View source for Carberp: it’s not over yet

{{Publication
|Image=Carberp it s not over yet.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.securelist.com/en/blog/694/Carberp_its_not_over_yet securelist.com
|Author=Vyacheslav Zakorzhevsky, 
|NomRevue=Securelist
|Date=March 26, 14:59
|Editor=Kaspersky lab
|Year=2012
|ISBN=
|Page=
|Abstract=On 20 March, Russian law enforcement agencies announced the arrest of a cybercriminal gang involved in stealing money using the Carberp Trojan. This is very good news, but unfortunately does not mark the end of the Carberp story.

Evidently, those arrested were just one of the criminal gangs using the Trojan. At the same time, those who actually developed Carberp are still at large, openly selling the Trojan on cybercriminal forums.

Here is a recent offer for the ‘multifunctional bankbot’, which appeared on 21 March:

 


A post advertising the sale of Carberp

There are still numerous ‘affiliate programs’ involved in the distribution of Carberp, particularly “traffbiz.ru”.

We detected a new Carberp distribution incident on 21 March. Infection was initiated at radio-moswar.ru, a website devoted to the MosWar online browser game.
|Botnet=Carberp, 
|Malware=, 
|CCProtocol=, 
|Operation=Carberp (opération), 
|Keyword=, 
}}