Cybercrime Targets Bankers

From Anunak to GCMAN and Metel to Carbanak, it is increasingly clear that organized cybercrime groups are becoming greedier than ever, no longer interested in volume attacks on bank customers. Rather, financially motivated adversaries are investing in attacking the source of liquid cash: banks. To get into these secure environments, they target the organization’s people, its first line of defense.

While bank customers are still the target for botnet-based attacks, bankers have become the top targets for organized advanced persistent threat (APT) groups.

Is this new? Why is it becoming an issue now? This detrimental trend has seen a significant escalation in number and scope, warranting greater awareness and new measures to bolster defense from within the organization.

The financial APT trend has been growing since mid-2014, making the headlines when the Anunak group was discovered setting its sights on the financial industry. Unfortunately, awareness to this sort of threat did not generate the necessary lessons, and the financial sector saw the same attackers strike in the biggest cyberheist ever: the Carbanak case, discovered in early 2015. Four more cases have since materialized, including specialized APT groups such as Lazarus that make it their business to attack banks, among other targets.

Classic APT — With a Twist

How are these attacks carried out? Is there anything special about them?

In these classic APT schemes, attackers follow a familiar route, infecting the employees with malware and then moving inside the organization’s networks until they encounter their mark. The most coveted corporate network zones are those that grant access to internal payment gateways and internal banking systems. However, the goal is different: Instead of stealing data or intellectual property, attackers will alter the information in internal systems or exploit it to work in their favor.

While these adversaries may have the same motivation as other cybercriminals, they are far from being typical fraudsters. These are highly skilled attackers who can infiltrate systems with the help of both legitimate and malicious tools — but also without using any malware at all.

Once they are in, the average time from the moment of penetration into the core internal networks to actual theft of money is 42 days — at least, it was in 2014. Nowadays, with experience and motivation, the reconnaissance phase is becoming shorter, and so is the active phase of the attack.

These extremely targeted attacks rely on a focal entry point: employees. If you work at a bank or as part of your organization’s financial team, you are a top target for these groups and could end up as the person who inadvertently ushers them in.

Read the white paper: Accelerating growth and digital adoption with seamless identity trust