14 DAY TRIAL // Threat-intel experts from Heimdal Security and the CSIS Security Group have uncovered a new banking trojan called Scylex, currently advertised on Dark Web hacking forums, but not yet seen in real-world attacks.
According to the crooks' advertisement - embedded in full at the end of this article - the group is marketing their product as a totally new, 99 percent original banking trojan.
In the past years, most banking trojans that have appeared have used the source code leaked from the Zeus project and filled the market with unoriginal and almost identical clones.
Scylex price starts at $7,500
The criminal group is leveraging this Zeus market fatigue to push a new product, which has a better chance of evading antivirus detection than any of the Zeus clones.
The group is selling their new cyber-crime kit for a basic price of $7,500. This includes a rootkit, modules to steal data from Web forms, the ability to inject new content into a Web page, a SOCKS5 reverse proxy, the capability to work via slow Internet connections, and capacity to work without administrator privileges on the infected machine.
If the buyer chooses to pay $2,000 more, then they'll receive full SOCKS5 support, allowing them to exfiltrate data to their own server via a SOCKS5 proxy.
There is also a separate Premium package that, for $10,000, offers support for HNVC (Hidden Virtual Network Computing), a complex feature that allows the crook to create virtual desktops, where they can carry out all sorts of malicious operations.
New deadly features are in the works
Furthermore, the group is hinting at upcoming features that include support for the Edge and Opera browsers, a powerful "Spreader" module to help with the trojan's distribution, support for reverse FTP, and an ATS engine to carry out transactions inside hijacked banking accounts.
The Scylex crew is also working on a DDoS and click-bot module, just in case the people using the trojan might need this functionality as well, to diversify their profits.
As criminal groups purchase this new threat and start distributing it, we'll likely hear more details about its mode of operation in the near future. Below is the full Scylex ad.