Ramnit / ZeuS Hybrid Compromises 45000 Facebook Accounts: What You Should Know
23.05.12
Following the release of the ZeuS botnet source code, though, malware developers borrowed from the ZeuS playbook to modify Ramnit. The resulting merger is a worm that has the scope and propagation of Ramnit, combined with the financial data-stealing talents of ZeuS.
Bill Morrow, executive chairman for Quarri Technologies , explains that the original Ramnit variants were thought to be spread via compromised USB thumb drives. The new variant, however, is spreading through Facebook using stolen credentials.
Seculert speculates that the attackers may be exploiting poor security practices to compromise more than just Facebook. It says, “Cybercriminals are taking advantage of the fact that users tend to use the same password in various web-based services (Facebook, Gmail, Corporate SSL VPN, Outlook Web Access, etc.) to gain remote access to corporate networks.”
There are basically two things you can do to prevent becoming a victim of this latest Ramnit variant. First, think twice about clicking on links from your Facebook contacts. Actually, think twice about clicking on any links or opening any file attachments from any contacts on any social networks or Web-based services. You should be especially skeptical if a contact you barely communicate with sends you an obscure link out of the blue.
Source: PCWorld (blog)