DanaBot, one of the most recent cyberthreats to hit the banking industry, has developed a way to avoid detection on virtual machines as it shifts focus from Australia to Poland.

The malware’s upgraded capabilities mean that DanaBot will not run its executable within a virtual machine (VM) environment, making it even more difficult to detect with basic security tools, according to research from IBM Trusteer.

DanaBot surfaced in May 2018, with initial attacks involving Australian financial institutions that fell for a bogus invoice issued from a legitimate, local accounting software firm called MYOB. Like other financial cyberthreats, DanaBot can steal access to user accounts and remotely control devices to commit fraud. The most recent activity, however, shows the banking Trojan is now being aimed at Polish banks and cryptocurrency exchange platforms.

Tracking DanaBot’s Evolution

Compared to Ramnit, TrickBot and other financial cyberthreats, DanaBot is still a relatively minor player. However, the anti-VM feature shows how quickly the malware is evolving into more sophisticated forms. Even before this adaptation, DanaBot was largely invisible to antivirus software, and researchers noted that more stealth updates are likely to come soon.

Perhaps more importantly, DanaBot is not a piece of privately owned code operated by a single group of cybercriminals. It is commercially available, which means the shift from Australia to Poland might be just the beginning if DanaBot draws interest from malicious actors targeting other parts of the world.

How to Fend Off Financial Cyberthreats

DanaBot uses malware spam to break into financial institutions, where employees may be too preoccupied to notice suspicious links or websites. There’s also a lot might not catch with the naked eye, including scripts, document object model data and other elements.

IBM experts suggest combining analytics with machine learning tools that can more readily detect phishing attempts, including image-based attacks that use screenshots of otherwise legitimate-looking bank websites coupled with online forms to steal usernames and passwords. As DanaBot rises through the ranks of financial cyberthreats, a cognitive approach to protecting endpoints is critical.