Menu
Latest attack against Russian bank employees highlights the threat to financial institutions

Latest attack against Russian bank employees highlights the threat to financial institutions

Cybercriminal groups increasingly attempt to break into banks' computer networks to steal funds

The employees of at least six Russian banks were recently the target of a well-crafted email attack where hackers masqueraded as the Russian Central Bank to trick them into installing malware.

The incident is the latest in a string of malware attacks against financial institutions over the past year. Together they signal a shift in focus for many cybercriminal groups, from stealing money from bank customers to stealing money directly from banks themselves.

According to researchers from Symantec, employees from different Russian banks received emails in December offering them employment at the Central Bank of Russia. The messages were sent from a domain that closely resembled that of the Russian Central Bank and contained a link to an archive file with a Trojan named Ratopak inside.

Ratopak opens a back door on infected computers and allows attackers to record keystrokes, retrieve clipboard data and remotely view the screen. It can also download and run other malicious files and tools.

The very narrow focus of the attacks and the fact that most of the affected computers were used for accounting, suggests that the hackers behind it were financially motivated, the Symantec researcher said in a blog post. "By using Ratopak, which can open a backdoor and log keystrokes, the attackers could position themselves to steal money, either by controlling the compromised computer or using the employees’ stolen login credentials."

That's reminiscent of other attacks against financial institutions, especially in Russia, but not only. Earlier this month, researchers from Kaspersky Lab reported on the activities of three groups that over the course of last year infected computers at 29 Russian banks with malware.

Those groups used highly targeted phishing, custom malware and advanced lateral movement techniques that were previously associated primarily with cyberespionage campaigns. Their goal was to steal money using subtle techniques after gaining a good understanding of banks' internal systems and operational procedures.

The most proficient such group is known as Carbanak, named after its primary malware tool. According to security researchers, the group stole up to $1 billion from banks in at least 25 countries over the course of two years until it was unmasked in early 2015.

With more and more cybercriminal groups adopting this strategy, banks will need to pay closer attention to the security of their internal networks and employee training, in addition to that of their publicly facing websites that are used by customers.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Reseller News launches inaugural Hall of Fame lunch

Reseller News launches inaugural Hall of Fame lunch

Reseller News welcomed 2015 and 2016 inductees - Darryl Swann, Dave Rosenberg, Gary Bigwood, Keith Watson, Mike Hill and Scott Green - to the inaugural Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed how the channel can collectively work together to benefit New Zealand, the Kiwi skills shortage and the future of the industry. Photos by Maria Stefina.

Reseller News launches inaugural Hall of Fame lunch
Educating from the epicentre - Why distributors are the pulse checkers of the channel

Educating from the epicentre - Why distributors are the pulse checkers of the channel

​As the channel changes and industry voices deepen, the need for clarity and insight heightens. Market misconceptions talk of an “under pressure” distribution space, with competitors in that fateful “race for relevance” across New Zealand. Amidst the cliched assumptions however, distribution is once again showing its strength, as a force to be listened to, rather than questioned. Traditionally, the role was born out of a need for vendors and resellers to find one another, acting as a bridge between the testing lab and the marketplace. Yet despite new technologies and business approaches shaking the channel to its very core, distributors remain tied to the epicentre - providing the voice of reason amidst a seismic industry shift. In looking across both sides of the vendor and partner fences, the middle concept of the three-tier chain remains centrally placed to understand the metrics of two differing worlds, as the continual pulse checkers of the local channel. This exclusive Reseller News Roundtable, in association with Dicker Data and rhipe, examined the pivotal role of distribution in understanding the health of the channel, educating from the epicentre as the market transforms at a rapid rate.

Educating from the epicentre - Why distributors are the pulse checkers of the channel
Kiwi channel reunites as After Hours kicks off 2017

Kiwi channel reunites as After Hours kicks off 2017

After Hours made a welcome return to the channel social calendar last night, with a bumper crowd of distributors, vendors and resellers descending on The Jefferson in Auckland to kickstart 2017. Photos by Maria Stefina.

Kiwi channel reunites as After Hours kicks off 2017
Show Comments