First Trojan targetting Dutch bank found

Shortly after my blog post yesterday I received a sample which seemed quite interesting. So I decided to take a closer look at things.

Turns out I that the specimen was another first – a bank Trojan which specifically targets (amongst others) a Dutch bank.

De Postbank has been the target of a number of phishing attacks, as it’s the only big bank in the Netherlands still using TAN codes.

It was just a matter of time before the criminals turned to Trojans instead of phishing.

We detect this sample as Trojan-Spy.Win32.Agent.ew.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.