Cybercrime Targets Bankers

From Anunak to GCMAN and Metel to Carbanak, it is increasingly clear that organized cybercrime groups are becoming greedier than ever, no longer interested in volume attacks on bank customers. Rather, financially motivated adversaries are investing in attacking the source of liquid cash: banks. To get into these secure environments, they target the organization’s people, its first line of defense.

While bank customers are still the target for botnet-based attacks, bankers have become the top targets for organized advanced persistent threat (APT) groups.

Is this new? Why is it becoming an issue now? This detrimental trend has seen a significant escalation in number and scope, warranting greater awareness and new measures to bolster defense from within the organization.

The financial APT trend has been growing since mid-2014, making the headlines when the Anunak group was discovered setting its sights on the financial industry. Unfortunately, awareness to this sort of threat did not generate the necessary lessons, and the financial sector saw the same attackers strike in the biggest cyberheist ever: the Carbanak case, discovered in early 2015. Four more cases have since materialized, including specialized APT groups such as Lazarus that make it their business to attack banks, among other targets.

Classic APT — With a Twist

How are these attacks carried out? Is there anything special about them?

In these classic APT schemes, attackers follow a familiar route, infecting the employees with malware and then moving inside the organization’s networks until they encounter their mark. The most coveted corporate network zones are those that grant access to internal payment gateways and internal banking systems. However, the goal is different: Instead of stealing data or intellectual property, attackers will alter the information in internal systems or exploit it to work in their favor.

While these adversaries may have the same motivation as other cybercriminals, they are far from being typical fraudsters. These are highly skilled attackers who can infiltrate systems with the help of both legitimate and malicious tools — but also without using any malware at all.

Once they are in, the average time from the moment of penetration into the core internal networks to actual theft of money is 42 days — at least, it was in 2014. Nowadays, with experience and motivation, the reconnaissance phase is becoming shorter, and so is the active phase of the attack.

These extremely targeted attacks rely on a focal entry point: employees. If you work at a bank or as part of your organization’s financial team, you are a top target for these groups and could end up as the person who inadvertently ushers them in.

Read the white paper: Accelerating growth and digital adoption with seamless identity trust

More from Advanced Threats

Black Hat 2022 Sneak Peek: How to Build a Threat Hunting Program

You may recall my previous blog post about how our X-Force veteran threat hunter Neil Wyler (a.k.a “Grifter”) discovered nation-state attackers exfiltrating unencrypted, personally identifiable information (PII) from a company’s network, unbeknownst to the security team. The post highlighted why threat hunting should be a baseline activity in any environment. Before you can embark on a threat hunting exercise, however, it’s important to understand how to build, implement and mature a repeatable, internal threat hunting program. What are the components…

Top-Ranking Banking Trojan Ramnit Out to Steal Payment Card Data

Shopping online is an increasingly popular endeavor, and it has accelerated since the COVID-19 pandemic. Online sales during the 2021 holiday season rose nearly 9% to a record $204.5 billion. Mastercard says that shopping jumped 8.5% this year compared to 2020 and 61.4% compared to pre-pandemic levels. Cyber criminals are not missing this trend. The Ramnit Trojan, in particular, is out for a shopping spree that’s designed to take over people’s online accounts and steal their payment card data. IBM…

Detections That Can Help You Identify Ransomware

One of the benefits of being part of a global research-driven incident response firm like X-Force Incidence Response (IR) is that the team has the ability to take a step back and analyze incidents, identifying trends and commonalities that span geographies, industries and affiliations. Leveraging that access and knowledge against the ransomware threat has revealed tools, techniques and procedures that can often be detected through the default Windows event logs (WELs). In particular, the X-Force IR team has identified several…

How to Report Scam Calls and Phishing Attacks

With incidents such as the Colonial Pipeline infection and the Kaseya supply chain attack making so many headlines these days, it can be easy to forget that malicious actors are still preying on individual users. They're not using ransomware to do that so much anymore, though. Not since the rise of big game hunting, anyway. This term marks ransomware actors' shift away from attacks against individual users and towards operations targeting large enterprises, noted CNBC. But attacks like phishing and…