Whatever else is said about malware authors, it’s becoming clearer and clearer of late that they are learning from their mistakes and adapting to new defensive tactics at an increasingly rapid rate. The latest example of this is a recently discovered version of the Carberp malware, which now includes a new encryption scheme and improved administrative capabilities.
Carberp is a somewhat obscure piece of malware–at least relative to media darlings such as Zeus and Clampi. But the authors behind Carberp have been tweaking and refining the capabilities of the malware in recent months, and a new version of the Trojan has appeared that makes it more difficult for users to defend against it. The original version of Carberp was just a typical Trojan designed to steal users’ sensitive data, such as online banking credentials or usernames and passwords for other high-value sites. All of the traffic sent back to the command-and-control server was in the clear. Simple and straightforward.
But as the malware’s creators learned what worked and what didn’t, they adjusted their tactics, according to an analysis by researchers at Seculert. The next iteration of Carberp boasted a couple of plug-ins, one that removed anti-malware software and another that would attempt to kill other pieces of malware found on an infected PC.
But the really interesting adjustments appeared in the most recent version of Carberp, which Seculert’s researchers came upon in recent days. The newest release includes the ability to encrypt all of the traffic between infected machines and the C&C server.
Carberp is mainly spreading in Russia right now, but many of the more successful banker Trojans and information-stealing pieces of malware targeted one specific country and then went on to spread in other countries over time. Don’t be surprised to see a similar evolution from Carberp.