Menu
Latest attack against Russian bank employees highlights the threat to financial institutions

Latest attack against Russian bank employees highlights the threat to financial institutions

Cybercriminal groups increasingly attempt to break into banks' computer networks to steal funds

The employees of at least six Russian banks were recently the target of a well-crafted email attack where hackers masqueraded as the Russian Central Bank to trick them into installing malware.

The incident is the latest in a string of malware attacks against financial institutions over the past year. Together they signal a shift in focus for many cybercriminal groups, from stealing money from bank customers to stealing money directly from banks themselves.

According to researchers from Symantec, employees from different Russian banks received emails in December offering them employment at the Central Bank of Russia. The messages were sent from a domain that closely resembled that of the Russian Central Bank and contained a link to an archive file with a Trojan named Ratopak inside.

Ratopak opens a back door on infected computers and allows attackers to record keystrokes, retrieve clipboard data and remotely view the screen. It can also download and run other malicious files and tools.

The very narrow focus of the attacks and the fact that most of the affected computers were used for accounting, suggests that the hackers behind it were financially motivated, the Symantec researcher said in a blog post. "By using Ratopak, which can open a backdoor and log keystrokes, the attackers could position themselves to steal money, either by controlling the compromised computer or using the employees’ stolen login credentials."

That's reminiscent of other attacks against financial institutions, especially in Russia, but not only. Earlier this month, researchers from Kaspersky Lab reported on the activities of three groups that over the course of last year infected computers at 29 Russian banks with malware.

Those groups used highly targeted phishing, custom malware and advanced lateral movement techniques that were previously associated primarily with cyberespionage campaigns. Their goal was to steal money using subtle techniques after gaining a good understanding of banks' internal systems and operational procedures.

The most proficient such group is known as Carbanak, named after its primary malware tool. According to security researchers, the group stole up to $1 billion from banks in at least 25 countries over the course of two years until it was unmasked in early 2015.

With more and more cybercriminal groups adopting this strategy, banks will need to pay closer attention to the security of their internal networks and employee training, in addition to that of their publicly facing websites that are used by customers.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

Ingram Micro completed its nationwide roadshow in Auckland last month, kicking off its Innovation Hour series with Hewlett Packard Enterprise. Uncovering the latest in storage, networking and servers, the event outlined key market trends for resellers in 2016 and beyond.

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise
IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

FireEye welcomed 143 channel partners and distributors to FireEye's 2016 annual Partner Conference, FireEye A/NZ Momentum - held at Establishment in Sydney. Delegates heard from senior trans-Tasman channel leaders, marketing and the product divisions in the morning, with FireEye customers, incident responders and threat intelligence analysts sharing knowledge during the afternoon.

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference
Show Comments