoing and is the largest one, attackers used spam messages to compromise victims leveraging the Brishloader technique, a combination of PowerShell and VBS scripts.
Earlier September, a series of smaller campaigns targeted banks in Italy, Germany, and Austria.
“Further to this development, on September 8, 2018, ESET discovered a new DanaBot campaign targeting Ukrainian users.” reads the analysis published by ESET.
“Figure 2 shows a spike in the DanaBot detection rate at the turn of August and again in September 2018, as seen in our telemetry data.”
Expert noticed the attackers have introduced several changes to the DanaBot plug-ins since the previously reported campaigns, for example, the Stealer plug-in was also compiled for 64-bit version since August 25, 2018.
Since the beginning of September 2018, the author of DanaBot also implemented the RDP plug-in based on the open-source project RDPWrap that provides Remote Desktop Protocol connections to Windows machines that normally do not support it.
The malware also implemented the RDP plug-in because the protocol is less likely to be blocked by firewalls, experts also highlighted that the RDPWrap allows several users to use the same machine concurrently. This aspect is very important because the attackers can perform reconnaissance operations while the victim is still using the machine.
DanaBot is a very active threat, its operators continue to improve it while targeting European countries.
“The new features introduced in these latest campaigns indicate the attackers behind DanaBot continue to make use of the malware’s modular architecture to increase their reach and success rate.” concludes ESET.
Further details, including IoCs are reported in the analysis published by ESET.
(Security Affairs – DanaBot, hacking)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.