Viruses/Worms News

Ilomo/Clampi botnet active in identity theft, steals bank website logins

Tuesday, August 25, 2009

PCs infected by a Trojan malware known as Clampi now form a botnet of zombie computers that web security researchers at Trend Micro have dubbed Ilomo. This botnet is active in identity theft and provides anonymity services for cybercriminals.

The Ilomo botnet has been active for several years but has managed to evade serious scrutiny from the web security industry. The Clampi Trojan has spread to hundreds of thousands of PCs and swipes personal information from users when they visit any of 4,000 banking websites for draining their bank accounts.

Like the Pushdo botnet, one of the most prolific at sending out spam, "the Ilomo threat is quite modular in nature, which makes it difficult to see the actions of the overall threat," Trend Micro said on its malware blog.

Ilomo also steals all other login credentials from infected PCs, which it uses to spread itself across networks and to take control of web servers online, where it will host new versions of the malware, Trend Micro said.

Cybercriminals have also been renting out the botnet as an anonymity service, so that criminals can hide their illegal activities by using different networks in different countries.