A three-year-old banking Trojan, believed to be the work of experienced and organised Russian cybercriminals, has now turned its attention to UK banks.
The Qadars Trojan has been active since 2013. Using several different versions, the malware has targeted banks in different regions, beginning with France and the Netherlands during 2013 and 2014, then Australia, Canada, the United States, and the Netherlands during 2015 and 2016.
Now, cybersecurity researchers at IBM X-Force Research — who last month spotted malware attacking Brazilian banks ahead of the Olympics — have observed the launch of a fresh version of Qadars and a new infection campaign.
This time, the malware campaign is targeting 18 banks in the UK — which haven’t been named for security reasons — as well as financial institutions in Germany, Poland, and once again, the Netherlands. UK banks have recently also been targeted by a separate data-stealing Dridex malware campaign.
Qadars historically infects end-points using exploit kits found on compromised hosts, or on domains purchased for the purpose of serving malware. It has also been known to employ botnets, using downloader-type malware to infect victims.
Qadars uses social engineering to help take control of systems and undertake full-scale theft of data, including information from the two-factor authentication systems used by many online banking services. The Trojan is also capable of monitoring all user activity on a device and hijacking text messaging on the victim’s mobile phone.