Clampi latest Trojan to gain momentum in Windows world

Clampi latest Trojan to gain momentum in Windows world

Conficker news might be dying out there but a new Trojan is now making headlines.

Clampi targets Windows machines and is designed to steal credentials from infected systems.

Security experts believe that it has already started attacking innocent victims.

Incidentally, it is not a new threat. It is known since 2007.

SecureWorks representative Joe Stewart: “In recent months, Clampi has successfully spread across Microsoft networks in a worm-like fashion.”

He added: “Clampi’s recent success in infecting victims is accomplished by using domain-administrator credentials — either stolen by the Trojan or reused, or by virtue of the fact that a domain administrator has logged into an already infected system. Once domain-administrator privileges are granted, the Trojan uses the SysInternals tool psexec to copy itself to all computers on the domain. Clampi also serves as a proxy server used by criminals to anonymize their activity when logging into stolen accounts.”

It is also known by other names like Ligats, Ilomo and Rscan.