Researchers are warning that the group behind Necurs, one of the most venerable malware spamming operations, has added functions to its toolkit to gain new insight into its victims.

Necurs is a botnet, a vast network of hacked computers used in this case to email malware to new victims. The malware includes TrickBot, which is designed to steal banking credentials, and Locky, a form of ransomware. Researchers at Symantec announced Tuesday that in addition to its recent updates to Locky and TrickBot, the Necurs group added some updates to the program used to download Locky and TrickBot onto new systems.