Excerpt
Research By: Yaroslav Harakhavik and Nikita Fokin
Following our recent analysis of the Kronos banking Trojan, we discovered that Kronos has also now been enhanced to hide its communication with C&C server using Tor. While the author of Kronos continues to remain an issue of controversy, the new banking Trojan, Osiris, is thought to be primarily based on Kronos source code and most likely has the same author.
Background
Kronos banking Trojan first made an appearance on the Russian underground forum, exploit.in, in 2014 where it was advertised for $2000 a month:
Figure 1: The advertisement of Kronos on the exploit.in.
It had the following technical capabilities:
Form grabber…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Check Point on research.checkpoint.com.
More from Check Point88
- Gozi: The Malware with a Thousand FacesCheck Point · Published 28 Aug 2020
- Shattering the Dream - When a Job Offer Becomes a Zero-Day AttackCheck Point · Published 11 Aug
- Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution EcosystemCheck Point · Published 3 Jun
- Cavern Manticore: Exposing Iran-Linked Modular C2 FrameworkCheck Point · Published 6 Jul
On the same topics
- Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkitacronis.com · Published 13 Sep
- Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor DeploymentQiAnXin · Published 11 May
- Nemty 1.6 Ransomware Released and Pushed via RIG Exploit KitBleepingComputer · Published 11 Oct 2019
- LockBit 2.0 Ransomware Becomes LockFile Ransomware with a Never-Before-Seen Encryption Methoddeepinstinct.com · Published 21 Sep 2021
