Group-IB uncovers hacker group “MoneyTaker” targeting banks and other companies around the world:
South Africa, Johannesburg, December 18, 2017 – Group-IB, the leading provider of intelligence-driven cyber-security, has released a report detailing the operations of a Russian-speaking targeted attack group dubbed by Group-IB as MoneyTaker.
In less than two years, this group has conducted over 20 successful attacks on financial institutions and legal firms around the world. Although the group has been successful at targeting a number of banks in different countries, to date, they have gone unreported. By constantly changing their tools and tactics to bypass antivirus and traditional security solutions and most importantly carefully eliminating their traces after completing their operations, the group has largely gone unnoticed. The first attack that Group-IB attributes to this group was conducted in the US in May 2016 while the most recent attack took place in November 2017 in Russia.
“MoneyTaker uses publicly available tools, which makes the attribution and investigation process a non-trivial exercise,” says Dmitry Volkov, Group-IB Co-Founder and Head of Intelligence. “In addition, incidents have occurred in different regions worldwide. Group-IB specialists expect new thefts in the near future and in order to reduce this risk, Group-IB would like to contribute our report identifying hacker tools, techniques as well as indicators of compromise we attribute to MoneyTaker operations”.
Using the Group-IB Threat Intelligence system, Group-IB researchers have discovered connections between all 20 incidents throughout 2016 and 2017. Connections were identified not only in the tools used, but also the distributed infrastructure, one-time-use components in the attack toolkit of the group and specific withdrawal schemes – using unique accounts for each transaction. Another distinct feature of this group is that they stick around after the event, continuing to spy on a number of impacted banks and sending corporate emails and other documents to Yandex and Mail.ru free email services in the first.last@yandex.com format.
“This year we have witnessed an array of high profile cyber-attacks in the financial sector which has put a renewed emphasis on data protection and security. While cybercriminals continue to grow in sophistication, organizations are yet to strengthen their cybersecurity immune system. In addition, the increased adoption of new technologies in the region presents new security and data risks. At Group-IB, we are committed to protecting our clients from vulnerabilities by providing them with comprehensive threat intelligence and robust cybersecurity solutions,” said Tarek Kuzbari, managing director for the Middle East, Turkey, Africa and South Asia at Group-IB.
By analyzing the attack infrastructure, Group-IB identified that the group continuously exfiltrates internal banking documentation to learn about bank operations in preparation for future attacks. Exfiltrated documents include: admin guides, internal regulations and instructions, change request forms, transaction logs, etc. A number of incidents with copied documents that describe how to make transfers through SWIFT are being investigated by Group-IB.
The group has primarily been targeting card processing systems where the attackers checked if they could connect to the card processing system after taking control over the bank’s network. Following this, they legally opened or bought cards of the bank whose IT system they had hacked.
Money mules – criminals who withdraw money from ATMs – with previously activated cards went abroad and waited for the operation to begin. After getting into the card processing system, the attackers removed or increased cash withdrawal limits for the cards held by the mules. They removed overdraft limits, which made it possible to overdraw even with debit cards. Using these cards, the mules withdrew cash from ATMs, one by one.
In addition to banks, the MoneyTaker group has attacked law firms and also financial software vendors. An attack on an organization will cost organizations an average of $ 500,000.
Fulfilling our duty to constantly protect the world from cybercriminals, we will be organizing a webinar for our partners to know more about MoneyTaker on December 18th, 2017. If you are interested to join, please register your interest at this link.
CLICK HERE to submit your press release to MyPR.co.za.
Source: MyPR
Submit your own Press Release or get free content for your publication.
Video – How to post your Press Release on MyPR:
My Press Release (MyPR) provides free South African targeted content and press releases for on and off line publishers and media. Registering on MyPR enables public relations companies and practitioners to post articles under their own author name. Public Relations Companies and practitioners, event organisers, sports and political writers use MyPR as a distribution mechanism for their press releases, content, images and news. A forever free subscription allows publishers and media free access to all press releases, content and images on MyPR.
This press release is courtesy of WP Robot plugin – CLICK HERE to learn more about WP Robot for WordPress – a massive time and money saver.
