New Citadel trojan costs more, but allows for easier updates

Share this article:

Code writers behind the latest Citadel trojan, dubbed the "Rain Edition," have added advanced features and significantly boosted the price tag of the malware.

The new iteration includes a feature, called "Dynamic Config," which allows botmasters easier access to compromised victims' machines by updating the malware's configuration file immediately. Configuration files are used by owners of command-and-control servers to communicate malicious instructions to hacked PCs under their control.

The first version of Citadel, a variant of banking trojan Zeus, entered the black market in January at cost of $2,399, but now commands a fee that is 41 percent higher – $3,391 for the latest, or sixth, Citadel release.  

Limor Kessem, technical lead and fraud expert at RSA, told on Thrusday that the “dynamic config” feature exemplifies just how advanced Citadel programmers are. RSA published a blog post Thursday divulging the details of the latest software released by the malware's authors.

“They are able to implement changes that come directly from the command-and-control server in real time,” Kessem said of the newest feature. “They are cutting out time and the need [for developers] to change the whole configuration file. They can correspond immediately with a victim who is sitting in front of a screen. It's really a breakthrough. We've never seen them do that.”

Citadel, along with other banking trojans, usually infects users through spam or drive-by download campaigns launched by saboteurs. Banking malware often aims to steal account login credentials to transfer money to attackers, either in the background or by hijacking victims' computers.

Page 1 of 2
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters


More in News

Email promises free pizza, ensnares victims in Asprox botnet instead

Email promises free pizza, ensnares victims in Asprox ...

Cloudmark came upon an email that offers free pizza, but clicking on the link to get the coupon ends with victims being ensnared in a botnet.

Report: most orgs lacking in response team, policies to address cyber incidents

In its Q3 threat intelligence report, Solutionary learned that 75 percent of organizations it assisted had no response team or policies and procedures to address cyber incidents.

Flash redirect campaign impacts Carnegie Mellon page, leads to Angler EK

Flash redirect campaign impacts Carnegie Mellon page, leads ...

Malwarebytes found that, since early July, thousands of sites had been targeted in the campaign.