Leveraging the redirection attack technique, Dridex victims are unknowingly sent to an entirely new, fake website when they try to browse to their online banking site. Since they are immediately redirected to a fake site, they never actually access the bank's true site. The power of this attack lies in its simplicity. By keeping the user away from their bank's site, the attacker can deceive them into divulging personal authentication codes without the bank's counter-fraud systems recognizing that a customer's session has been initiated or diverted.
These tactics have already been seen in other parts of the world and are now shifting to Singapore.
The Tinba v3 Trojan
X-Force researchers first discovered Tinba targeting Singaporean banks in 2015, and this malware continues to be one of the most active threats in the region today. In December 2015, Tinba v3 set its sights on business and corporate accounts held with nine major bank brands in Singapore. These Singaporean banks became the top target for the malware campaign, accounting for more than one-third of all Tinba-targeted brands. In fact, Singapore is in the crosshairs of Tinba v3 27 percent of the time, making it the most targeted country for Tinba.
Source: IBM Trusteer - Geo distribution per Asia-targeting Tinba v3 configuration file
Tinba v3 continues to be an advanced, actively developed banking Trojan and according to ongoing IBM X-Force research into this malware's evolution, it is likely to have a dedicated development team behind it.
GM Bot: Most Prolific Android Banking Trojan
GM Bot, mobile malware that affects Android based devices, is the latest and most popular commercial malware that organizations in Singapore need be aware of. While it first emerged in the Russian-speaking cybercrime underground in 2014, GM Bot's source code was recently leaked making the Trojan accessible to potential attackers to use for free. With the code leaked, more cybercriminals can now recompile the code, create new variants and customize it for specific regions.
GM Bot is specifically designed to help fraudsters steal banking and payment credentials, as well as bypass verification techniques used in banking transaction authorization. For example, GM Bot can launch fake overlay windows to mimic bank applications to steal user login details and payment card information. Additionally, the malware can control a device's SMS relay and voice calls to intercept verification code text or calls incoming from a bank to the user.
How can Singapore fight back?
IBM Security regularly works with customers around the globe in order to study and stop banking Trojan attacks launched by gangs that operate threats like Dridex, Tinba, and GM Bot. Singaporean organizations should consider using technologies that can adapt to emerging threats to detect infections and protect customer endpoints.
Sign up for Computerworld eNewsletters.