Menu
Latest attack against Russian bank employees highlights the threat to financial institutions

Latest attack against Russian bank employees highlights the threat to financial institutions

Cybercriminal groups increasingly attempt to break into banks' computer networks to steal funds

The employees of at least six Russian banks were recently the target of a well-crafted email attack where hackers masqueraded as the Russian Central Bank to trick them into installing malware.

The incident is the latest in a string of malware attacks against financial institutions over the past year. Together they signal a shift in focus for many cybercriminal groups, from stealing money from bank customers to stealing money directly from banks themselves.

According to researchers from Symantec, employees from different Russian banks received emails in December offering them employment at the Central Bank of Russia. The messages were sent from a domain that closely resembled that of the Russian Central Bank and contained a link to an archive file with a Trojan named Ratopak inside.

Ratopak opens a back door on infected computers and allows attackers to record keystrokes, retrieve clipboard data and remotely view the screen. It can also download and run other malicious files and tools.

The very narrow focus of the attacks and the fact that most of the affected computers were used for accounting, suggests that the hackers behind it were financially motivated, the Symantec researcher said in a blog post. "By using Ratopak, which can open a backdoor and log keystrokes, the attackers could position themselves to steal money, either by controlling the compromised computer or using the employees’ stolen login credentials."

That's reminiscent of other attacks against financial institutions, especially in Russia, but not only. Earlier this month, researchers from Kaspersky Lab reported on the activities of three groups that over the course of last year infected computers at 29 Russian banks with malware.

Those groups used highly targeted phishing, custom malware and advanced lateral movement techniques that were previously associated primarily with cyberespionage campaigns. Their goal was to steal money using subtle techniques after gaining a good understanding of banks' internal systems and operational procedures.

The most proficient such group is known as Carbanak, named after its primary malware tool. According to security researchers, the group stole up to $1 billion from banks in at least 25 countries over the course of two years until it was unmasked in early 2015.

With more and more cybercriminal groups adopting this strategy, banks will need to pay closer attention to the security of their internal networks and employee training, in addition to that of their publicly facing websites that are used by customers.

Subscribe here for up-to-date channel news

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards

Revealed at a glitzy bash in Sydney at the Ivy Penthouse, the first StorageCraft Partner Awards locally saw the vendor honour its top-performing partners with ASI Solutions, SMBiT Pro, Webroot, ACA Pacific and Soft Solutions New Zealand taking home the top awards. Photos by Maria Stefina.

StorageCraft celebrates high achievers at its inaugural A/NZ Partner Awards
Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip

​Synnex and Lenovo hosted 18 resellers for an action-packed weekend adventure in RotoVegas, taking in white water rafting on the Kaituna River, as well as quad biking and dinner at Stratosfare​, overlooking Lake Rotorua at the top of Mount Ngongotaha​. Photos by Synnex.

Kiwi resellers make a splash on Synnex and Lenovo RotoVegas road trip
Show Comments