Gadgetell | Tech News, Reviews, and Interesting Things

Experts are warning of a new Trojan that is so sophisticated it’s being called “ferocious.”  The Clampi Trojan has infected up to 1 million computers and is stealing massive amounts of financial data.  The Trojan’s botnet is so huge and the Trojan itself so cloaked in encryption it’s nearly impossible to crack.

“Clampi is the most professional thieving pieces of malware I’ve ever seen,” said Joe Stewart, director of malware research for SecureWorks’ counter-threat unit. “We know of few others that are this sophisticated and wide-ranging. It’s having a real impact on users.”

Clampi has a list of nearly 5,000 websites it monitors once it’s infected a PC.  Once a site on the list is visited, a keylogger is activated and the user credentials and any financial info found are stolen and sent to the botnet’s command and control server.  It takes everything - user names, passwords, PINs, SSNs, and anything else typed in while the victim is at one of the targeted sites.

Among the sites identified are news sites, mortgage and insurance company sites, banks, online casinos, military information portals, e-commerce sites and more.  An auto parts store in Georgia has revealed the malware allowed the cybercriminals behind it to rob them of almost $75,000.

What makes this Trojan even more of a concern is that its design is such that it is broken down into multiple pieces, encrypted, and stored in the Windows registry which keeps it hidden from anti-virus software.  The fact that every bit of it, from the malware itself to the traffic between it and its command server, is heavily encrypted makes it impossible to reverse engineer-which also keeps anti-virus software makers from identifying its markers.

This Trojan is so powerful that experts are recommending that everyone confine their financial tasks (this includes banking, bill paying, loan and credit applications and even shopping online) to an isolated PC that is not connected to a network.  Once it’s infected one machine, Clampi will copy itself to every other machine it finds networked to it.

Read [PCWorld]