⚠️ Overview

Hand of Thief is a Linux-based banking trojan first publicly documented in August 2013 by security firm Trusteer (acquired by IBM). It was sold on underground forums as a commercial malware-as-a-service (MaaS) offering, targeting users of online banking services on Linux desktops. Categorized as a form-grabbing trojan and information stealer, it was one of the first sophisticated Linux-focused banking trojans, exploiting the then-common belief that Linux was inherently immune to financial malware.

🔧 Technical Capabilities

Hand of Thief intercepts web traffic by hooking into browser processes, primarily Mozilla Firefox and Google Chrome, using LD_PRELOAD to inject malicious shared libraries. It performs man-in-the-browser (MitB) attacks via web injects (HTML/JavaScript overlay injections) to steal login credentials, CVV numbers, and one-time passwords in real time. The malware uses encrypted HTTP POST requests to a command-and-control (C2) server for exfiltration and updates, and it can disable security extensions like NoScript. Persistence is achieved through cron jobs or .bashrc modifications, and it employs anti-debugging techniques such as ptrace() detection and timing checks. Propagation is primarily through drive-by downloads or trojanized software packages; no self-spreading worm capability exists. According to MITRE ATT&CK, this aligns with techniques T1056.001 (Input Capture: Web Portal Capture) and T1573.001 (Encrypted Channel: Symmetric Cryptography).

📜 History & Notable Incidents

First appearing in underground forums in mid-2013, Hand of Thief gained notoriety when Trusteer published a detailed analysis in August 2013, highlighting its sophistication. It targeted Brazilian, US, and European banks but no large-scale campaigns or high-profile victims were publicly named. No specific CVEs were exploited; instead, it relied on social engineering and compromised websites. Law enforcement actions are not documented, likely due to its niche nature and limited distribution before the rise of Linux ransomware.

🔍 Detection Indicators

Known indicators include the use of the LD_PRELOAD environment variable pointing to a malicious .so file (e.g., libkeyutils.so), and persistence via cron entries such as "@reboot /usr/bin/.hidden.sh". Network indicators include HTTP POST requests to domains mimicking legitimate banking URLs with a distinctive User-Agent string "Mozilla/5.0 (X11; Linux x86_64) HandOfThief/1.0". File hashes are not widely published but behavioral signatures, such as unexpected browser process memory dumps or pop-up overlays, serve as detection heuristics. Mutex objects like "HOT_mutex" have been observed in older variants.

☠️ Risk & Impact

Hand of Thief poses a direct risk to Linux desktop users performing online banking, enabling theft of account credentials and financial data that can lead to unauthorized transactions and identity theft. Due to its targeted nature and limited distribution, financial losses are anecdotal rather than quantified in public reports. Affected sectors are primarily retail banking and personal finance; no industrial-scale impact was recorded.

🛡️ Mitigation

Mitigation includes running browsers in sandboxed environments or using application whitelisting to block unauthorized LD_PRELOAD injections. Endpoint detection and response (EDR) tools should monitor for suspicious environment variable changes and cron modifications. Users should enforce multi-factor authentication, keep browsers and plugins updated, and avoid installing software from untrusted sources. No specific patches exist; defense relies on good security hygiene.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.