VXers have developed a strain of malware capable of logging keystrokes as well as snooping on encrypted SSL streams originating from compromised PCs.
The hybrid variant of the Gozi Trojan was discovered by Don Jackson, a researcher with SecureWorks who discovered the original Gozi malware earlier this year. In its original form, Gozi spread using IE exploits. It used advanced Winsock2 functionality to snoop on traffic.
More ReadingSuspected brains behind bank-account-draining Gozi extradited to USLatvian foreign minister speaks out against giving up alleged Gozi writer to US'Gozi Trojan trio' blamed for multimillion-dollar bank raid spreeMobile banking security bypassed in fiendish malware blagOnline crime gangs embrace open source ethos
Gozi used customised server/database code to collect sensitive data. Access to this data was sold to fraudsters, an innovation in the malware-for-profit marketplace. According to SecureWorks, a single strain of the original malware compromised more than 5,200 hosts and 10,000 user accounts at hundreds of sites. The malware is estimated to have created a thriving black market worth an estimated $2m.
Access to a server offering customised queries on the data was maintained by a Russian group called 76Service. The code itself, and probably the latest variant, was the work of a group of VXers called the HangUp Team.
The latest variant adds keylogging features to an already potent mix - a new packing utility that mutates or deletes portions of the Trojan code, making detection far more difficult. Gozi 2.0 has already filched data from at least 2,000 users worldwide since its first appearance on 17 April, Computerworld reports. ®