Russian Hackers Steal $10M From Banks

A previously unknown ring of Russian-speaking hackers has stolen as much as $10 million from US and Russian banks in the last 18 months, according to a Moscow-based cyber-security firm that runs the largest computer forensics laboratory in eastern Europe.

The MoneyTaker group broke into 20 systems, which includes 15 US lenders, targeting ATMs with “mules” and Russia’s interbank money-transfer system, according to a report from Group-IB.

The hackers, who also breached a UK software and service provider, are now probing institutions in Latin America and may be trying to compromise the SWIFT international bank messaging service, according to the privately held security firm, whose clients range from Russia’s biggest lender Sberbank PJSC to Raiffeisen Bank International AG. Group-IB last month signed an agreement with Interpol to share data on threat intelligence and the latest cyber-criminal activities.

“Criminals have changed tactics and are now focusing on banks rather than their clients, as was standard operating procedure in the past,” Dmitry Volkov, the head of Group-IB’s cyber intelligence department, said by phone.
Russia, considered a hotbed of government-backed information attacks, increasingly finds itself a victim of cyber-crime. It was initially blamed for the Badrabbit ransomware virus that spread to more than 200 targets globally, even though some of the biggest disruptions affected Russian businesses.

Limited Resources
Since its first successful breach in May 2016, MoneyTaker has stolen from banks in New York, California, Utah and Moscow, primarily targeting smaller institutions with limited cyber defenses, Group-IB found. The average haul from US banks was about $500,000, and it stole over $3 million from three Russian lenders. “They understand that banks, especially community banks with limited resources, are the easiest marks,” Volkov said.

The cell remained undetected by using so-called fileless malware that only exists on a computer’s temporary memory and destroys itself when the system reboots, meaning it’s not permanently stored and therefore can more easily evade anti-virus programs, according to Group-IB.  At one bank, the hackers gained access to the network via the home computer of the lender’s system administrator.

Corkow Trojan
The attackers further covered their tracks with encryption certificates generated using brand names such as Bank of America Corp., Microsoft Corp. and the Federal Reserve, according to Group-IB, which previously uncovered Russian-speaking hacker cells behind the Corkow Trojan and Buhtrap.

SWIFT and Bank of America didn’t immediately respond to requests from Bloomberg. While hackers are transnational, many new types of attacks are discovered in Russia because it’s at the forefront of cyber security, a deputy head of the Russian central bank’s information security and protection department, Artem Sychev, said in an interview in November.

Group-IB said the US banks were targeted by gaining access to their card-processing system and then opening accounts at the compromised institutions. The attackers removed limits on the legitimate bank cards and used mules to withdraw cash from ATMs. The virus was so stealthy that, in at least one instance, a bank was successfully robbed twice.

While Group-IB didn’t uncover evidence of a successful attack on Swift by MoneyTaker, it found that the hackers were searching for documents related to the messaging system, which could indicate pending attacks. Last year, in one of the biggest heists in cyber-crime history, hackers used SWIFT to steal $81 million from Bangladesh.

“The more we dig, the more we’ll find,” Group-IB’s Volkov said. “This report doesn’t represent the full picture, and I can say with 100 percent certainty that there are more victims that haven’t been identified yet.”

Insurance Journal

You Might Also Read: 

Interpol/Group-IB Unmasking Pro-ISIS Hackers:

Bank Robbery: Cyber Criminals Steal $1Billion:

Bank Data Breaches Are Up And It's An Inside Job:

 

« Digital Risks Are Changing And CSOs Must Adapt
Get Into Gear On GDPR »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

Cifas

Cifas

Cifas are leaders in fraud prevention, working closely with UK law enforcement partners.

Mastercard

Mastercard

MasterCard is a leading global payments solutions company that serves consumers and businesses in over 210 countries and territories worldwide.

Lawley Insurance

Lawley Insurance

Lawley is a full-service, independent insurance agency. Specialty insurance products include Cyber Security.

Intezer Labs

Intezer Labs

The only solution replicating the concepts of the biological immune system into cyber-security. Intezer provides enterprises with unparalleled Threat Detection and accelerates Incident Response.

GreatHorn

GreatHorn

GreatHorn offers the only cloud-native security platform that stops targeted social engineering and phishing attacks on communication tools like O365, G Suite, and Slack.

7 Elements

7 Elements

7 Elements is an independent IT security testing company providing expertise in technical information assurance through security testing, incident response and consultancy.

Cybersecurity Competence Center (C3)

Cybersecurity Competence Center (C3)

The Cybersecurity Competence Center was created to further strengthen the Luxembourg economy in the field of cybersecurity.

International Data Sanitization Consortium (IDSC)

International Data Sanitization Consortium (IDSC)

IDSC is a group composed of individuals and companies dedicated to standardizing terminology and practices across the data sanitization industry.

archTIS

archTIS

archTIS specialises in the design and development of products, solutions and services for secure information sharing and collaboration.

NuID

NuID

NuID is a pioneer in trustless authentication and decentralized digital identity.

Communications & Information Technology Regulatory Authority (CITRA)

Communications & Information Technology Regulatory Authority (CITRA)

CITRA is responsible for overseeing the telecommunications sector, monitoring and protecting the interests of users and service providers, and regulating the services of telecomms networks in Kuwait.

Digital Silence

Digital Silence

Digital Silence is a world-class provider of information security research and consulting services.

InfoSec4TC

InfoSec4TC

InfoSec4tc is an online Information Security Courses, Training, and Consultancy provider.

Obrela Security Industries

Obrela Security Industries

Obrela provides security analytics and risk management services to identify, analyze, predict and prevent highly sophisticated security threats in real time.

VeriBOM

VeriBOM

VeriBOM is a SaaS security and compliance platform that helps protect you and your customers through automation, documentation, and transparency for every software application you build or run.

AppSOC

AppSOC

AppSOC is a leader in Application Security Posture Management (ASPM) and Code-to-Cloud Vulnerability Management.