Threat of New Carberp Trojan Revealed by TrustDefender

The Carberp trojan first appeared in May 2010, and researchers at TrustDefender found that it has several unique characteristics that raise concern.

[xtypo_dropcap]C[/xtypo_dropcap]ybercriminals are leveraging a new computer trojan, Carberp, in the United States and Europe, that could outpace current trojans to become “a leading malware security threat,” according to online transaction security company TrustDefender.

Some of the main trojans currently being used by cybercriminals to attack financial institutions and enterprises are Zeus, Mebroot, and Silentbanker. According to TrustDefender, “Carberp is a promising challenger to Zeus and potentially provides a new class of Trojan for cybercriminals to use.”

“This particular Trojan appears to be purpose built and has evolved in sophistication at a rapid rate,” Online Security expert and CTO of TrustDefender, Andreas Baumhof said in a press release.

Baumhof adds that the company “anticipates Carberp will further develop and could morph into a problematic threat from a financial, political, and personal perspective. This demonstrates how quickly the bad guys are innovating new sophisticated threats.”

The Carberp trojan first appeared in May 2010, and researchers at TrustDefender found that it has several unique characteristics that raise concern.

The trojan can disable other trojans in order to make its own attacks more effective, it does not send stolen information to competition, and can infect computers running Windows XP, Vista, and 7, “which only few Trojans can do,” according to TrustDefender.

It can also use use browser hooking and installation to “fully control all Internet traffic” and “the entire Internet session.” Carberp does not make changes to the computer’s registry and transmits stolen state is real-time back to the cybercriminal who implemented it.

“While Trojans such as Zeus and Mebroot are successful and high profile; the ‘bad guys’ obviously wish to stay under the radar and with new malware and configuration files they are able to continue to infiltrate in new ways,” Baumhof said.