As many as 30 US banking firms are expected to be targeted in a wave of cyber attacks as part of “a large-scale orchestrated crimeware campaign,” a security researcher says.

Mor Ahuvia of the security firm RSA said in a blog post this week that a “cyber gang” has communicated plans to launch a Trojan attack spree involving “bots” or automated control of infected computers.

“Planned for this fall, the blitzkrieg-like series of Trojan attacks is set to be carried out by approximately 100 botmasters,” he wrote. “RSA believes this is the making of the most substantial organized banking-Trojan operation seen to date.”

Ahuvia said the attackers plan to use malware called “Gozi Prinimalka,” which is a term derived from the Russian word meaning “to receive.”

“According to underground chatter, the gang plans to deploy the Trojan in an effort to complete fraudulent wire transfers via Man-In-The-Middle manual session-hijacking scenarios,” he said.

RSA said the gang claims that since 2008 their Trojan has been able to siphon $5 million from American bank accounts.

The new attacks, if successfully launched, may be felt by targeted banks in a month or two, RSA said.

“The spree’s longevity, in turn, will depend on how fast banks and their security teams implement countermeasures against the heretofore-secret banking-Trojan,” Ahuvia said.

The warning comes after several US banks appeared to be targeted by so-called denial of service attacks, which aim to bring down websites by flooding the networks with data requests.

US Bank acknowledged last week its website was the target of “attacks” aimed at disrupting its system but that customer data and financial information were not compromised.

PNC Bank, Wells Fargo and others experienced problems as well.

The problems arose after a group calling itself “Cyber fighters of Izz ad-din Al qassam” announced that three banks would be targeted for the second week of “Operation Ababil.”

The “cyber fighters” group said it launched attacks under the name “Operation Ababil,” meaning “Swarm,” against the websites of Bank of America and the New York Stock Exchange on September 18, and Chase on September 19.

[Image via Agence France-Presse]

Categories: Cyber Security