AhnLab, Inc. announced the full analysis of Citadel malware, the latest generation of banking information-stealing malware. The most famous banking-targeted malware before Citadel was Zeus and SpyEye Trojan. After the source code of Zeus went public in 2011, Citadel is emerged as the most dominating malware with enhanced malicious functions.

Citadel has many things in common with Zeus. It creates and manages the botnet, a collection of internet-connected computers those are infected with malware. It is designed to collect personal information from infected PCs including online banking information, web browser credential and SNS account data.

The malware also delivers ransomeware and scareware from attacker in attempts to extort money directly from victims. In terms of info-stealing, Citadel surpasses Zeus. Both malwares collect and leak basic information of infected PC, including OS information, data of web browser in use, system time, and user admin name before they steal banking credential. Citadel, in addition to the basic information, leaks more comprehensive information of infected PC including domain information of local network, the list of data base servers, network configuration information and homepage setting information.

With these information gathered, the attacker can design more targeted threats. Citadel is provided in a Software-as-a-Service (SaaS) model, as it has its own store, and customers can manage the malware from creation to maintenance. The store offers the Citadel builder, botnets paying in monthly basis, update service, a test to avoiding AV and many other features.

It indicates a recent trend of the cybercrime ecosystem. AhnLab's AOS provides integrated and multi-layered transaction security against comprehensive security threats. With its four primary components including AOS Secure Browser, a dedicated security browser that creates a protected environment for online transactions, AOS Anti-keylogger, AOS Firewall and antivirus, prevent confidential data loss through this kind of advanced and targeted attack from sophisticated malware such as Zeus, SpyEye and Citadel.

After the full analysis of Citadel malware, AhnLab keeps working on analysis of possible Citadel variants.