Ursnif v3 Emerges, Targets Australian Bank Customers With Redirection Attacks

Starting in the summer of 2017, IBM X-Force research detected a new variation of the Ursnif Trojan being tested in the wild. The malware is based on the same malcode of the original Ursnif Trojan (aka Gozi ISFB), but features some modifications on the code injection level and to attack tactics.

Beyond these changes, the internal build number has also changed to indicate v3 increments versus the existing v2 builds, making this iteration an upgrade of sorts that was most likely undertaken by a different malware developer.

X-Force noted that while changes were most significant in the code injection mechanism, the malware’s operators also opted to develop redirection attacks to target business and corporate banking customers in Australia. The redirection scheme is implemented through the configuration file and not embedded into the code itself.

This finding is significant because it suggests that a new group has joined the cybercrime arena and is specifically operating in Australia, where malware gangs such as TrickBot and Dridex already have a firm foothold. Another notable issue is that Gozi v3 targets business and corporate banking users with redirection attacks, a sophisticated tactic currently used by cybergangs such as Dridex, GootKit and TrickBot.

Ursnif v2 variants are active in the wild alongside this recent version.

Ursnif 2, Ursnif 3 …

Continue reading this post here.