Terdot

Terdot is a banking Trojan that collects information related to online login combinations for banking and social media accounts especially. As a persistent background threat, Terdot may conduct activities with symptoms that are limited or difficult to recognize, such as spoofing content in your Web browser or intercepting network communications. Always have anti-malware protection ready and updated for detecting and deleting Terdot automatically, and be watchful for indicators of compromise in any Web accounts.

The Still-Sounding Echoes of the God of Lightning

The first attacks of Keylogger Zeus are many years old, but most aspects of its programming remain viable for cybercrooks in need of financial information. A specific, year-old variant of that threat, a spyware program referred to as Terdot, even has become the recent recipient of noteworthy updates to its payload particularly. This new build of Terdot includes what malware experts are deducing as extremely comprehensive login-collecting capabilities that include both generalized and highly-focused attacks against the user's Web accounts.

The people who manage Terdot's campaign use two ways of circulating this banking Trojan: a website-hosted threat called the SunDown Exploit Kit, and imitations of PDF documents attached to spam e-mails. By abusing default, script-based vulnerabilities or tricking the user into launching the Trojan downloader accidentally, they acquire access to the PC for installing Terdot. Terdot also includes very configurable downloading features in its payload, which it could use for self-patching, as well as dropping separate threats onto the computer.

The majority of Terdot's payload dedicates itself to collecting information by intercepting it via the conventional 'Man-in-the-Middle' strategy, which logs any network-transferred info the user enters before passing it on towards the relevant parties, such as a third-party website. Terdot also leverages this feature for conducting sophisticated phishing attacks that can redirect the victim to a fake site that imitates the login pages of domains such as an online banking service. Malware experts confirm that Terdot includes certificate-imitating features, which could add an extra layer of authenticity to these tactic sites.

Filtering Trojans out of the Customer Waiting Line

Only some of Terdot's code is original, but its deriving partially from the Keylogger Zeus isn't an indication that its administrators are lax in their work ethic. Terdot's latest version has significant updates and includes features, such as memory-hooking, that can allow it to run in the background without alerting the user and hamper the detection attempts of standard security solutions. Although Terdot's MitM attacks intercept all network traffic, Terdot also shows a focus on specific website types, including e-mail services and social media (such as Gmail). However, the Trojan ignores any vulnerable data from the VK.com domain, raising some questions about the threat's possible links to Russian threat actors.

The EKs that install Terdot may be taking advantage of hosting on compromised advertising networks, hacked websites or corrupted websites that pretend to offer content such as TV shows or games. Since the SunDown Exploit Kit depends on preexisting vulnerabilities in your software, users can defend themselves by updating all programs promptly and having anti-malware products block these drive-by-downloads by default. Anti-malware solutions also should identify Trojan downloaders using fake PDF iconography or, in a post-infection situation, delete Terdot from within a secure environment, like Safe Mode.

Terdot is a Trojan that offers far more diversity to its data-thieving techniques than is possible with any 'real life' burglary or pickpocket attempt. When spyware includes tactics advanced sufficiently, your best strategy is preventing it from unloading them at all by stopping that first infection from happening.

03.31.20 Update

Old malware families often tend to resurface when their authors find a new way to propagate them reliably. Such is the case of Terdot, a banking Trojan that had seen little use in the past three years. The threat, also called Zloader or Zeus Sphinx, is once again being spread online. Its targets are likely to be users in Canada, the United States and Australia. The recipients may receive a phishing email that is titled 'COVID-19 Relief' – clearly, the authors of the Terdot have decided to piggyback on the popularity of the Coronavirus pandemic and try to profit out of it. The phishing email contains a compromised document that can execute a macro script meant to deploy and run a copy of Terdot.

Recipients of the email are told that they are entitled to compensation from the COVID-19 relief fun, and they have to fill in the attached form to confirm their request. Since millions of people are likely to experience financial difficulties because of the pandemic, it is not a surprise that the authors of the Terdot Trojan have adopted such a strategy to infect their targets. If the document attachment is opened, it may execute the macro script responsible for the initialization of Terdot.

This banking Trojan is able to keep track of active Web browser tabs, and it will check if the user is using an online banking portal that the Trojan supports regularly. If such an event occurs, the Trojan may alter the page so that it includes fake forms that submit data to the attackers – these forms may ask for personal and payment information that could be used to execute fraudulent transactions.

The 'COVID-19 Relief' phishing scam is not the only Coronavirus-themed fraud running online. The 'Get Corona Safety Mask' Scam is another con that cybercriminals use to propagate harmful applications.