Tuesday, June 25, 2024

A new Hacker Group ‘MoneyTaker’ uncovered by Group-IB Attacking Banks in the USA and Russia

A new Hacker Group ‘MoneyTaker’ uncovered by Group-IB targetting financial institutions and law firms in the USA, UK, and Russia. They are very successful in targetting a number of banks in different countries and they remain anonymous.

Security researchers from Group-IB uncovered the operations and the Hacker Group found targetting mainly on card payments including the AWS CBR (Russian Interbank System) and purportedly SWIFT (US).

They remain anonymous by constantly changing their methods and tools to bypass security products and to remove their tracks after completing their attack.

Also Read: Top 5 hackers Groups that made the Invisible Internet as a Background

1.5 years of Silent Hacker Group Operations – MoneyTaker

They remain hidden for almost 1.5 years, their first operation was in 2016 and they targetted First Data’s “STAR” network operator portal.

According to Group-IB investigation, the group conducted 10 attacks in 2016, 6 attacks on US banks, 1 on UK banks and 2 On Russia Banks, another 1 attacks on US service provider. In 2017 8 US banks 1 law firm and 1 Russian bank targeted.

Using Group-IB Threat intelligence researchers able to identify the relationship between the incidents tools used and unique account for transactions and the most important findings with the privilege escalation tools compiled based on codes presented in ZeroNights 2016 Russian security conference.

Hacker Group

Exfiltration by the group

They use to exfiltrate the internal bank documents such as admin guides, internal regulations to understand the bank architecture and to prepare for attacks.Group-IB provided details to Interpol and Europol for further investigation.

For launching attacks, they used they used their self-written as well as the borrowed tools, Screenshotter’ and ‘keylogger’ to capture desktop screenshots and keystrokes. MoneyTaker 5.0 which substitutes malicious program for auto replacement of payment data.

To ensure their persistence they used fileless malware which resides only in RAM memory and destroyed after the system reboot.

In Group-IB investigation “an incident in Russia, we managed to discover the initial point of compromise: hackers penetrated the bank’s internal network by gaining access to the home computer of the bank’s system administrator.”

In addition, to prevent the C&C communication they employ SSL certificates for MoneyTaker with famous brands Bank of America, Federal Reserve Bank, Microsoft, Yahoo, etc.

They legitimately opened or purchased cards from the bank whose IT framework they had hacked. Then they withdraw cash from ATMs – with already enacted cards traveled to another country and sat tight for the operation to start.

In the wake of getting into the card processing system, the assailants removed or increased money withdrawal limits for the cards held by the mules and the average loss will be $500,000 USD.


Latest articles

Threat Actor Claiming a 0-day in Linux LPE Via GRUB bootloader

A new threat actor has emerged, claiming a zero-day vulnerability in the Linux GRUB...

LockBit Ransomware Group Claims Hack of US Federal Reserve

The notorious LockBit ransomware group has claimed responsibility for hacking the U.S. Federal Reserve,...

Microsoft Power BI Vulnerability Let Attackers Access Organizations Sensitive Data

A vulnerability in Microsoft Power BI allows unauthorized users to access sensitive data underlying...

Consulting Companies to Pay $11 Million Failing Cybersecurity Requirements

Two consulting companies, Guidehouse Inc. and Nan McKay and Associates, have agreed to pay...

New RAT Malware SneakyChef & SugarGhost Attack Windows Systems

Talos Intelligence has uncovered a sophisticated cyber campaign attributed to the threat actor SneakyChef....

Chinese Winnti Group Intensifies Financially Motivated Attacks

Hackers are increasingly executing financially motivated attacks and all due to the lucrative potential...

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from Promokit.eu for...

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles