Cybercrime Targets Bankers

From Anunak to GCMAN and Metel to Carbanak, it is increasingly clear that organized cybercrime groups are becoming greedier than ever, no longer interested in volume attacks on bank customers. Rather, financially motivated adversaries are investing in attacking the source of liquid cash: banks. To get into these secure environments, they target the organization’s people, its first line of defense.

While bank customers are still the target for botnet-based attacks, bankers have become the top targets for organized advanced persistent threat (APT) groups.

Is this new? Why is it becoming an issue now? This detrimental trend has seen a significant escalation in number and scope, warranting greater awareness and new measures to bolster defense from within the organization.

The financial APT trend has been growing since mid-2014, making the headlines when the Anunak group was discovered setting its sights on the financial industry. Unfortunately, awareness to this sort of threat did not generate the necessary lessons, and the financial sector saw the same attackers strike in the biggest cyberheist ever: the Carbanak case, discovered in early 2015. Four more cases have since materialized, including specialized APT groups such as Lazarus that make it their business to attack banks, among other targets.

Classic APT — With a Twist

How are these attacks carried out? Is there anything special about them?

In these classic APT schemes, attackers follow a familiar route, infecting the employees with malware and then moving inside the organization’s networks until they encounter their mark. The most coveted corporate network zones are those that grant access to internal payment gateways and internal banking systems. However, the goal is different: Instead of stealing data or intellectual property, attackers will alter the information in internal systems or exploit it to work in their favor.

While these adversaries may have the same motivation as other cybercriminals, they are far from being typical fraudsters. These are highly skilled attackers who can infiltrate systems with the help of both legitimate and malicious tools — but also without using any malware at all.

Once they are in, the average time from the moment of penetration into the core internal networks to actual theft of money is 42 days — at least, it was in 2014. Nowadays, with experience and motivation, the reconnaissance phase is becoming shorter, and so is the active phase of the attack.

These extremely targeted attacks rely on a focal entry point: employees. If you work at a bank or as part of your organization’s financial team, you are a top target for these groups and could end up as the person who inadvertently ushers them in.

Read the white paper: Accelerating growth and digital adoption with seamless identity trust

More from Banking & Finance

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

New Fakext malware targets Latin American banks

6 min read - This article was made possible thanks to contributions from Itzhak Chimino, Michael Gal and Liran Tiebloom. Browser extensions have become integral to our online experience. From productivity tools to entertainment add-ons, these small software modules offer customized features to suit individual preferences. Unfortunately, extensions can prove useful to malicious actors as well. Capitalizing on the favorable characteristics of an add-on, an attacker can leverage attributes like persistence, seamless installation, elevated privileges and unencrypted data exposure to distribute and operate banking…

DORA and your quantum-safe cryptography migration

5 min read - Quantum computing is a new paradigm with the potential to tackle problems that classical computers cannot solve today. Unfortunately, this also introduces threats to the digital economy and particularly the financial sector.The Digital Operational Resilience Act (DORA) is a regulatory framework that introduces uniform requirements across the European Union (EU) to achieve a "high level of operational resilience" in the financial services sector. Entities covered by DORA — such as credit institutions, payment institutions, insurance undertakings, information and communication technology…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today