Attacks/Breaches

3/26/2018
04:55 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Leader of Cybercrime APT Behind $1.2 Billion in Bank Heists Arrested

The Carbanak group has caused more financial losses to financial institutions than any other cybercrime group since it surfaced in 2013.

In a big victory for international law enforcement, Spanish police have arrested the alleged leader of Carbanak, a cybercrime group believed responsible for stealing over $1.2 billion from more than 100 banks in 40 countries.

The question now is whether the arrest will completely stop the group — one of the most financially destructive ever — or merely disrupt its operations in the short term.

"Much like traditional organized crime, the serpent has many heads so when one is caught even at the upper echelon, there are many more eager and willing to take that person's place," says Brian Hussey vice president of cyber detection and response at Trustwave.

He predicts a short pause in the group's day-to-day operations, but not much more. "A billion-dollar hacking operation is just too lucrative to be completely reliant on a single person." 

Europol announced the arrest of the alleged Carbanak ringleader on March 26 but did not identify the individual or the circumstances leading to the arrest. An Associated Press report quoting Spanish authorities described the individual as Ukrainian and identified only as Denis K. Three accomplices said to be from Ukraine and Russia have also been arrested in connection with the Carbanak group's activities, the AP report noted.

In the statement, Europol described the arrests as stemming from a massive international effort involving the FBI, Europol's European Cybercrime Centre (EC3), law enforcement in Romania, Belarus and Taiwan, and several private companies.

Also key was the role of the European Banking Federation (EBF), which for the first time actively cooperated with Europol on a specific investigation. "The arrest of the key figure in this crime group illustrates that cybercriminals can no longer hide behind perceived international anonymity," Steven Wilson, the head of EC3 said in the statement.

The Carbanak group first surfaced in August 2013 and was initially associated with Anunak, a malware campaign that targeted mostly Russian banks and payment systems. The group began testing and later using Carbanak malware a short time later, and by the end of 2014 had infiltrated over 100 financial institutions and caused nearly $1 billion in cumulative losses.  

Security vendor Kaspersky Labs was the first to warn publicly about the Carbanak group in a February 2015 report. The report described the group's modus operandi as involving the use of phishing emails to install the Carbanak backdoor on systems belonging to targeted individuals at banks. The group then has used the malware to log keystrokes, spy on the institution's operations in other ways, and to move laterally through the compromised network to find specific systems of interest. In some instances, the threat actors have used infected computers to actually record videos of people working at their computers as part of the information-gathering process.

Cashing Out

The group has used multiple methods to steal money. One tactic is to infect servers controlling a bank's ATM systems and instructing the machines to dispense cash at specific locations and specific times so mules can collect the money without having to interact with the ATMs at all.

In other instances, Carbanak gang members have used the SWIFT financial services network to transfer money out of victim banks and into accounts held by the criminals. The Carbanak group has on several occasions also modified bank databases to create fake accounts and to inflate balances in existing accounts, and then transferred the money in these accounts to mules around the world.

After the Kaspersky Lab report, the group switched from using Carbanak malware to using the Cobalt Strike penetration-testing tool to launch even more devastating attacks. According to Europol, banks that the Carbanak group has targeted with Cobalt have suffered losses averaging $12.5 million.

"Carbanak is the most successful APT group in terms of stolen money," says Sergey Golovanov, principal security researcher at Kaspersky Lab's global research and analysis team.  One reason has been its ability to copy the tactics, techniques and procedures of state-sponsored attackers such as the use of spear-phishing, hidden persistence, and months of data exfiltration.

From a malware standpoint, there is little to separate the Carbanak group from other advanced persistent threat groups. What does sets it apart is its connections with criminals worldwide, Golovanov says. These connections have been critical to the group's ability to understand the language of documents and systems installed in target financial institutions around the world and to steal money from them.

"The law enforcement action against Carbanak showcases the idea of [the] inevitability of punishment," Golovanov says. "We understand that the arrest of one man will not solve all cases reported to the police, but this is a step towards catching others."

He predicts that a lot of the people associated with the Carbanak group will go offline for a while following the arrests. "Some of them will never become active again, because of the fear of being arrested."

Ilia Kolochenko, CEO of High-Tech Bridge, is less optimistic. It is quite likely the arrests will not lead to more arrests because many cybercriminals are good at covering their identities even from each other, he says. "It's difficult to estimate, but [it is] unlikely such arrests will make substantial improvements [from] a long term prospective," Kolochenko says.

Related Content:

 

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here. Register with Promo Code DR200 and save $200.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Crowdsourced vs. Traditional Pen Testing
Alex Haynes, Chief Information Security Officer, CDL,  3/19/2019
BEC Scammer Pleads Guilty
Dark Reading Staff 3/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Well, at least it isn't Mobby Dick!
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20165
PUBLISHED: 2019-03-22
Cross-site scripting (XSS) vulnerability in OpenText Portal 7.4.4 allows remote attackers to inject arbitrary web script or HTML via the vgnextoid parameter to a menuitem URI.
CVE-2019-1716
PUBLISHED: 2019-03-22
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code. The vulnerability ...
CVE-2019-1763
PUBLISHED: 2019-03-22
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to bypass authorization, access critical services, and cause a denial of service (DoS) condition. The vulnerability exist...
CVE-2019-1764
PUBLISHED: 2019-03-22
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack. The vulnerability is due to insufficient CSRF protections for the ...
CVE-2019-1765
PUBLISHED: 2019-03-22
A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 8800 Series could allow an authenticated, remote attacker to write arbitrary files to the filesystem. The vulnerability is due to insufficient input validation and file-level permis...