Win32:Citadel-K

Win32:Citadel-K is a variant of the infamous Citadel Trojan which is part of an ineffective email spam scam that uses fake email messages from Vodafone. However, the Win32:Citadel-K Trojan itself is derived from an extremely dangerous Trojan family that is based on the code for the Zeus Trojan family. This family of malware typically has backdoor capabilities and advanced keylogger abilities that allow these Trojans to steal information related to online banking and credit cards, including bank account numbers, passwords and other sensitive information. ESG malware analysts consider that the Win32:Citadel-K Trojan is a severe threat to your computer, even if the particular variant contained in the fake Vodafone email is nearly harmless due to poor implementation of this scam.

Malware belonging to Win32:Citadel-K's family of banking Trojans are acknowledged for containing some of the most advanced functions of the Zeus Trojan, such as capturing keystrokes, monitoring for activity on banking websites, and scanning files on the infected computer that may contain data associated with online passwords or credit card numbers. However, the Citadel Trojan family also includes additional updates that make Citadel Trojan more difficult to deal with and remove. This is because criminals have taken the code from the Zeus Trojan, updated it and packaged it in a form that allows them to sell it to other scammers while providing support and additional features. ESG security researchers have observed that variants of the Citadel Trojan (which include the Win32:Citadel-K Trojan) may contain one of the following attributes that are not appended in the Zeus family of malware:

• Win32:Citadel-K variants may allow this Trojan to attack particular web browsers more effectively. For example, ESG security researchers have observed that Citadel variants are more effective at attacking Google Chrome than basic Zeus Trojan variants.
• Win32:Citadel-K may also be particularly more effective than other variants at detecting and avoiding security software on the victim's computer.
• One curious aspect of Win32:Citadel-K variants is that the Citadel Trojan will often include components that prevent it from attacking computers with Ukrainian or Russian keyboards, making it likely that this Trojan is originally from these regions.

Win32:Citadel-K is typically distributed using email or social media spam. Because of this, one of the most effective ways of preventing Win32:Citadel-K attacks is to use a strong spam email filter to prevent these kinds of malicious email messages from reaching your inbox in the first place.