Malicious server used to propagate Zbot shut down

Share this article:
A criminal operation has been halted by the shutdown of a malicious server in the Cayman Islands, but attackers are probably now looking for a new home, researchers at a U.K. security firm said this week.

Prevx researchers recently discovered a site where the trojan Zbot had uploaded the FTP login credentials from more than 68,000 websites, including companies such as Bank of America, BBC, and Symantec. Since then, more than 20,000 additional FTP credentials were stolen. In addition, the stolen credentials started being used to inject malicious scripts on those sites, Jacques Erasmus, director of research at Prevx, told on Wednesday. But the attacker's server, based in the Cayman Islands, was shut down on Tuesday.

Up until Friday, when visiting a compromised website, users were being infected (by means of a drive-by download) with Zbot, a trojan that captures keystrokes to obtains login credentials and credit card information, Erasmus said. Once a user was infected, the trojan harvested FTP credentials and sent them back to the attack server.

This Monday, however, a second component of the attack was activated -- the infected computers began “calling home,” or communicating with the attack server in the Cayman Islands, Erasmus said. When they began calling home, FTP credentials were pushed to the infected computers, with instructions to attempt logging on to sites associated with the credentials (that is, websites whose FTP credentials were stolen) and -- if successful -- to inject them with malicious scripts.

“Since Monday it started infecting a lot of websites, embedding script in the websites,” he said. “Anyone who visits one of these websites will also get infected.”

One infected machine attempted to inject malicious scripts into 85 different domains in a five-minute period, Erasmus said.

He said that because the controlling server in the Cayman Islands is currently “dead,” no additional websites are being injected with malicious scripts. What remains is a lot of compromised websites that are now further propagating the Zbot trojan. Erasmus said that the big-name websites whose FTP credentials were stolen have all been contacted and those companies canceled the accounts that were harvested. 

Though the attack server is currently down, it looks like those responsible for the threat are trying to move their operations to a different server, Erasmus said.

“Similar servers are popping up and we are trying to figure out if this is the same group,” Erasmus said.
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters


More in News

Information sharing requires breaking down barriers, White House cyber guru says

Information sharing requires breaking down barriers, White House ...

The White House has advanced an agenda to promote and facilitate information sharing on security threats and vulnerabilities.

Worm variant of Android ransomware, Koler, spreads via SMS

Worm variant of Android ransomware, Koler, spreads via ...

Upon infection, the Koler variant will send an SMS message to all contacts in the device's address book.

Patch for Windows flaw can be bypassed, prompts temporary fix from Microsoft

Patch for Windows flaw can be bypassed, prompts ...

The Windows zero-day received a patch last week, but the fix can still be bypassed by crafty attackers.