CSO — By 2003, online banking was not yet ubiquitous but everyone could see that, eventually, it would be. Everyone includes Internet criminals, who by then had already built software capable of surreptitiously grabbing personal information from online forms, like the ones used for online banking. The first of these so-called form-grabbing Trojans was called Berbew.

Berbew’s creator is believed to be a VXer, or malware developer, named Smash, who rose to prominence by co-founding the IAACA—International Association for the Advancement of Criminal Activity–after the Feds busted up ShadowCrew, Smash’s previous hacking group.

Berbew was wildly effective. Lance James, a researcher with Secure Science Corp., believes it operated undetected for as long as nine months and grabbed as much as 113GB of data—millions of personal credentials.

Like all exploits, Berbew was eventually detected and contained, but, as is customary with malware, strands of Berbew’s form-grabbing code were stitched into new Trojans that had adapted to defenses. The process is not unlike horticulturalists’ grafting pieces of one plant onto another in order to create hardier mums.

Thus, Berbew code reappeared in the Trojan A311-Death, and A311- Death in turn begat a pervasive lineage of malware called the Haxdoor family, authored by Corpse, who many believe was part of a well-known, successful hacking group called the HangUp Team, based in the port city of Archangelsk, Russia, where the Dvina River empties into the White Sea, near the Arctic Circle.

By 2006, online banking was ubiquitous and form-grabbers had been refined into remarkably efficient, multi-purpose bots. Corpse himself was peddling a sophisticated Haxdoor derivative called Nuclear Grabber for as much as $3,200 per copy. Nordea Bank in Sweden lost 8 million kronor ($1.1 million) because of it.

But by last October, despite his success, Corpse decided that it was time to lay low. A message appeared on a discussion board at pinch3.net, a site that sold yet another Haxdoor relative called pinch.

“Corpse does cease development spyware? news not new, but many do not know” reads a post by “sash” translated using Babelfish. It then quotes Corpse: “I declare about the official curtailment of my activity of that connected with troyanami [trojans]”

This past January, a reporter for Computer Sweden chatted with Corpse, pretending to be a potential customer. Corpse tried to sell him Nuclear Grabber for $3,000 and crowed that banks sweep 99 percent of online fraud cases under the rug. After Computerworld Australia published the chat, Corpse disappeared. He hasn’t been heard from since.

But his form-grabbing code resurfaced, when a friend of Don Jackson asked him to look at a file he found on his computer, as a favor.

That file led Jackson behind the curtain to find hacking with a level of sophistication he’d never seen before.

Next: Gozi and the hacking service economy.

Continue Reading