Cybercrime group steals millions from Russian banks, targets US and European retailers

The group compromised computer networks and ATMs operated by financial institutions, as well as point-of-sale terminals

A sophisticated group of cybercriminals has stolen over US$25 million by hacking into the infrastructure of numerous financial institutions in Russia and former Soviet Union countries, as well as into point-of-sale systems belonging to U.S. and European retailers.

Researchers from Russian cybercrime investigations firm Group-IB and Dutch security firm Fox-IT have dubbed the cybercriminal group Anunak, after the primary malware program in its toolset.

Unlike most cybercrime operations where attackers target the customers of financial institutions, the Anunak group targeted the institutions themselves, compromising their internal networks, workstations and servers. This access allowed them to transfer funds to accounts under their control and in some cases even to compromise ATMs, which they then used to withdraw money fraudulently.

"Since 2013 they have successfully gained access to networks of more than 50 Russian banks and 5 payment systems, and 2 of these institutions were deprived of their banking license," Group-IB said in a report released Monday. "To date the total amount of theft is over 1 billion rubles (about 25 million dollars), most of it has been stolen in the second half of 2014."

The Anunak attackers start by infecting the computers of regular employees with malware and then move laterally inside the network by compromising servers and active domain accounts. The group uses network scanners, keyloggers, password crackers, SSH backdoors, remote control programs and often the Metasploit penetration testing framework.

However, their primary tool is a computer Trojan dubbed Anunak, based on Carberp, a malware program designed to steal online banking credentials and whose source code was leaked online in June 2013. The Group-IB researchers believe that some members of the Anunak group were previously members of the Carberp gang which split up in 2013 following internal conflicts.

The attackers use several methods to infect computers with the Anunak Trojan. These include drive-by downloads through exploit kits (the group is believed to have injected malicious code in the php.net site in 2013 to attack its visitors), spoofed emails with malicious attachments that claim to be sent by the Central Bank of the Russian Federation and installation through other malware programs as part of pay-per-install agreements.

"The criminal group keeps in touch with several owners of large botnets that massively distribute their malware," the Group-IB researchers said. "The attackers buy from these botnet owners the information about IP addresses of computers where the botnet owners have installed malware and then check whether the IP addresses belong to financial and government institutions. If the malware is in the subnet of interest, the attackers pay the large botnet owner for installation of their target malware."

Starting in the second quarter of 2014, the Anunak group also targeted retailers in the U.S., Australia and Europe with the goal of infecting point-of-sale (POS) terminals with malware that can steal payment card data during transactions.

At least 16 possible breaches have been identified at retail organizations -- 12 of them in the U.S. -- and theft of credit card data was confirmed in three of those cases, the researchers said in their report. The group also compromised computers at three U.S.-based PR and media organizations, possibly with the intention of obtaining trading advantages on the stock market, they said.

"We have no evidence of compromises against banks in Western Europe or United States, but it should be noted that the attackers methods could be utilized against banks outside of Russia as well," the researchers warned.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags fraudmalwarespywareFox-ITGroup-IB

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?