Cybercriminals increasingly targeting Asian banks

Online banking malware increases 29% in Q2.

Trend Micro's Q2 2013 Security Roundup Report said more online banking threats were seen in different countries in the second quarter, specifically in South Korea, India and Japan. It said online banking threats are spreading across the globe and are no longer concentrated in certain regions like Europe and the Americas.

Increased online banking threats and availability of sophisticated, inexpensive malware toolkits are among growing concerns. The report warns users about the increasing hazards of online banking. Online banking malware saw 29% increase from the previous quarter, or from 113,000 to 146,000 infections.

Online banking malware volume significantly increased in Q2 due in part to the rise in the ZeuS/ZBOT malware volume in the wild.

Trend Micro found an online banking malware that modifies an infected computer’s HOSTS file to redirect a customer of certain banks to phishing sites. It also saw more Citadel variants (detected as ZBOT) targeting different financial service institutions.

These malware not only target big banks but also smaller ones, including those that exclusively cater to online banking customers. As predicted, cybercriminals carried out developments in malware distribution and refinement for existing tools

The FAKEBANK malware spotted in Q2 spoofs legitimate apps. It contains specific Android application package files (APKs), which it copies to a device’s Secure Digital (SD) card.

Using the APK files, the malware displays icons and a user interface that imitates legitimate banking apps. This technique is reminiscent of PC banking Trojans that monitor users’ browsing behaviors and spoofs banking sites.

This highlights the need for increased awareness of online banking security. Cybercriminals have also developed more diverse attacks that used various social engineering lures; single sign-on (SSO) and multi-protocol services and blogging platforms for their malicious schemes.

Other online banking Trojan toolkits like ZeuS, SpyEye, and Ice IX are already available for free, making it easier for any skilled hacker to obtain their source codes.