Neverquest Banking Trojan Expands List of Targets

Snifula telemetry data from Symantec

Recent variants of the malware analyzed by security researchers show that the cybercriminals operating the Neverquest banking Trojan have focused their attack on banks in the United States and Japan.

New telemetry results from Symantec inform that the largest number of infections since December 2013, have occurred in these two countries, accounting for more than half of the compromised computers.

The U.S. recorded 38.51% of the detections while in Japan the infection accounted for 18.21%. Next in line are Germany (11.48%) and United Kingdom (11.19%).

Identified by Symantec as Snifula, in 2014 the malware recorded a spike in Japan for the month of March.

Neverquest has been around for a long time, since 2006 and the cybercriminals kept improving its malicious components.

At the moment, it is capable to log keystrokes, grab screen captures and record video, control the infected machine through remote control software, as well as steal information using man-in-the-browser (MitB) technique.

Symantec also warns that it can steal digital certificates. Exfiltrating the information is done to command and control servers operated by the threat actors.

More details & screenshot here: http://news.softpedia.com/news/Neverquest-Banking-Trojan-Expands-List-of-Targets-451157.shtml