CamuBot: New Financial Malware Targets Brazilian Banking Customers

IBM X-Force researchers analyzed new financial malware that targets major Brazilian banks through their business banking customers. The malware was dubbed CamuBot because it attempts to camouflage itself as a security module required by the banks it targets.

CamuBot emerged in Brazil in August 2018 in what appeared to be targeted attacks against business banking users. According to X-Force’s findings, the malware’s operators are actively using it to target companies and public sector organizations, mixing social engineering and malware tactics to bypass strong authentication and security controls.

A Brazilian Standout

Unlike other malware operated in Brazil, CamuBot is a defined new code. Very different from typical banking Trojans, CamuBot does not hide its deployment. On the contrary, it is very visible, using bank logos and overall brand imaging to appear like a security application. It thus gains victims’ trust and leads them to install it without realizing they are running an installation wizard for a Trojan horse.

CamuBot is more sophisticated than the remote-overlay type malware commonly used in fraud schemes targeting users in Brazil. Instead of simplistic fake screens and a remote access tool, CamuBot tactics resemble those used by Eastern European-made malware such as TrickBot, Dridex and QakBot, each of which focuses on business banking and blends social engineering with malware-assisted account and device takeover.

Hello, it's a Phish Calling! 

Want to know what the phish said? Check out the rest of this blog post here.