The incident is the latest in a string of malware attacks against financial institutions over the past year. Together they signal a shift in focus for many cybercriminal groups, from stealing money from bank customers to stealing money directly from banks themselves.
According to researchers from Symantec, employees from different Russian banks received emails in December offering them employment at the Central Bank of Russia. The messages were sent from a domain that closely resembled that of the Russian Central Bank and contained a link to an archive file with a Trojan named Ratopak inside.
Ratopak opens a back door on infected computers and allows attackers to record keystrokes, retrieve clipboard data and remotely view the screen. It can also download and run other malicious files and tools.
The very narrow focus of the attacks and the fact that most of the affected computers were used for accounting, suggests that the hackers behind it were financially motivated, the Symantec researcher said in a blog post. “By using Ratopak, which can open a backdoor and log keystrokes, the attackers could position themselves to steal money, either by controlling the compromised computer or using the employees’ stolen login credentials.”
That’s reminiscent of other attacks against financial institutions, especially in Russia, but not only. Earlier this month, researchers from Kaspersky Lab reported on the activities of three groups that over the course of last year infected computers at 29 Russian banks with malware.
Those groups used highly targeted phishing, custom malware and advanced lateral movement techniques that were previously associated primarily with cyberespionage campaigns. Their goal was to steal money using subtle techniques after gaining a good understanding of banks’ internal systems and operational procedures.
The most proficient such group is known as Carbanak, named after its primary malware tool. According to security researchers, the group stole up to $1 billion from banks in at least 25 countries over the course of two years until it was unmasked in early 2015.
With more and more cybercriminal groups adopting this strategy, banks will need to pay closer attention to the security of their internal networks and employee training, in addition to that of their publicly facing websites that are used by customers.
