GozNym malware is proficient in German, new malicious campaign proves

August 23, 2016

Thirteen German financial institutions and their subsidiaries are probably feeling weltschmerz (look it up) after their customers became targets of the latest campaign from hybrid downloader and banking malware GozNym.

According to an IBM X-Force blog post, GozNym was found launching redirection attacks against infected German banking customers, tricking them into giving away their credentials by sending them to malicious websites that impersonate legitimate banking sites. The X-Force team noted that the redirection schemes "come in addition to web injection-based attacks for all the targeted brands."

Following redirect campaigns against Poland and U.S., the blog continued, GozNym's operators "already have three distinct geographies under attack – in three different languages and in countries that have different banking systems."

IBM X-Force has also reported that GozNym activity so far in August has been 3,550 percent greater than last month, and 526 percent greater than the total number of attacks from GozNym's April debut through July.

An In-Depth Guide to Network Security

Get essential knowledge and practical strategies to fortify your network security.

Learn More

Bradley Barth

As director of multimedia content strategy at CyberRisk Alliance, Bradley Barth develops content for online conferences, webcasts, podcasts video/multimedia projects — often serving as moderator or host. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Cyber security concept. Toy horse on a digital screen, symbolizes the attack of the Trojan virus. 3D illustration.

Malware

Trojanized images leveraged in separate malware campaigns

SC StaffJanuary 17, 2025

Both campaigns involved the distribution of malicious emails purporting to be invoices, purchase orders, or quotation requests with attachments, which when opened triggers a PowerShell script fetching the trojanized image and executing a .NET-based loader to launch the payloads.