Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
The Citadel trojan is being pulled underground with fears of a law enforcement crackdown.
Citadel, built on the shoulders of Zeus, was one of the most advanced and quality trojans available with a sale price of around $2500.
It was famous for being the first crimeware kit to include a Customer Relationship Management (CRM) module where clientele could request new features from Citadel’s team of software developers.
Citadel’s creators have now announced the trojan will be pulled from the public Russian underground market, to be likely only sold to users whose reputation existing customers have vouched for.
“By selling less they can keep the trojan from being all too widely-spread”, RSA’s research labs wrote.
Selling on the open market attracts law enforcement and gives white hat researchers access to reverse-engineer the software, forcing Citadel’s developers to tweak its functions.
Citadel’s developers were accessories to the crimes committed by their botmaster customers but RSA points out that those behind other crimeware kits like Spyeye and rival Ice have to date escaped arrest.
“…we are seeing the Citadel’s team already taking measures to go deeper underground for their own safety.”
Research last month by S21Sec found the latest version of the banking trojan was outfitted with evasion techniques to help it avoid reverse-engineering.
That anti-emulator would detect sandboxes and, rather than terminate operation like other trojans, would mimic normal functionality but fake connection to botnets in hopes of throwing researchers off the scent.
Copyright © SC Magazine, Australia
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.