Customer Success Testimonial: Recovery is Everything

Anti-virus outfit Eset has discovered a malicious Apache module in the wild that serves up malware designed to steal banking credentials.

As the company states in this post, the module, dubbed Linux/Chapro, is already being used to inject a version of Win32/Zbot (Zeus) into content served by the compromised Web servers.

The process described by Eset goes like this: a user requests a supposedly-innocent Web page from a compromised server, which contacts its command and control server. The C&C machine sends compromised content – like an iframe – back to the Web server, which sends the malicious content to the end user.

That leaves the user infected with Zeus, and under control of the exploit hosting server.

“This complicated case spreads across three different countries, targeting users from a fourth one, making it very hard for law enforcement agencies to investigate and mitigate,” Pierre-Marc Bureau, Eset's security intelligence program manager, wrote in the blog post. “It is not clear at this point in time if the same group of people are behind the whole operation, or if multiple gangs collaborated, perhaps with one to drive traffic to the exploit pack and sell the infected computers to another gang operating a botnet based on Win32/Zbot.”

The attack is carefully designed not to draw attention to itself, Bureau writes. It doesn’t try to serve the malicious frame to search engine robots, and it ignores users connecting to a compromised site over SSH, to avoid infecting site administrators. Cookies and IP address logs are used to avoid sending the exploit to any user more than once. ®

Ensure Ease of Recovery with Asigra’s Agentless Software