Anonymous supporters find themselves victims of Zeus Trojan Horse

The hacktivist group Anonymous has taken on an increasingly more public profile over the past few months as the list of websites they’ve been able to infiltrate and deface is long and far ranging. From the US DOJ to the UFC website, Anonymous has proven quite adept at breaking into whatever they set their eyes on.

But recently, members of the group had the tables turned around on them when many found themselves on the receiving end of a an outside hacker, a role reversal if there ever was one.

In late January, the slowloris tool Anonymous members use to carry out DDoS attacks was injected with the Zeus Trojan which subsequently compromised the PCs of Anonymous members and shuttled web credentials and bank information of affected machines back to a command and control server.

This of course all transpired in the wake of the raid on Megaupload, which prompted Anonymous to recommend the software tool to its users as it proceeded to launch DDos attacks on the FBI, the RIAA and a slew of other entities. But the software Anonymous directed its users to download had been compromised.

Security firm Symantec reports how the operation, so to speak, was carried out:

The deception of Anonymous supporters began on January 20, 2012, the day of the FBI Megaupload raid. An attacker took a popular PasteBin guide, used by Anonymous members for downloading and using the DoS tool Slowloris, and modified it. In this modified version, the attacker changed the download link to a Trojanized version of the Slowloris tool with matching text.

The modified version of the software still carried out its DDos attacks while also capturing a user’s web credentials, banking information, and cookies. What’s more, once the trojan was installed, the infected slowloris tool was replaced with the real thing, thereby covering up its existence.

The infected version of slowloris has since been removed but not without inflicting a bit of damage in the process.