New Ramnit variant steals Facebook logins

Share this article:

The ever-evolving Ramnit worm is back, and this time it has gone after Facebook users, harvesting more than 45,000 login credentials worldwide, primarily from users in the U.K. and France, according to a blog post from Seculert Research Lab, which discovered a command-and-control (C&C) server holding the pilfered data.

Researchers found that the C&C server contained an open directory called "Facebook," with a text file called "Facebook accounts," Aviv Ruff, CTO of Seculert, told SCMagazine.com on Thursday. The file contained more than 45,000 unique Facebook usernames and passwords.

"We suspect that the attackers behind Ramnit are using the stolen credentials to expand the malware's reach," Seculert said.

The threat was first discovered in April 2010. Prior variants have infected Windows executable and HTML files, and stole stored data, including usernames, passwords, login credentials and browser cookies. Previous strains also have functioned as a backdoor, enabling a cyber thief to gain control of an infected computer.

Last July, Symantec reported that Ramnit was the most-blocked malware, accounting for 17 percent of incidents.

A variant spread a month later that incorporated source code from the notorious Zeus trojan, rendering it a hybrid capable of going after financial assets. Seculert said it was able to "bypass two-factor authentication and transaction signing systems, gain remote access to financial institutions, compromise online banking sessions and penetrate several corporate networks."

Computers are infected through drive-by download attacks, which occur when users simply visit a malicious website and become infected without taking any action. Machines also can be impacted if users click on rogue email links.

In the case of Facebook, once the attackers steal a user's login and password to the social networking site, they can access the victim's account to direct others to Ramnit.

Users should never click on suspicious links, even if posted by one of their friends on Facebook, Raff said. Also they should not share passwords across online accounts.

Seculert provided Facebook with all of the stolen credentials it detected on the Ramnit C&C servers.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

TOP COMMENTS

More in News

Information sharing requires breaking down barriers, White House cyber guru says

Information sharing requires breaking down barriers, White House ...

The White House has advanced an agenda to promote and facilitate information sharing on security threats and vulnerabilities.

Worm variant of Android ransomware, Koler, spreads via SMS

Worm variant of Android ransomware, Koler, spreads via ...

Upon infection, the Koler variant will send an SMS message to all contacts in the device's address book.

Patch for Windows flaw can be bypassed, prompts temporary fix from Microsoft

Patch for Windows flaw can be bypassed, prompts ...

The Windows zero-day received a patch last week, but the fix can still be bypassed by crafty attackers.