ATMZombie is a new banking trojan discovered by Kaspersky security researchers that targets Israeli banks, the first of its kind to do so!
ATMZombie, which was detected in November 2015, follows the classic proxy-changing method of bringing Web traffic to banking portals and then requires the victim's cooperation and a series of illegal money transfers so that in the end the fraudster can withdraw money from the ATM.
https://www.secnews.gr/101867/omospondiako-trojan-parakolouthei-polites/Federal trojan monitors German citizens
The proxy-changing method is an old trick for malware developers! It involves modifying the browser's proxy server files by replacing the browser, PAC (Proxy Auto-Config) files.
These malicious PAC files will redirect all browser traffic through an intermediary node controlled by the attackers who record all the details. To break encrypted HTTPS traffic, ATMZombie also installs its own signed certificates on infected computers.
Once the necessary data is obtained, the attack moves into a manual operation phase, specifically only in Israeli banks due to a local service that allows the owner of a bank account to send money to people who have neither bank accounts nor credit cards!
Using the stolen credentials, the attacker will log into the victim's account to make small payments to their partners. The attacker uses an SMS transaction feature to do this, specifically to Israeli banks.
https://www.secnews.gr/101183/%ce%b5%ce%b9%ce%ba%ce%bf%cf%83%ce%ac%cf%87%cf%81%ce%bf%ce%bd%ce%bf%cf%82-%ce%b4%ce%b7%ce%bc%ce%b9%ce%bf%cf%8d%cf%81%ce%b3%ce%b7%cf%83%ce%b5-%cf%80%ce%ac%ce%bd%cf%89-%ce%b1%cf%80%cf%8c-100-banking-troj/This twenty-year-old created over 100 Banking Trojans!
The partners who are to receive the money receive an SMS, go to any ATM, enter the details and authorization code they have received in the message, and the ATM withdraws money from the victim and gives it to the fraudster.
Karpensky analysts said that many Israeli banks were hit this way and ATMZombie had hundreds of victims. Fortunately, this method does not allow large withdrawals, so no payment exceeded $750 (€690).
The conclusion is that local fraudsters are probably behind this story because they seem to know the ins and outs of the local banking scene and because they use special associates who withdraw money from ATMs, something that international criminal gangs tend to avoid.
https://www.secnews.gr/100684/%ce%bc%ce%b9%ce%b1-%ce%b1%cf%80%cf%8c-%cf%84%ce%b9%cf%82-%ce%bc%ce%b5%ce%b3%ce%b1%ce%bb%cf%8d%cf%84%ce%b5%cf%81%ce%b5%cf%82-%ce%ba%cf%85%ce%b2%ce%b5%cf%81%ce%bd%ce%bf%ce%b5%cf%80%ce%b9%ce%b8%ce%ad/Israel suffered one of the biggest cyberattacks!
