A new Hacker Group ‘MoneyTaker’ uncovered by Group-IB Attacking Banks in the USA and Russia

A new Hacker Group ‘MoneyTaker’ uncovered by Group-IB targetting financial institutions and law firms in the USA, UK, and Russia. They are very successful in targetting a number of banks in different countries and they remain anonymous.

Security researchers from Group-IB uncovered the operations and the Hacker Group found targetting mainly on card payments including the AWS CBR (Russian Interbank System) and purportedly SWIFT (US).

They remain anonymous by constantly changing their methods and tools to bypass security products and to remove their tracks after completing their attack.

Also Read: Top 5 hackers Groups that made the Invisible Internet as a Background

1.5 years of Silent Hacker Group Operations – MoneyTaker

They remain hidden for almost 1.5 years, their first operation was in 2016 and they targetted First Data’s “STAR” network operator portal.

According to Group-IB investigation, the group conducted 10 attacks in 2016, 6 attacks on US banks, 1 on UK banks and 2 On Russia Banks, another 1 attacks on US service provider. In 2017 8 US banks 1 law firm and 1 Russian bank targeted.

Using Group-IB Threat intelligence researchers able to identify the relationship between the incidents tools used and unique account for transactions and the most important findings with the privilege escalation tools compiled based on codes presented in ZeroNights 2016 Russian security conference.

Exfiltration by the group

They use to exfiltrate the internal bank documents such as admin guides, internal regulations to understand the bank architecture and to prepare for attacks.Group-IB provided details to Interpol and Europol for further investigation.

For launching attacks, they used they used their self-written as well as the borrowed tools, Screenshotter’ and ‘keylogger’ to capture desktop screenshots and keystrokes. MoneyTaker 5.0 which substitutes malicious program for auto replacement of payment data.

To ensure their persistence they used fileless malware which resides only in RAM memory and destroyed after the system reboot.

In Group-IB investigation “an incident in Russia, we managed to discover the initial point of compromise: hackers penetrated the bank’s internal network by gaining access to the home computer of the bank’s system administrator.”

In addition, to prevent the C&C communication they employ SSL certificates for MoneyTaker with famous brands Bank of America, Federal Reserve Bank, Microsoft, Yahoo, etc.

They legitimately opened or purchased cards from the bank whose IT framework they had hacked. Then they withdraw cash from ATMs – with already enacted cards traveled to another country and sat tight for the operation to start.

In the wake of getting into the card processing system, the assailants removed or increased money withdrawal limits for the cards held by the mules and the average loss will be $500,000 USD.