Organized Cybercrime’s New Bull’s-eye: Bankers

Cybercrime Targets Bankers

From Anunak to GCMAN and Metel to Carbanak, it is increasingly clear that organized cybercrime groups are becoming greedier than ever, no longer interested in volume attacks on bank customers. Rather, financially motivated adversaries are investing in attacking the source of liquid cash: banks. To get into these secure environments, they target the organization’s people, its first line of defense.

While bank customers are still the target for botnet-based attacks, bankers have become the top targets for organized advanced persistent threat (APT) groups.

Is this new? Why is it becoming an issue now? This detrimental trend has seen a significant escalation in number and scope, warranting greater awareness and new measures to bolster defense from within the organization.

The financial APT trend has been growing since mid-2014, making the headlines when the Anunak group was discovered setting its sights on the financial industry. Unfortunately, awareness to this sort of threat did not generate the necessary lessons, and the financial sector saw the same attackers strike in the biggest cyberheist ever: the Carbanak case, discovered in early 2015. Four more cases have since materialized, including specialized APT groups such as Lazarus that make it their business to attack banks, among other targets.

Read the white paper: Fraud protection doesn’t have to be an uphill battle

Classic APT — With a Twist

How are these attacks carried out? Is there anything special about them?

In these classic APT schemes, attackers follow a familiar route, infecting the employees with malware and then moving inside the organization’s networks until they encounter their mark. The most coveted corporate network zones are those that grant access to internal payment gateways and internal banking systems. However, the goal is different: Instead of stealing data or intellectual property, attackers will alter the information in internal systems or exploit it to work in their favor.

While these adversaries may have the same motivation as other cybercriminals, they are far from being typical fraudsters. These are highly skilled attackers who can infiltrate systems with the help of both legitimate and malicious tools — but also without using any malware at all.

Once they are in, the average time from the moment of penetration into the core internal networks to actual theft of money is 42 days — at least, it was in 2014. Nowadays, with experience and motivation, the reconnaissance phase is becoming shorter, and so is the active phase of the attack.

These extremely targeted attacks rely on a focal entry point: employees. If you work at a bank or as part of your organization’s financial team, you are a top target for these groups and could end up as the person who inadvertently ushers them in.

Watch our on-demand webinar learn about the tactics of advanced APT groups that target bank and finance department employees. The session will also provide an update on banking Trojans and groups that target your organization and its top customers, allowing you to come away informed and prepared.

Share this Article:
Limor Kessem

Executive Security Advisor, IBM

Limor Kessem is one of the top cyber intelligence experts at IBM Security. She is a seasoned security advocate, public speaker, and a regular blogger on the cutting-edge IBM Security Intelligence blog. Limor comes to IBM from organizations like RSA Security, where she spent 5 years as part of the RSA research labs and drove the FraudAction blog on RSA's Speaking of Security. She also served as the Marketing Director of Big Data analytics startup ThetaRay, where she created the company's cybersecurity thought leadership. Limor is considered an authority on emerging cybercrime threats. She participated as a highly appreciated speaker on live InfraGard New York webcasts (an FBI collaboration), spoke in RSA events worldwide, conducts live webinars on all things fraud and cybercrime, and writes a large variety of threat intelligence  publications. With her unique position at the intersection of multiple research teams at IBM, and her fingers on the pulse of current day threats, Limor covers the full spectrum of trends affecting consumers, corporations, and the industry as a whole. On the social side, Limor tweets security items as @iCyberFighter and is an avid Brazilian Jiu Jitsu fighter.