Trojan steals £700,000 from UK bank

Customer beware

Insecurity researchers at M86's Security Labs say they have uncovered a Zeus v3 Trojan botnet that has managed to steal over £650,000 from customers of an unnamed UK bank.

The "sophisticated" attack by cybercriminals uses Web-based malware to rob money via the bank's online banking system, the researchers said.They reckon to have discovered   a "command and control centre" located in Eastern Europe which directs the operation.

According to the report (pdf), the Trojan manages to avoid detection by "traditional" anti-virus software.

It steals the customer's online banking ID and hijacks their online banking sessions. It is able to check the account balance and, if the account has more than £800 in it, it issues a money transfer transaction.

"Based on information M86 Security Labs found on the malicious Command & Control  server, we assume that close to £675,000 was stolen from the bank between July 5 and August 4, 2010, and approximately 3,000 customer accounts were compromised, M86 said.

Spilt beans are still being counted to assess the full damage and the attack appears to be ongoing.