Experts warn of increase in Zeus attacks as source code spreads

The source code for the Zeus malware is in increasingly wide circulation, according to researchers at internet security firm Trusteer, and a new wave of attacks is expected soon.

Reports last month indicted that the creator of the Zeus malware had put the source code for the software up for sale with a $100,000 price tag.

However, Trusteer has seen multiple sellers offering the source code, and there are reports that it is also turning up on file sharing sites as a password-protected download.

"What we're seeing today is that the source code is leaking," Trusteer chief executive Mickey Boodaei told V3.co.uk.

"Zeus was contained in a single automated toolkit, which created all the variants we've seen so far. Now the source code is leaking we'll see more toolkits based around Zeus."

Boodaei said that, as the new toolkits start appearing, their users will unleash a host of new Zeus variants that will need to be identified and blocked.

However, he also feared that some criminals will keep the kits for highly targeted, small-scale attacks that are harder to identify and block.

Zeus first surfaced in 2007 and has been responsible for a number of high-profile infections among  government and businesses, and variants of the code have been spotted targeting BlackBerry handsets.

McAfee named Zeus as one of the top five exploits of the past decade in a recent report.

If the malware is integrated into more virus toolkits, a rise in the number of attacks is inevitable. The security industry is becoming increasingly concerned with the rise in use of such toolkits, which some estimates suggest are responsible for over 60 per cent of online attacks.

"You can see spikes in attacks after a new toolkit is released," said Mike Dausin, manager of advanced security intelligence at HP TippingPoint DVLabs. "We're seeing a huge expansion in the number, and capabilities, of malware toolkits."

Dausin explained that such toolkits allow malware writers to make significant amounts of money by offering ancillary services, such as firewall exploits and code obfuscation techniques.