Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

3/26/2018
04:55 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Leader of Cybercrime APT Behind $1.2 Billion in Bank Heists Arrested

The Carbanak group has caused more financial losses to financial institutions than any other cybercrime group since it surfaced in 2013.

In a big victory for international law enforcement, Spanish police have arrested the alleged leader of Carbanak, a cybercrime group believed responsible for stealing over $1.2 billion from more than 100 banks in 40 countries.

The question now is whether the arrest will completely stop the group — one of the most financially destructive ever — or merely disrupt its operations in the short term.

"Much like traditional organized crime, the serpent has many heads so when one is caught even at the upper echelon, there are many more eager and willing to take that person's place," says Brian Hussey vice president of cyber detection and response at Trustwave.

He predicts a short pause in the group's day-to-day operations, but not much more. "A billion-dollar hacking operation is just too lucrative to be completely reliant on a single person." 

Europol announced the arrest of the alleged Carbanak ringleader on March 26 but did not identify the individual or the circumstances leading to the arrest. An Associated Press report quoting Spanish authorities described the individual as Ukrainian and identified only as Denis K. Three accomplices said to be from Ukraine and Russia have also been arrested in connection with the Carbanak group's activities, the AP report noted.

In the statement, Europol described the arrests as stemming from a massive international effort involving the FBI, Europol's European Cybercrime Centre (EC3), law enforcement in Romania, Belarus and Taiwan, and several private companies.

Also key was the role of the European Banking Federation (EBF), which for the first time actively cooperated with Europol on a specific investigation. "The arrest of the key figure in this crime group illustrates that cybercriminals can no longer hide behind perceived international anonymity," Steven Wilson, the head of EC3 said in the statement.

The Carbanak group first surfaced in August 2013 and was initially associated with Anunak, a malware campaign that targeted mostly Russian banks and payment systems. The group began testing and later using Carbanak malware a short time later, and by the end of 2014 had infiltrated over 100 financial institutions and caused nearly $1 billion in cumulative losses.  

Security vendor Kaspersky Labs was the first to warn publicly about the Carbanak group in a February 2015 report. The report described the group's modus operandi as involving the use of phishing emails to install the Carbanak backdoor on systems belonging to targeted individuals at banks. The group then has used the malware to log keystrokes, spy on the institution's operations in other ways, and to move laterally through the compromised network to find specific systems of interest. In some instances, the threat actors have used infected computers to actually record videos of people working at their computers as part of the information-gathering process.

Cashing Out

The group has used multiple methods to steal money. One tactic is to infect servers controlling a bank's ATM systems and instructing the machines to dispense cash at specific locations and specific times so mules can collect the money without having to interact with the ATMs at all.

In other instances, Carbanak gang members have used the SWIFT financial services network to transfer money out of victim banks and into accounts held by the criminals. The Carbanak group has on several occasions also modified bank databases to create fake accounts and to inflate balances in existing accounts, and then transferred the money in these accounts to mules around the world.

After the Kaspersky Lab report, the group switched from using Carbanak malware to using the Cobalt Strike penetration-testing tool to launch even more devastating attacks. According to Europol, banks that the Carbanak group has targeted with Cobalt have suffered losses averaging $12.5 million.

"Carbanak is the most successful APT group in terms of stolen money," says Sergey Golovanov, principal security researcher at Kaspersky Lab's global research and analysis team.  One reason has been its ability to copy the tactics, techniques and procedures of state-sponsored attackers such as the use of spear-phishing, hidden persistence, and months of data exfiltration.

From a malware standpoint, there is little to separate the Carbanak group from other advanced persistent threat groups. What does sets it apart is its connections with criminals worldwide, Golovanov says. These connections have been critical to the group's ability to understand the language of documents and systems installed in target financial institutions around the world and to steal money from them.

"The law enforcement action against Carbanak showcases the idea of [the] inevitability of punishment," Golovanov says. "We understand that the arrest of one man will not solve all cases reported to the police, but this is a step towards catching others."

He predicts that a lot of the people associated with the Carbanak group will go offline for a while following the arrests. "Some of them will never become active again, because of the fear of being arrested."

Ilia Kolochenko, CEO of High-Tech Bridge, is less optimistic. It is quite likely the arrests will not lead to more arrests because many cybercriminals are good at covering their identities even from each other, he says. "It's difficult to estimate, but [it is] unlikely such arrests will make substantial improvements [from] a long term prospective," Kolochenko says.

Related Content:

 

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here. Register with Promo Code DR200 and save $200.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
6 Top Nontechnical Degrees for Cybersecurity
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/21/2019
TPM-Fail: What It Means & What to Do About It
Ari Singer, CTO at TrustPhi,  11/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18610
PUBLISHED: 2019-11-22
An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary syste...
CVE-2019-9536
PUBLISHED: 2019-11-22
Apple iPhone 3GS bootrom malloc implementation returns a non-NULL pointer when unable to allocate memory, aka 'alloc8'. An attacker with physical access to the device can install arbitrary firmware.
CVE-2013-6811
PUBLISHED: 2019-11-22
Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DSL-6740U gateway (Rev. H1) allow remote attackers to hijack the authentication of administrators for requests that change administrator credentials or enable remote management services to (1) Custom Services in Port Forwarding...
CVE-2013-6880
PUBLISHED: 2019-11-22
Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary web sites and conduct cross-site scripting (XSS) attacks via the HTTP Referer header.
CVE-2019-15652
PUBLISHED: 2019-11-22
The web interface for NSSLGlobal SatLink VSAT Modem Unit (VMU) devices before 18.1.0 doesn't properly sanitize input for error messages, leading to the ability to inject client-side code.