New clues have surfaced on how the Blackmoon banking Trojan is infecting its victims using a new framework to deliver the malware.
“We noticed recent campaigns (two weeks ago) where Blackmoon had shifted its infection strategy and is now utilizing a unique and interesting technique,” said Hardik Modi, vice president of threat research at Fidelis Cybersecurity in an interview with Threatpost.
Blackmoon, also known as KRBanker, is a banking Trojan designed to steal user credentials from various South Korean banking institutions. It was discovered in early 2014 and since then has adopted a variety of infection and credential stealing techniques.
