Spy virus targeting Lebanese bank customers: security firm

Byblos Bank headquarters in Beirut, Lebanon. (The Daily Star)

BEIRUT/BOSTON: A new cyber surveillance virus is apparently targeting Lebanese and Arab bank accounts as well as email and social networking activity, according to leading computer security firm Kaspersky Lab.

Dubbed Gauss, the virus may also be capable of attacking critical infrastructure and was built in the same laboratories as Stuxnet, the computer worm widely believed to have been used by the United States and Israel to attack Iran’s nuclear program, Kaspersky Lab said Thursday.

Analysis of Gauss shows it was designed to steal data from several Lebanese banks including the Bank of Beirut, EBLF, BLOM Bank, Byblos Bank, Fransabank and Credit Libanais. In addition, it targets users of Citibank and PayPal.

The virus is apparently aimed at uncovering any suspicious financial transactions, perhaps to try to determine whether Hezbollah is using these banks to launder money.

The highest number of infections has been recorded in Lebanon, with more than 1,600 computers affected.

A banker told The Daily Star Lebanese banks always upgrade their computer and security system to protect transactions and customers account.

“Let them search as much as they want. They will find out sooner or later that Lebanese banks are clean and are not involved in any money laundering,” the banker said on condition of anonymity.

Lebanese banks have long brushed off accusations that they are involved in money laundering, stressing that they fully comply with strict banking regulations that require careful supervision of accounts.

Lebanon is one of the few countries in the world with banking secrecy, and Central Bank Governor Riad Salameh has said on many occasions that he will continue to uphold this secrecy.

Another leading banker told The Daily Star that the Association of Banks in Lebanon has held many meetings to discuss financial matters, but the issue of a virus targeting lenders or bank customers was never raised.

“This is the first time I hear about such a virus. I can’t say anything at moment because we have no information of such a virus,” the banker said

He added that it was too early to talk about countermeasures.

The Gauss code contains direct commands to intercept data required to work with Lebanese banks.

Kaspersky Lab said it found Gauss had infected 1,660 computers in Lebanon, 483 in Israel and 261 in the Palestinian Territories. It declined to speculate on who was behind the virus but said it was related to Stuxnet and two other cyber espionage tools, Flame and Duqu.

“After looking at Stuxnet, Duqu and Flame, we can say with a high degree of certainty that Gauss comes from the same ‘factory’ or ‘factories,’” Kaspersky Lab said in a posting on its website. “All these attack toolkits represent the high end of nation-state-sponsored cyber-espionage and cyber war operations.”

Kaspersky Lab’s findings are likely to fuel a growing international debate over the development and use of cyber weapons. Those discussions were stirred up by the discovery of Flame in May by Kaspersky and others. Washington has declined comment on whether it was behind Stuxnet.

According to Kaspersky Lab, Gauss can steal Internet browser passwords and other data, send information about system configurations, steal credentials for accessing banking systems in the Middle East, and hijack login information for social networking sites, email and instant messaging accounts.

Modules in the Gauss virus have internal names that Kaspersky Lab researchers believe were chosen to pay homage to famous mathematicians and philosophers, including Johann Carl Friedrich Gauss, Kurt Godel and Joseph-Louis Lagrange.

Kaspersky Lab said it called the virus Gauss because that was the name of the most important module, which implements its data-stealing capabilities.

A version of this article appeared in the print edition of The Daily Star on August 10, 2012, on page 1.




Your feedback is important to us!

We invite all our readers to share with us their views and comments about this article.

Disclaimer: Comments submitted by third parties on this site are the sole responsibility of the individual(s) whose content is submitted. The Daily Star accepts no responsibility for the content of comment(s), including, without limitation, any error, omission or inaccuracy therein. Please note that your email address will NOT appear on the site.

Alert: If you are facing problems with posting comments, please note that you must verify your email with Disqus prior to posting a comment. follow this link to make sure your account meets the requirements. (

comments powered by Disqus



Interested in knowing more about this story?

Click here