Banking Trojans are popular in cybercriminal schemes given the valuable data and financial service credentials they can steal in successful cyberattacks.

Banks find themselves a constant target for relentless attacks against their apps and infrastructure. Their names, too, are abused by threat actors which use them in phishing campaigns and through copycat malicious domains designed to dupe customers into handing over their account credentials.

Banking Trojans are considered one of the top threats to the enterprise today. In 2018 alone, Kaspersky Lab recorded roughly 900,000 financial malware-based attacks against users in 2018 -- an increase of 16 percent in comparison to 767,000 attacks in the previous year.

The names of such malware may be familiar. Zeus, Redaman, BackSwap, Emotet, Gozi, and Ramnit are only some of the Trojan families which have gained prominence in the cybercriminal world, however, the operators of campaigns using banking Trojans are constantly cajoling for space and territory.

At least, this used to be the case. According to IBM's Global Executive Security Advisor Limor Kessem and the IBM X-Force cybersecurity team, the top banking malware operators are now working together to distribute their malware.

On Wednesday, Kessem revealed new research on the cooperative trend, which builds upon the financial malware trends discussed in the latest IBM X-Force Threat Intelligence Index.

Trickbot, Gozi, Ramnit, and IcedID were the most active banking Trojans in 2018, and while other forms of malware have grown in popularity, it is the most active -- and prevalent -- forms of financial malware which are now being spread through cybercriminal partnerships.

The cybersecurity researchers say that the list is "populated by organized cybercrime gangs that have ties to yet other cybercrime gangs, each doing its part to feed the perpetual supply chain of a digital financial crime economy."

"The banking Trojan arena is dominated by groups from the same part of the world and by people who know each other and collaborate to continue orchestrating high-volume wire fraud," Kessem added.

Trickbot is one of the major players in the financial Trojan space. The Russian cybercriminals behind the malware, who target banks and wealth firms managing high-value accounts, have recently diversified into ransomware as part of a wider botnet strategy and are now working with gang members from IcedID.

First discovered in 2017, IcedID uses web injection attacks to compromise online payment portals and also indulges in the typical bait-and-switch method for redirecting banking customers to malicious domains.

While this malware isn't particularly memorable as a banking Trojan, a recent shift in its deployment is. IcedID used to be dropped by the Emotet Trojan, but this changed to TrickBot in May 2018.

Three months later, it became clear that IcedID had also received a number of upgrades to perform more like TrickBot, including the reduction in the size of its binary file and plugins being fetched and loaded on demand, rather than being an intrinsic part of the Trojan's modules.

"Although malware authors do sometimes copy from one another, our research indicates these modifications were not coincidental," IBM says. "Even if we only looked at the fact that TrickBot and IcedID fetch one another into infected devices, that would be indication enough that these Trojans are operated by teams that work together."

See also: Facebook debuts AI tool to tackle revenge porn

IBM also speculates that a vague partnership between the two groups may have begun years ago, and potentially during the years when Dyre and Neverquest malware samples were making the rounds pre-2015. Trickbot is considered the protege of Dyre, whilst Neverquest vanished following the arrest of a member of the group behind it. IcedID came onto the scene soon after.

Gozi, too, is another key player in the banking malware industry and has been active for over a decade. First spotted in 2007, Gozi is constantly evolving and the leak of its source code in 2010 gave rise to a number of Trojans that are active today.

The malware is now in two major forms, v.2, and v.3, of which the former variant targets global players and the latter focuses on banks in Australia and New Zealand through macro-based malicious attachments sent via phishing campaigns.

In some countries, such as Japan, the operators of Gozi are collaborating with URLZone. This form of malware specializes in process hollowing and disguises itself as legitimate computing processes to lurk undetected on a victim's machine. 

In a 2018 campaign, URLZone dropped both the Cutwail botnet and Gozi, which together are able to enslave devices, create persistent backdoors, and steal data.

TechRepublic: How to prevent spear phishing attacks: 8 tips for your business

The operators of Ramnit, too, appear to find value in collaboration. Active since 2010, Ramnit started out using worm-like techniques to infect PCs, networks, and removable drives before evolving into a modular banking Trojan which is now spread through exploit kids including Angler and RIG.

Ramnit tends to focus on victims in the UK, Canada, and Japan, and in 2018, re-emerged after a law enforcement botnet takedown with a new partner in tow: Ngioweb, a multifunctional proxy server which uses multiple layers of encryption.

CNET: Facial recognition overkill: How deputies cracked a $12 shoplifting case

A 2018 campaign between the pair was able to infect approximately 100,000 devices in only two months. During the scheme, Ramnit went back to its worm-like roots and acted as a first-stage infection platform to create a proxy botnet for Ngioweb. 

IBM believes this partnership -- albeit a short-lived one -- was designed in the hopes of creating a botnet of a size comparable to the old Gameover Zeus botnet.

"While previous years saw gangs operate as adversaries, occupying different turfs, or even attack one another's malware, 2018 connects the major cybercrime gangs together in explicit collaboration," IBM says. "This trend is a negative sign to the joining of forces between botnet operators, revealing the resilience factor in these nefarious operations over time."

Previous and related coverage

Logo: Kaspersky Lab // Composition: ZDNet

Russian cyber-security firm Kaspersky Lab filed today an antitrust complaint against Apple with Russian authorities in regards to the OS maker's monopolistic grip over its official App Store.

Kaspersky claims that Apple used its power over the App Store and the entire iOS app ecosystem to force its engineers into removing two features from the Kaspersky Safe Kids iOS app --namely app control and Safari browser blocking.

The company argues that Apple did so to eliminate competition for the "Screen Time" feature that the OS maker added in iOS 12 in September last year.

Apple is sabotaging "Screen Time" competitors

In a blog post published today, Kaspersky said that other app makers like AdGuard and Kidslox also lost their abilities to restrict access to apps after interventions from Apple.

Furthermore, the Russian firm claims that Apple has embarked on what appears to be a concerted effort to crack down, remove, or reject any third-party screen time apps that may compete with built-in iOS features.

"By setting its own rules for that channel, [Apple] extends its power in the market over other, adjacent markets: for example, the parental control software market, where it has only just become a player," Kaspersky Lab said.

"It is precisely in this extension of its leverage through possession of so-called 'key capacity' over other segments, leading to restriction and elimination of competition, that we see the essential elements of antitrust law violation, which consist of erecting barriers and discriminating against our software," the antivirus maker added. "We have repeatedly tried to contact Apple to resolve this situation, but no meaningful negotiations have ensued."

Kaspersky lodged its complaint with the Federal Antimonopoly Service of Russia (FAS), and only in Russia, but not in the European Union.

The antivirus maker recognized Spotify's similar effort in the EU.

Last week, the music streaming service filed a similar antitrust complaint against Apple because of its strict control over the App Store. Spotify claimed that Apple had used unfair App Store taxes to suppress the growth of Spotify and other competitors for Apple's own music service --Apple Music.

Apple posted a blog post answering the Spotify complaint in the EU, but an Apple spokesperson did not return a request for comment in regards to Kaspersky's complaint today.

Kaspersky took on Microsoft and won

This is not the first time that Kaspersky Lab files antitrust complaints against a Silicon Valley tech giant. The company filed an antitrust complaint against Microsoft in Russia and the EU in November 2016.

The antivirus maker argued that Microsoft made it unfairly difficult for antivirus providers to compete following a major Windows 10 update.

Kaspersky dropped its complaints in August 2017 after reaching a common ground with Microsoft after the Redmond-based OS maker revised its antivirus and update policies.

More tech & cybersecurity coverage: