Zeus 2 botnet is spotted in the wild

INSECURITY FIRM Trusteer has found the first instance of the Zeus botnet version 2 out in the wild.

Earlier this week we said that this next version of the gittish botnet was still in beta and was only being trialed. However we might have spoken too soon as Trusteer reckons to have found what it calls a 'significant' instance.

Trusteer reckons that the botnet, which is operated and controlled from Eastern Europe, is after financial information in the UK, and has a massive zombie army of 100,000 infected computers as its footsoldiers - 98 per cent of which are in the UK.

Already Trusteer has been able to ascertain that the botnet is sniffing up things like credit and debit card numbers, banking website login IDs and passwords, bank statements, more passwords, FTP accounts and passwords, website and user certificates, Internet users' web cookies, the kitchen sink and did we mention passwords?

Mickey Boodaei, CEO of Trusteer said that the firm had been seeing Zeus 2.0 being used for about six months, but added that this was the first 'pure' one.

Boodaei said that his firm had been able to drill deep down into the botnet and discovered a user interface that lets the controllers do things like search for banks by name or snarf up mass collections of emails through a 'Google-like' interface.

He explained that the collection of information was very specific, and included the usual suspects such as logins and passwords. However, it is far more comprehensive than this and collects other things as well, like place of work and type of job.

"It's very focused," he added, "they are targeting the UK market, its financial institutions and its citizens." µ