Menu
Latest attack against Russian bank employees highlights the threat to financial institutions

Latest attack against Russian bank employees highlights the threat to financial institutions

Cybercriminal groups increasingly attempt to break into banks' computer networks to steal funds

The employees of at least six Russian banks were recently the target of a well-crafted email attack where hackers masqueraded as the Russian Central Bank to trick them into installing malware.

The incident is the latest in a string of malware attacks against financial institutions over the past year. Together they signal a shift in focus for many cybercriminal groups, from stealing money from bank customers to stealing money directly from banks themselves.

According to researchers from Symantec, employees from different Russian banks received emails in December offering them employment at the Central Bank of Russia. The messages were sent from a domain that closely resembled that of the Russian Central Bank and contained a link to an archive file with a Trojan named Ratopak inside.

Ratopak opens a back door on infected computers and allows attackers to record keystrokes, retrieve clipboard data and remotely view the screen. It can also download and run other malicious files and tools.

The very narrow focus of the attacks and the fact that most of the affected computers were used for accounting, suggests that the hackers behind it were financially motivated, the Symantec researcher said in a blog post. "By using Ratopak, which can open a backdoor and log keystrokes, the attackers could position themselves to steal money, either by controlling the compromised computer or using the employees’ stolen login credentials."

That's reminiscent of other attacks against financial institutions, especially in Russia, but not only. Earlier this month, researchers from Kaspersky Lab reported on the activities of three groups that over the course of last year infected computers at 29 Russian banks with malware.

Those groups used highly targeted phishing, custom malware and advanced lateral movement techniques that were previously associated primarily with cyberespionage campaigns. Their goal was to steal money using subtle techniques after gaining a good understanding of banks' internal systems and operational procedures.

The most proficient such group is known as Carbanak, named after its primary malware tool. According to security researchers, the group stole up to $1 billion from banks in at least 25 countries over the course of two years until it was unmasked in early 2015.

With more and more cybercriminal groups adopting this strategy, banks will need to pay closer attention to the security of their internal networks and employee training, in addition to that of their publicly facing websites that are used by customers.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments