Shylock targets US and European banks

Posted in categories

  • CyberREPORTs
Publish date 25 September 2013
Issue Number 1503
Diary Legalbrief eLaw

Two-dozen US and European banks have been targeted by the Shylock Trojan. The virus avoids detection as it injects itself into legitimate processes.

According to a report on the ITWeb site, Shylock, known also as 'Capshaw financial malware', has actively been going after bank accounts since 2011. The report says the countries with the highest number of infections are the UK, Italy, Denmark and Turkey. Sachin Deodhar and Chris Mannon, researchers from Zscaler's ThreatLabZ, have reported this upswing in activity, but say they are currently unable to identify the initial infection vector. 'We can tell that it is more than likely arriving as part of an exploit kit honing in on vulnerable versions of Java. At the same time, it obfuscates its phone home traffic by employing a domain-generated algorithm to create addresses using self-signed SSL certificates,' the researchers are quoted in the report as saying. Full report on the ITWeb site