{"id":106763,"date":"2017-12-20T07:53:18","date_gmt":"2017-12-20T05:53:18","guid":{"rendered":"http:\/\/www.myza.co.za\/group-ib-uncovers-hacker-group-moneytaker-targeting-banks-and-other-companies-around-the-world\/"},"modified":"2017-12-20T07:53:18","modified_gmt":"2017-12-20T05:53:18","slug":"group-ib-uncovers-hacker-group-moneytaker-targeting-banks-and-other-companies-around-the-world","status":"publish","type":"post","link":"https:\/\/www.myza.co.za\/press\/group-ib-uncovers-hacker-group-moneytaker-targeting-banks-and-other-companies-around-the-world\/","title":{"rendered":"Group-IB uncovers hacker group \u201cMoneyTaker\u201d targeting banks and other companies around the world"},"content":{"rendered":"

Group-IB uncovers hacker group \u201cMoneyTaker\u201d targeting banks and other companies around the world<\/a>: <\/p>\n

South Africa, Johannesburg, December 18, 2017 \u2013 Group-IB, the leading provider of intelligence-driven cyber-security, has released a report detailing the operations of a Russian-speaking targeted attack group dubbed by Group-IB as MoneyTaker.<\/p>\n

In less than two years, this group has conducted over 20 successful attacks on financial institutions and legal firms around the world. Although the group has been successful at targeting a number of banks in different countries, to date, they have gone unreported. By constantly changing their tools and tactics to bypass antivirus and traditional security solutions and most importantly carefully eliminating their traces after completing their operations, the group has largely gone unnoticed. The first attack that Group-IB attributes to this group was conducted in the US in May 2016 while the most recent attack took place in November 2017 in Russia.<\/p>\n

\u201cMoneyTaker uses publicly available tools, which makes the attribution and investigation process a non-trivial exercise,\u201d says Dmitry Volkov, Group-IB Co-Founder and Head of Intelligence. \u201cIn addition, incidents have occurred in different regions worldwide. Group-IB specialists expect new thefts in the near future and in order to reduce this risk, Group-IB would like to contribute our report identifying hacker tools, techniques as well as indicators of compromise we attribute to MoneyTaker operations\u201d.<\/p>\n

Using the Group-IB Threat Intelligence system, Group-IB researchers have discovered connections between all 20 incidents throughout 2016 and 2017. Connections were identified not only in the tools used, but also the distributed infrastructure, one-time-use components in the attack toolkit of the group and specific withdrawal schemes \u2013 using unique accounts for each transaction. Another distinct feature of this group is that they stick around after the event, continuing to spy on a number of impacted banks and sending corporate emails and other documents to Yandex and Mail.ru free email services in the first.last@yandex.com format.<\/p>\n

\u201cThis year we have witnessed an array of high profile cyber-attacks in the financial sector which has put a renewed emphasis on data protection and security. While cybercriminals continue to grow in sophistication, organizations are yet to strengthen their cybersecurity immune system. In addition, the increased adoption of new technologies in the region presents new security and data risks. At Group-IB, we are committed to protecting our clients from vulnerabilities by providing them with comprehensive threat intelligence and robust cybersecurity solutions,\u201d said Tarek Kuzbari, managing director for the Middle East, Turkey, Africa and South Asia at Group-IB.<\/p>\n

By analyzing the attack infrastructure, Group-IB identified that the group continuously exfiltrates internal banking documentation to learn about bank operations in preparation for future attacks. Exfiltrated documents include: admin guides, internal regulations and instructions, change request forms, transaction logs, etc. A number of incidents with copied documents that describe how to make transfers through SWIFT are being investigated by Group-IB.<\/p>\n

The group has primarily been targeting card processing systems where the attackers checked if they could connect to the card processing system after taking control over the bank\u2019s network. Following this, they legally opened or bought cards of the bank whose IT system they had hacked.<\/p>\n

Money mules \u2013 criminals who withdraw money from ATMs \u2013 with previously activated cards went abroad and waited for the operation to begin. After getting into the card processing system, the attackers removed or increased cash withdrawal limits for the cards held by the mules. They removed overdraft limits, which made it possible to overdraw even with debit cards. Using these cards, the mules withdrew cash from ATMs, one by one.<\/p>\n

In addition to banks, the MoneyTaker group has attacked law firms and also financial software vendors. An attack on an organization will cost organizations an average of $ 500,000.
Fulfilling our duty to constantly protect the world from cybercriminals, we will be organizing a webinar for our partners to know more about MoneyTaker on December 18th, 2017. If you are interested to join, please register your interest at this link.<\/p>\n

CLICK HERE to submit your press release to MyPR.co.za.<\/p>\n

Source:<\/strong> MyPR<\/a><\/small>
\n<\/p>\n

Submit your own Press Release<\/a> or get free content for your publication.<\/p>\n

Video – How to post your Press Release on MyPR:<\/strong>
\n