A notorious hacker group known as MoneyTaker has stolen roughly $1 million from a Russian bank after breaching its network via an outdated router.
The victim of the hack is PIR Bank, which lost at least $920,000 in money it had stored in a corresponding account at the Bank of Russia.
Group-IB, a Russian cyber-security firm that was called in to investigate the incident, says that after studying infected workstations and servers at PIR Bank, they collected “irrefutable digital evidence implicating MoneyTaker in the theft.”
Group-IB are experts in MoneyTaker tactics because they unmasked the group’s existence and operations last December when they published a report on their past attacks.
Experts tied the group to thefts at US, UK, and Russian banks and financial institutions going back as far as 2016. According to Group-IB, the MoneyTaker attacks that hit banks were focused on infiltrating inter-banking money transfer and card processing systems such as the First Data STAR Network and the Automated Work Station Client of the Russian Central Bank (AWS CBR) system.
How the hack unfolded
This is what happened this time as well, according to Group-IB. Hackers infiltrated PIR Bank’s network at the end of May via an outdated router at one of the bank’s regional branches.
“The router had tunnels that allowed the attackers to gain direct access to the bank’s local network,” Group-IB experts said. “This technique is a characteristic of MoneyTaker. This scheme has already been used by this group at least three times while attacking banks with regional branch networks.”
Hackers then used the router to infect the bank’s local network with malware. They then used PowerShell scripts to gain persistence and carry out malicious operations without being detected.
When, finally, the hackers breached PIR Bank’s main network, they also gained access to its AWS CBR account, the system they needed to control financial transactions.
On July 3, MoneyTaker used this system to transfer funds from PIR Bank’s account at the Bank of Russia to 17 accounts they created in advance. Moments after the stolen funds landed in these accounts, money mules withdrew it from ATMs across Russia.
PIR Bank employees discovered the hack a day later, on July 4, but by that moment it was already too late to reverse transactions.
In typical MoneyTaker fashion, hackers tried clearing logs from infected computers in order to hide their tracks, but Group-IB said they found reverse shells the group used to access compromised computers.
Not the first MoneyTaker hack in Russia this year
“This is not the first successful attack on a Russian bank with money withdrawal since early 2018,” says Valeriy Baulin, Head of Digital Forensics Lab Group-IB. “We know of at least three similar incidents, but we cannot disclose any details before our investigations are completed.”
Group-IB says that at least two of these 2018 hacks of Russian banks have been carried out by the MoneyTaker group.
The group’s activities are very hard to track because they tend to use common OS utilities to perform malicious actions instead of relying on actual malware. They also clear logs and study each bank’s network and system in advance, even stealing documentation to understand with what they’re dealing with.
During its three-year lifespan, it is believed the group stole tens of millions from banks since they started their hacking spree back in 2016. Group-IB says the average losses are of $500,000 per incident in the US and around $1.2 million per incident in Russia.
Past MoneyTaker hacks include 15 US banks, a US services provider, a UK banking software company, 5 Russian banks, and one Russian law firm. Below is a chart of past MoneyTaker hacks, last updated December 2017.
Source:
https://www.bleepingcomputer.com/news/security/hackers-breach-russian-bank-and-steal-1-million-due-to-outdated-router/
Stay connected