Friday, March 29, 2024

A new Hacker Group ‘MoneyTaker’ uncovered by Group-IB Attacking Banks in the USA and Russia

A new Hacker Group ‘MoneyTaker’ uncovered by Group-IB targetting financial institutions and law firms in the USA, UK, and Russia. They are very successful in targetting a number of banks in different countries and they remain anonymous.

Security researchers from Group-IB uncovered the operations and the Hacker Group found targetting mainly on card payments including the AWS CBR (Russian Interbank System) and purportedly SWIFT (US).

They remain anonymous by constantly changing their methods and tools to bypass security products and to remove their tracks after completing their attack.

Also Read: Top 5 hackers Groups that made the Invisible Internet as a Background

1.5 years of Silent Hacker Group Operations – MoneyTaker

They remain hidden for almost 1.5 years, their first operation was in 2016 and they targetted First Data’s “STAR” network operator portal.

According to Group-IB investigation, the group conducted 10 attacks in 2016, 6 attacks on US banks, 1 on UK banks and 2 On Russia Banks, another 1 attacks on US service provider. In 2017 8 US banks 1 law firm and 1 Russian bank targeted.

Using Group-IB Threat intelligence researchers able to identify the relationship between the incidents tools used and unique account for transactions and the most important findings with the privilege escalation tools compiled based on codes presented in ZeroNights 2016 Russian security conference.

Hacker Group

Exfiltration by the group

They use to exfiltrate the internal bank documents such as admin guides, internal regulations to understand the bank architecture and to prepare for attacks.Group-IB provided details to Interpol and Europol for further investigation.

For launching attacks, they used they used their self-written as well as the borrowed tools, Screenshotter’ and ‘keylogger’ to capture desktop screenshots and keystrokes. MoneyTaker 5.0 which substitutes malicious program for auto replacement of payment data.

To ensure their persistence they used fileless malware which resides only in RAM memory and destroyed after the system reboot.

In Group-IB investigation “an incident in Russia, we managed to discover the initial point of compromise: hackers penetrated the bank’s internal network by gaining access to the home computer of the bank’s system administrator.”

In addition, to prevent the C&C communication they employ SSL certificates for MoneyTaker with famous brands Bank of America, Federal Reserve Bank, Microsoft, Yahoo, etc.

They legitimately opened or purchased cards from the bank whose IT framework they had hacked. Then they withdraw cash from ATMs – with already enacted cards traveled to another country and sat tight for the operation to start.

In the wake of getting into the card processing system, the assailants removed or increased money withdrawal limits for the cards held by the mules and the average loss will be $500,000 USD.

Website

Latest articles

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles