Contributor: Piotr Krysiuk
On June 5, Microsoft announced that they had worked together with members of the financial services industry and the FBI to disrupt the operations of a banking Trojan horse program called Citadel. The takedown operation resulted in over 1,000 Citadel botnets being taken offline.
Citadel is a banking Trojan that has been in existence since 2011. As with most banking Trojans, Citadel is a full crimeware kit, providing the attackers with payload builders, a command and control (C&C) server infrastructure, and configuration scripts to target various banks. Citadel is a descendant of that other behemoth of the financial Trojan world, Trojan.Zbot (Zeus). It came into existence after the Zeus source code was leaked in 2011, with criminal groups taking that code and enhancing it.
Figure 1. The Citadel Trojan interface
Citadel is aimed at a more "exclusive" attacker market than its more widespread predecessor, Zeus. The Citadel kit is sold through underground Russian forums and typically costs around $3,000, compared to $100 for the SpyEye and leaked Zeus kits. Citadel users will also have to fork out a further $30-$100 to purchase Web inject code for the banks that they wish to target. Additionally, even if attackers have that money to spend, there is a strict vetting process with referrals required for new purchasers.
Citadel infections have spread around the globe, but in the past six months the majority of infections have been in Australia, Italy and the US.
Figure 2. Citadel infections from January to June 2013
Symantec welcomes news of the takedown of these Citadel botnets. While these takedowns may not eliminate the threat of Citadel completely, it certainly disrupts current campaigns and sends out a clear message to attackers that their actions are being monitored. Symantec also welcomes the cooperation between the public and private sector in taking action against this threat.
For more information about the world of financial Trojans, read our whitepaper. Symantec's current antivirus and intrusion prevention signatures provide protection against Citadel infections.