Top-Ranking Banking Trojan Ramnit out to steal payment card data

Category	Details
Threat Actors	Ramnit Gang
Campaign Overview	Ongoing campaigns targeting e-commerce brands and hospitality giants, particularly during the holiday shopping season.
Target Regions (Or Victims)	North America, Europe, and Australia. Targets include consumers, e-commerce platforms, hospitality services, and recruitment sites.
Methodology	– Web injections to steal credentials and payment card details. – Delivery through malicious macros in booby-trapped files. – Uses obfuscated scripts.
Product Targeted	Payment card data, e-commerce accounts, and online banking credentials.
Malware Reference	Ramnit, a banking Trojan active since 2010, leveraging Zeus Trojan code for web injections.
Tools Used	– External web injection scripts from C2 servers. – Booby-trapped productivity files with malicious macros.
Vulnerabilities Exploited	Not directly mentioned; relies on social engineering and malicious macros to infect devices.
TTPs	– Credential and payment data theft via real-time web injections. – C2 communication for script injections. – Blocking access to security sites.
Attribution	IBM X-Force research indicates Ramnit is operated by the same gang since its inception.
Recommendations	– Monitor and block traffic to malicious domains. – Educate users about phishing and macro-based attacks. – Deploy endpoint protection tools.
Source	Security Intelligence

Read full article: Read More

Disclaimer: The above summary has been generated by an AI language Model.