Updated Danabot malware emerges after takedown

Months after being disrupted as part of the law enforcement effort Operation Endgame, the Danabot banking trojan has resurfaced with the new version 669, according to Cyber Security News.

Attackers have launched social engineering intrusions involving spear-phishing emails and illicit files to spread Danabot version 669, which launches multiple data harvesting, lateral network movement, and Windows-based payload delivery modules following execution, a report from Zscaler ThreatLabz showed.

Unlike previous iterations of the banking trojan, version 669 harnessed several standard IP-based command-and-control domains and .onion addresses to facilitate the delivery of other modules and configuration files, which enable further persistence and continuous execution.

The increased modularity integrated into Danabot version 669 has permitted remote payload management and infection parameter updating for its users, said researchers, who also noted that the updated trojan has also become more threatening due to its evolved tactics to circumvent detection.