Cybercrime group steals millions from Russian banks, targets US and European retailers

The group compromised computer networks and ATMs operated by financial institutions, as well as point-of-sale terminals

A sophisticated group of cybercriminals has stolen over US$25 million by hacking into the infrastructure of numerous financial institutions in Russia and former Soviet Union countries, as well as into point-of-sale systems belonging to U.S. and European retailers.

Researchers from Russian cybercrime investigations firm Group-IB and Dutch security firm Fox-IT have dubbed the cybercriminal group Anunak, after the primary malware program in its toolset.

Unlike most cybercrime operations where attackers target the customers of financial institutions, the Anunak group targeted the institutions themselves, compromising their internal networks, workstations and servers. This access allowed them to transfer funds to accounts under their control and in some cases even to compromise ATMs, which they then used to withdraw money fraudulently.

"Since 2013 they have successfully gained access to networks of more than 50 Russian banks and 5 payment systems, and 2 of these institutions were deprived of their banking license," Group-IB said in a report released Monday. "To date the total amount of theft is over 1 billion rubles (about 25 million dollars), most of it has been stolen in the second half of 2014."

The Anunak attackers start by infecting the computers of regular employees with malware and then move laterally inside the network by compromising servers and active domain accounts. The group uses network scanners, keyloggers, password crackers, SSH backdoors, remote control programs and often the Metasploit penetration testing framework.

However, their primary tool is a computer Trojan dubbed Anunak, based on Carberp, a malware program designed to steal online banking credentials and whose source code was leaked online in June 2013. The Group-IB researchers believe that some members of the Anunak group were previously members of the Carberp gang which split up in 2013 following internal conflicts.

The attackers use several methods to infect computers with the Anunak Trojan. These include drive-by downloads through exploit kits (the group is believed to have injected malicious code in the php.net site in 2013 to attack its visitors), spoofed emails with malicious attachments that claim to be sent by the Central Bank of the Russian Federation and installation through other malware programs as part of pay-per-install agreements.

"The criminal group keeps in touch with several owners of large botnets that massively distribute their malware," the Group-IB researchers said. "The attackers buy from these botnet owners the information about IP addresses of computers where the botnet owners have installed malware and then check whether the IP addresses belong to financial and government institutions. If the malware is in the subnet of interest, the attackers pay the large botnet owner for installation of their target malware."

Starting in the second quarter of 2014, the Anunak group also targeted retailers in the U.S., Australia and Europe with the goal of infecting point-of-sale (POS) terminals with malware that can steal payment card data during transactions.

At least 16 possible breaches have been identified at retail organizations -- 12 of them in the U.S. -- and theft of credit card data was confirmed in three of those cases, the researchers said in their report. The group also compromised computers at three U.S.-based PR and media organizations, possibly with the intention of obtaining trading advantages on the stock market, they said.

"We have no evidence of compromises against banks in Western Europe or United States, but it should be noted that the attackers methods could be utilized against banks outside of Russia as well," the researchers warned.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Group-IBFox-ITsecuritydata breachspywaremalwarefraud

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?