The Mekotio banking trojan is a sophisticated piece of malware that has been active since at least 2015, primarily targeting Latin American countries with the goal of stealing sensitive information — particularly banking credentials — from its targets.
Originating in the Latin American region, it has been particularly prolific in Brazil, Chile, Mexico, Spain, and Peru. Furthermore, Mekotio seems to share a common origin with other notable Latin American banking malware such as Grandoreiro, which was disrupted by law enforcement earlier this year. Mekotio is often delivered through phishing emails, employing social engineering to trick users into interacting with malicious links or attachments. Trend Micro recently seen a surge in attacks involving Mekotio among their customers.
Read more…
Source: Trend Micro
Related:
- Ploutus.D Malware Variant Used in U.S.-based ATM Jackpotting Attacks
January 29, 2018
The United States Secret Service issued a warning on Friday to financial institutions citing “credible information” about “planned” attacks against U.S. cash machines using malware that can quickly drain ATM machines dry of cash. The warning came a day after ATM maker Diebold Nixdorf also warned its customers of “potential” ATM Jackpotting attacks moving from Mexico to the U.S. But journalist Brian ...
- Dridex banking Trojan compromises FTP sites in new campaign
January 19, 2018
Researchers have discovered the Dridex banking Trojan has once again evolved and is now using compromised FTP websites in phishing campaigns. The Trojan was first spotted back in 2014 after targeting banks in the United Kingdom. Since then, Dridex has become infamous for striking financial institutions across Europe. The malware spreads through phishing campaigns, duping victims into downloading ...
- Oman’s stock exchange was easily hackable for months
January 18, 2018
One of the largest stock exchanges in the Middle East has quietly fixed a security issue that could’ve let hackers gain unfettered access to the network. A core router for Oman’s stock exchange, the Muscat Securities Market, had both its username and password as “admin” for months, even after several attempts by a security researcher to ...
- New KillDisk Variant Hits Financial Organizations in Latin America
January 15, 2018
We came across a new variant of the disk-wiping KillDisk targeting financial organizations in Latin America. Trend Micro detects it as TROJ_KILLDISK.IUB. Trend Micro™ Deep Discovery™ proactively blocks any intrusions or attacks associated with this threat. Initial analysis (which is still ongoing) reveals that it may be a component of another payload, or part of a bigger ...
- After security disasters, banks using SWIFT messaging platform face new regulations in 2018
January 3, 2018
In 2018, all banks using the SWIFT messaging platform will be required to comply with a new cybersecurity framework that aims to establish a baseline for security. SWIFT stands for the Society for Worldwide Interbank Financial Telecommunication. Banks use the closed network to communicate among themselves, sending approximately 25 million messages per day. Read more… Source: TechRepublic
- MoneyTaker Cybercriminal Group Steals $10 Million from Financial Institutions
December 12, 2017
Security researchers shed light on the Russian-speaking cybercriminal group MoneyTaker, which was reported to have perpetrated cyberattacks against financial organizations in the U.S. and Russia. The group reportedly stole as much as $10 million from at least 20 card payment and inter-bank transfer systems. What is MoneyTaker? MoneyTaker is a cybercriminal group named after the custom malware they use ...