Seqrite detects trojan targetting co-operative banks

PUNE: Seqrite, the enterprise security arm of Quick Heal Technologies, said that it had detected a new wave of Adwind Java Remote Access Trojan (RAT) campaign targeting Indian co-operative banks using Covid-19 as a bait. Researchers at Seqrite warned that if attackers are successful, they can take over the victim’s device to steal sensitive data like SWIFT logins and customer details and move laterally to launch large scale cyberattacks and financial frauds.

According to the researchers at Seqrite, the Java RAT campaign starts with a spear-phishing email which claims to have originated from the Reserve Bank of India or a nationalized bank. The contents of the email refer to COVID-19 guidelines or a financial transaction, with detailed information in an attachment, which is a zip file containing a JAR based malware

This JAR malware is a Remote Access Trojan that can run on any machine which has Java runtime enabled, impacting a variety of endpoints, irrespective of their base Operating System. Once the RAT is installed, the attacker can take over the victim’s device, send commands from a remote machine, and spread laterally in the network. In addition, this malware can also log keystrokes, capture screenshots, download additional payloads, and extract sensitive user information.


The company said that it had been able to successfully detect and block these attempts.