Ramnit Banking Trojan, August 2018’s Top Malware

Banking Trojans are one of the most common malware these days, alongside ransomware and cryptojacking. And one of the most prolific of them all this year is named the Ramnit banking trojan, as exposed by CheckPoint, a mainstream cybersecurity firm. “This is the second summer running where we have seen criminals increasingly using banking trojans to target victims and make a quick profit. Trends like this should not be ignored as hackers are acutely aware of which attack vectors are most likely to be successful at any given time, suggesting internet users’ browsing habits during the summer months make them more susceptible to banking trojans. This underlines that malicious hackers are tenacious and sophisticated in their attempts to extort money,” explained Maya Horowitz, Checkpoint’s Threat Intelligence Group Manager.

Since June 2018, the instances of banking trojan cases has been increasing, with Ramnit trojan being the most common type of banking trojan-type infection. “In order to prevent exploitation by banking trojans – and other types of attacks – it is critical that enterprises employ a multi-layered cybersecurity strategy that protects against both established malware families cyber-attacks and brand new threats,” Horowitz emphasized.

More details are revealed in CheckPoint’s official blog that details the issue of banking trojan. “It marks the second summer running where we have detected hackers increasingly using banking trojans to target victims and make a quick profit. Trends like this should not be ignored as hackers are acutely aware of which attack vectors are most likely to be successful at any given time, suggesting internet users’ browsing habits during the summer months makes them more susceptible to attack than at other times of the year. This underlines that malicious hackers are tenacious and sophisticated in their attempts to extort money,” the blog further explained.

It is valid for an enterprise to increase cyber defense spending, in order to minimize the chance of a banking trojan wrecking havoc on the office IT infrastructure. A multilayered cybersecurity methodology will never be a cheap option, but compared to becoming a victim of malware and losing the confidence of customers due to it, cyber defense spending is a much cheaper option.

In the report, Checkpoint enumerated the top 10 Malware for August 2018. Below is the direct quote of their list and their corresponding description:

1. ↔ Coinhive – Crypto Miner designed to perform online mining of Monero cryptocurrency when a user visits a web page without the user’s knowledge or approval the profits with the user. The implanted JavaScript uses great computational resources of the end users to mine coins and might crash the system.
2. ↑Dorkbot- IRC-based Worm designed to allow remote code execution by its operator, as well as the download of additional malware to the infected system.
3. ↑ Andromeda– Modular bot used mainly as a backdoor to deliver additional malware on infected hosts, but can be modified to create different types of botnets.
4. ↓ Cryptoloot– Crypto-Miner, using the victim’s CPU or GPU power and existing resources for crypto mining – adding transactions to the blockchain and releasing new currency. It is a competitor to Coinhive, trying to pull the rug under it by asking less percents of revenue from websites.
5. ↔ Jsecoin– JavaScript miner that can be embedded in websites. With JSEcoin, you can run the miner directly in your browser in exchange for an ad-free experience, in-game currency, and other incentives
6. ↑ Ramnit– Banking Trojan that steals banking credentials, FTP passwords, session cookies, and personal data.
7. ↔ XMRig– XMRig is an open-source CPU mining software used for the mining process of the Monero cryptocurrency, and first seen in-the-wild on May 2017.
8. ↓ Roughted– Large-scale Malvertising used to deliver various malicious websites and payloads such as scams, adware, exploit kits and ransomware. It can be used to attack any type of platform and operating system and utilizes ad-blocker bypassing and fingerprinting in order to make sure it delivers the most relevant attack
9. ↓ Conficker- Worm that allows remote operations and malware download. The infected machine is controlled by a botnet, which contacts its Command & Control server to receive instructions.
10. ↑ Nivdort– Multipurpose bot, also known as Bayrob, that is used to collect passwords, modify system settings and download additional malware. It is usually spread via spam emails with the recipient address encoded in the binary, thus making each file unique.