By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
10alert.com10alert.com
  • Threats
    • WordPress ThreatsDanger
    Threats
    A cyber or cybersecurity threat is a malicious act that seeks to damage data, steal data, or disrupt digital life in general. Cyber threats include…
    Show More
    Top News
    An Android that robbed your bank account -Kaspersky Daily
    8 months ago
    New CryptoLocker-like Malware for Android
    8 months ago
    Apple Watch And The Other Smartwatches
    8 months ago
    Latest News
    Triangulation: Trojan for iOS | Kaspersky official blog
    2 days ago
    Wordfence Intelligence Weekly WordPress Vulnerability Report (May 22, 2023 to May 28, 2023)
    2 days ago
    Safeguards against firmware signed with stolen MSI keys
    4 days ago
    WPDeveloper Addresses Privilege Escalation Vulnerability in ReviewX WordPress Plugin
    4 days ago
  • Fix
    Fix
    Troubleshooting guide you need when errors, bugs or technical glitches might ruin your digital experience.
    Show More
    Top News
    How To Configure Cloudflare To Maximize WordPress Speed + Security
    8 months ago
    Windows 11 build 25179 rolls out in the Dev Channel
    8 months ago
    How to set a static IP address on Windows 11
    8 months ago
    Latest News
    How automatically delete unused files from my Downloads folder?
    4 months ago
    Now you can speed up any video in your browser
    4 months ago
    How to restore access to a file after EFS or view it on another computer?
    4 months ago
    18 Proven Tips to Speed Up Your WordPress Site and Improve SEO | 2023 Guide
    5 months ago
  • How To
    How ToShow More
    Dynamic data collection with Zaraz Worker Variables
    Dynamic data collection with Zaraz Worker Variables
    1 day ago
    Reduce latency and increase cache hits with Regional Tiered Cache
    Reduce latency and increase cache hits with Regional Tiered Cache
    2 days ago
    Cloudflare is deprecating Railgun
    Cloudflare is deprecating Railgun
    2 days ago
    What is two-factor authentication | Kaspersky official blog
    5 days ago
    Acer refreshes Windows 11 PCs for work and play: Swift Edge 16 and Predator Triton 16
    1 week ago
  • News
    News
    This category of resources includes the latest technology news and updates, covering a wide range of topics and innovations in the tech industry. From new…
    Show More
    Top News
    New Fraud in India with porn deepfakes
    8 months ago
    Google My Business Temporarily Removes Features Due to COVID-19
    8 months ago
    Show Order Histories on User Profiles at the Backend
    8 months ago
    Latest News
    How to add CPU, GPU, RAM widgets on Windows 11
    2 days ago
    How to create virtual drive (VHD, VHDX, Dev Drive) on Windows 11
    5 days ago
    How to enable Taskbar End Task option to close apps on Windows 11
    5 days ago
    How to check USB4 devices specs from Settings on Windows 11
    5 days ago
  • Glossary
  • My Bookmarks
Reading: Catching the cybercriminals who created Lurk
Share
Notification Show More
Aa
Aa
10alert.com10alert.com
  • Threats
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
  • Threats
    • WordPress ThreatsDanger
  • Fix
  • How To
  • News
  • Glossary
  • My Bookmarks
Follow US
ThreatsWordpress Threats

Catching the cybercriminals who created Lurk

Vitus White
Last updated: 13 October
Vitus White 4 years ago
Share
7 Min Read

Perhaps the biggest problem with cybercriminals is that they are extremely difficult to catch. Think of a real-life bank robbery with guns and face-masks — the thieves leave fingerprints; their voices are recorded by security cameras; police can trace their cars using traffic cameras; and so on. All of that helps the investigators find the suspects. But when cybercriminals pull off a robbery, they leave … basically nothing. No clues.

Yet sometimes they get caught. Remember the SpyEye banking trojan? Its creators were caught in 2011. Remember the Carberp group, which was active from 2010 to 2012? Caught as well. How about the infamous Angler exploit kit, which suddenly went off the radar in late June? Lurk malware stopped its attacks around the same time — because the group behind it got caught, with the help of Russian authorities and Kaspersky Lab.

The story began back in 2011, when we first encountered Lurk. What caught our eye was the fact that some nameless Trojan that used remote banking software to steal money was classified by our internal malware naming system as a Trojan that could be used for many things — but not stealing money. So we took a closer look.

The investigation yielded almost no results — the Trojan seemed to do nothing. But the attacks continued, and our analysts were able to get more and more samples to look at.

During that time, we learned a lot about Lurk. For example, it had a modular structure: When the Trojan detected that it had infected a computer with remote banking software installed, it would download the malicious payload, which was responsible for stealing money. That is why our naming system didn’t call Lurk a banking Trojan at first — the payload was missing.

A technical look at #Lurk #banking #Trojan https://t.co/rNsJ0YHimW pic.twitter.com/vT7YLXZOae

— Kaspersky Lab (@kaspersky) June 10, 2016

We also found that Lurk avoided leaving any footprints on the hard drive, working only in the RAM of the computers it had infected. That made it harder to catch. Lurk’s creators were also using encryption here and there as well as obfuscation. Their command-and-control servers were hosted on domains that were registered with false registration data. And the software — both Lurk’s body and the malicious payloads — were constantly changing, being tailored specifically for one bank or another.

Lurk’s creators were careful, and we knew there must be a team of professionals behind such complex malware. But professionals are still just people, and people make mistakes. Those mistakes gave us information we could use to find the people behind the Trojan.

Lurk, it turned out, was created and maintained by a group of about 15 people, although by the time it was shut down, that number had risen to 40. They had two projects: the malware itself and the botnet used for its distribution. Each project had its own team.

A group of programmers developed Lurk, and a group of testers checked how it performed in various environments. On the botnet side, there were administrators, operators, a money flow manager, and other people. Money mules picked up cash at ATMs, and a money mule manager collected that money from the mules.

Lurk: Seek and destroy

Most of the people involved were basically wage workers on a salary. To hire them, the people behind Lurk posted job vacancies on head-hunting websites, promising remote work with full employment and an attractive salary. During the job interview, the recruiter would ask the candidates whether they had strong moral principles. Those who didn’t got the job.

Developing Lurk and maintaining the botnet required not only a lot of people, but also some costly infrastructure including servers, VPNs, and other tools. After a few years in business, the Lurk team looked like a medium-size IT company. And like many companies, they decided to diversify their business after a while.

The cybercriminals behind Lurk are also responsible for creating Angler, aka XXX — one of the most sophisticated exploit kits to date. At first it was designed as a tool to deliver Lurk to its victims, but its creators decided to sell Angler to third parties as well. Its success and apparent invincibility boosted the group behind Lurk to almost legendary status among Russian cybercriminals, and that in turn gave a good boost to Angler sales on underground markets.

Angler became quite popular among cybercriminals. For example, it was used to distribute CryptXXX and Teslacrypt ransomware.

#Nuclear, #Angler exploit kit activity has disappeared via @threatpost https://t.co/XHxKsObx03 pic.twitter.com/GPjzpJDVvS

— Kaspersky Lab (@kaspersky) June 23, 2016

But by the time they started to sell Angler, the group’s days were already numbered. The Russian police, with Kaspersky Lab’s help, had collected enough evidence to arrest the suspected group members. In June 2016 Lurk activity stopped, and soon Angler followed suit. The cybercriminals thought to the end that they would never get caught because of the precautions they took.

Their precautions shielded them for a while, but even clever cybercriminals are still human. Sooner or later they’ll stumble and make some mistakes, and then a good team of investigators will find them. It usually takes a long time and a lot of effort, but that’s how we bring justice to the cyberworld.


Source: kaspersky.com

Translate this article

TAGGED: Encryption, Malware, PoC, RC4, Security, Software, Targeted Attack, Threats
Vitus White October 13, 2022 September 30, 2019
Share this Article
Facebook Twitter Reddit Telegram Email Copy Link Print

STAY CONECTED

24.8k Followers Like
253.9k Followers Follow
33.7k Subscribers Subscribe
124.8k Members Follow

LAST 10 ALERT

Dynamic data collection with Zaraz Worker Variables
Dynamic data collection with Zaraz Worker Variables
Apps 1 day ago
How to add CPU, GPU, RAM widgets on Windows 11
News 2 days ago
Reduce latency and increase cache hits with Regional Tiered Cache
Reduce latency and increase cache hits with Regional Tiered Cache
Apps 2 days ago
Cloudflare is deprecating Railgun
Cloudflare is deprecating Railgun
Apps 2 days ago
Triangulation: Trojan for iOS | Kaspersky official blog
Threats 2 days ago

Recent Posts

  • Dynamic data collection with Zaraz Worker Variables
  • How to add CPU, GPU, RAM widgets on Windows 11
  • Reduce latency and increase cache hits with Regional Tiered Cache
  • Cloudflare is deprecating Railgun
  • Triangulation: Trojan for iOS | Kaspersky official blog

You Might Also Like

Dynamic data collection with Zaraz Worker Variables
Apps

Dynamic data collection with Zaraz Worker Variables

1 day ago
Reduce latency and increase cache hits with Regional Tiered Cache
Apps

Reduce latency and increase cache hits with Regional Tiered Cache

2 days ago
Cloudflare is deprecating Railgun
Apps

Cloudflare is deprecating Railgun

2 days ago
Threats

Triangulation: Trojan for iOS | Kaspersky official blog

2 days ago
Show More

Related stories

How to Use Cloudflare to Secure Your WordPress Site
How To Starting Chrome from the command line
How to fix error 0x80070057 in Chrome?
Windows 10 How To Disable Slide to Shutdown
Windows search not working (FIX)
How to watch movies and TV series for free on Kinopoisk?
Previous Next

10 New Stories

Wordfence Intelligence Weekly WordPress Vulnerability Report (May 22, 2023 to May 28, 2023)
Safeguards against firmware signed with stolen MSI keys
WPDeveloper Addresses Privilege Escalation Vulnerability in ReviewX WordPress Plugin
How to create virtual drive (VHD, VHDX, Dev Drive) on Windows 11
How to enable Taskbar End Task option to close apps on Windows 11
How to check USB4 devices specs from Settings on Windows 11
Previous Next
Hot News
Dynamic data collection with Zaraz Worker Variables
How to add CPU, GPU, RAM widgets on Windows 11
Reduce latency and increase cache hits with Regional Tiered Cache
Cloudflare is deprecating Railgun
Triangulation: Trojan for iOS | Kaspersky official blog
10alert.com10alert.com
Follow US

© 10 Alert Network. All Rights Reserved.

  • Privacy Policy
  • Contact
  • Customize Interests
  • My Bookmarks
  • Glossary
Go to mobile version
adbanner
AdBlock Detected
Our site is an advertising supported site. Please whitelist to support our site.
Okay, I'll Whitelist
Welcome Back!

Sign in to your account

Lost your password?