ID Data Theft by Trojan

Huge haul of ID data stolen by trojan

Smart Russian spyware gathered info 'unnoticed' for 54 days.

According to researchers at SecureWorks, a sophisticated trojan which spread through browser exploits, harvested sensitive data both from storage and by monitoring online activity, and uploaded this data to a server in St. Petersburg, went undetected by many AV products for over 50 days.

The trojan, dubbed 'Gozi' by researchers at SecureWorks, was first spotted by them in early January, and was apparently infecting users from early December 2006. A single seeding of one variant is thought to have infected over 5,000 individual machines and stolen data concerning over 10,000 accounts, netting credentials worth up to $2 million on the black market.

When first tested against 30 AV products, no specific identification was available, although several picked up on suspicious behaviour or the use of packers. By early February, several products were detecting the trojan under various names, while many more still had no detection at all.

Following up initial investigation into the behaviour of the trojan, SecureWorks researchers looked into the site storing the stolen data, and found the harvested information stored in a searchable format, which was then used to inform affected financial institutions, while attempts were made to have the server tracked and shut down.

Full analysis of the trojan, along with details of subsequent investigations into online data trading, can be found here.