Cybercrime group steals millions from Russian banks, targets US and European retailers

The group compromised computer networks and ATMs operated by financial institutions, as well as point-of-sale terminals

A sophisticated group of cybercriminals has stolen over US$25 million by hacking into the infrastructure of numerous financial institutions in Russia and former Soviet Union countries, as well as into point-of-sale systems belonging to U.S. and European retailers.

Researchers from Russian cybercrime investigations firm Group-IB and Dutch security firm Fox-IT have dubbed the cybercriminal group Anunak, after the primary malware program in its toolset.

Unlike most cybercrime operations where attackers target the customers of financial institutions, the Anunak group targeted the institutions themselves, compromising their internal networks, workstations and servers. This access allowed them to transfer funds to accounts under their control and in some cases even to compromise ATMs, which they then used to withdraw money fraudulently.

"Since 2013 they have successfully gained access to networks of more than 50 Russian banks and 5 payment systems, and 2 of these institutions were deprived of their banking license," Group-IB said in a report released Monday. "To date the total amount of theft is over 1 billion rubles (about 25 million dollars), most of it has been stolen in the second half of 2014."

The Anunak attackers start by infecting the computers of regular employees with malware and then move laterally inside the network by compromising servers and active domain accounts. The group uses network scanners, keyloggers, password crackers, SSH backdoors, remote control programs and often the Metasploit penetration testing framework.

However, their primary tool is a computer Trojan dubbed Anunak, based on Carberp, a malware program designed to steal online banking credentials and whose source code was leaked online in June 2013. The Group-IB researchers believe that some members of the Anunak group were previously members of the Carberp gang which split up in 2013 following internal conflicts.

The attackers use several methods to infect computers with the Anunak Trojan. These include drive-by downloads through exploit kits (the group is believed to have injected malicious code in the site in 2013 to attack its visitors), spoofed emails with malicious attachments that claim to be sent by the Central Bank of the Russian Federation and installation through other malware programs as part of pay-per-install agreements.

"The criminal group keeps in touch with several owners of large botnets that massively distribute their malware," the Group-IB researchers said. "The attackers buy from these botnet owners the information about IP addresses of computers where the botnet owners have installed malware and then check whether the IP addresses belong to financial and government institutions. If the malware is in the subnet of interest, the attackers pay the large botnet owner for installation of their target malware."

Starting in the second quarter of 2014, the Anunak group also targeted retailers in the U.S., Australia and Europe with the goal of infecting point-of-sale (POS) terminals with malware that can steal payment card data during transactions.

At least 16 possible breaches have been identified at retail organizations -- 12 of them in the U.S. -- and theft of credit card data was confirmed in three of those cases, the researchers said in their report. The group also compromised computers at three U.S.-based PR and media organizations, possibly with the intention of obtaining trading advantages on the stock market, they said.

"We have no evidence of compromises against banks in Western Europe or United States, but it should be noted that the attackers methods could be utilized against banks outside of Russia as well," the researchers warned.

Join the CSO newsletter!

Error: Please check your email address.

Tags Group-IBFox-ITsecuritydata breachspywaremalwarefraud

More about APTSSH

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place