A new form of malware combines two previous banking trojans and is actively targeting US and Canadian banks. The GozNym trojan is a hybrid of two previous banking trojans, the Nymaim and Gozi ISFB trojans. Researchers at IBM X-Force discovered that the new hybrid trojan specifically targets business banking accounts. The new hybrid is responsible for millions of dollars in losses for 24 US and Canadian banks. 

According to the X-Force security team, the new hybrid takes the most effective elements from its two predecessors to create a powerful new threat. “From the Nymaim malware, it leverages the dropper’s stealth and persistence; the Gozi ISFB parts add the banking Trojan’s capabilities to facilitate fraud via infected Internet browsers. The end result is a new banking Trojan in the wild.”

The GozNym trojan typically infects user machines through an exploit kit deployed from a compromised or malicious website. An exploit kit is a malicious program which searches the user’s computer for known software vulnerabilities. Such vulnerabilities are typically the result of outdated or unpatched programs such as Adobe Flash, Microsoft Word, PDF readers or web browsers. If the user’s computer contains one or more of these vulnerabilities, the exploit kit infects it and then delivers the GozNym payload.

As mentioned earlier, the trojan is targeting financial institutions in the US and Canada, including business banking services, credit unions, Ecommerce platforms, and retail banking. According to The Register, the malware is responsible for about $4 million worth of damages.