Zeus Trojan resurfaces

The Zeus Trojan was originally designed to steal banking data

Security vendor Websense is warning of a renewed spate of global attacks aimed at stealing information from staff in government and military departments via the notorious Zbot, or Zeus, Trojan.

The malware was originally designed to steal banking data, but was used in a campaign targeting government workers in the US and UK at the beginning of the month.

This follow up attack involves a fake email purporting to be from a reputable figure within the CIA with the subject line: 'Russian spear phishing attack against .mil and .gov employees.'

"The spoofed emails capitalise on the last Zeus attack, and claim that installing the 'Windows update' via the links provided will aid protection against Zeus attacks," said Websense in a security alert.

"The binary file downloaded from these links is identified as a Zeus bot and holds a 35 per cent anti-virus detection rate. Once again URLs in the email messages lead to a malicious file hosted on a compromised host, and also on a popular file hosting service."

Websense explained that, after the Zeus rootkit component is installed, the command and control server is contacted to download an encrypted configuration file.

Another data stealing component gets downloaded and installed from the same server, and the bot then starts to connect with a credential-based FTP server to upload stolen data.