Nasty banking Trojan makes mules of victims

A sophisticated Trojan horse program designed to empty bank accounts has a new trick up its sleeve: It lies to investigators about where the money is going. It rewrites bank pages so that the victims don't know that their accounts have been emptied, and it also has a sophisticated command-and-control interface that lets the bad guys pre-set what percentage of the account balance they want to clear out. First uncovered by Finjan Software last week, the URLzone Trojan is already known to be very advanced. But Finjan isn't the only company looking into URLzone.

Researchers typically create their own programs that are designed to mimic the behavior of real Trojans. RSA Security researchers say the software uses several techniques to spot machines that are run by investigators and law enforcement. When URLzone identifies one of these, it sends it bogus information, according to Aviv Raff, RSA's FraudAction research lab manager. When URLzone spots a researcher's program, instead of simply disconnecting from the researcher's computer, the server tells it to do a money transfer. Security experts have long published research into the inner workings of malicious computer programs such as URLzone, Raff said. "Now the other side knows that they are being watched and they're acting," he said. But instead of transferring the money into one of the criminal's money mules - people who have been recruited to move cash overseas - it chooses an innocent victim.

So far, more than 400 legitimate accounts have been used in this way, RSA said. Typically, these are people who have received legitimate money transfers from other hacked computers on the network, Raff said. The idea is to confuse researchers and to prevent the criminal's real money mules from being discovered. According to Finjan, URLzone infected about 6,400 computer users last month and was clearing about €12,000 (US$17,500) per day. Banking Trojans such as Zeus and Clampi have been emptying accounts for years now, but Finjan dubbed URLzone the first of a new, smarter generation of the crimeware.