Cloud

1/17/2017
03:10 PM
50%
50%

Carbanak's Back And Using Google Services For Command-and-Control

Cybercrime gang employs common cloud services to hide in plain sight.

The infamous Carbanak cybercrime gang responsible for hacking and stealing money from financial insitutions in 2015 recently resurfaced with a new modus operandi: using Google services for command-and-control of its malware.

Researchers from Forcepoint Security Labs today detailed new activity they spotted by the Carbanak gang that employs Google's Apps Script, Sheets, and Forms cloud-based services to send and receive commands for its malware. Forcepoint recently spotted Carbanak using a trojanized RTF document with an encoded Visual Basic script.

"For each infected user a unique Google Sheets spreadsheet is dynamically created in order to manage each victim. The use of a legitimate third party service like this one gives the attacker the ability to hide in plain sight," Forcepoint wrote in a blog post today.

Carbanak, which was first discovered by researchers at Kaspersky Lab, is an international cybercrime ring based out of Eastern Europe that pilfered some $1 billion in two years from 100 different banks in nearly 30 countries using spear phishing emails targeting bank employees. Its targets were mainly Russian financial institutions, followed by banks in Denmark and the US.

Forcepoint says it has notified Google about Carbanak's fraud via Google services. Click here for more information. 

 

 

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
8 Security Tips for a Hassle-Free Summer Vacation
Steve Zurier, Freelance Writer,  6/23/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11446
PUBLISHED: 2018-06-25
The buy function of a smart contract implementation for Gold Reward (GRX), an Ethereum ERC20 token, allows a potential trap that could be used to cause financial damage to the buyer because of overflow of the multiplication of its argument amount and a manipulable variable buyPrice, aka the "tr...
CVE-2018-12062
PUBLISHED: 2018-06-25
The sell function of a smart contract implementation for SwftCoin (SWFTC), a tradable Ethereum ERC20 token, allows a potential trap that could be used to cause financial damage to the seller, because of overflow of the multiplication of its argument amount and a manipulable variable sellPrice, aka t...
CVE-2018-12063
PUBLISHED: 2018-06-25
The sell function of a smart contract implementation for Internet Node Token (INT), a tradable Ethereum ERC20 token, allows a potential trap that could be used to cause financial damage to the seller, because of overflow of the multiplication of its argument amount and a manipulable variable sellPri...
CVE-2018-12067
PUBLISHED: 2018-06-25
The sell function of a smart contract implementation for Substratum (SUB), a tradable Ethereum ERC20 token, allows a potential trap that could be used to cause financial damage to the seller, because of overflow of the multiplication of its argument amount and a manipulable variable sellPrice, aka t...
CVE-2018-12068
PUBLISHED: 2018-06-25
The sell function of a smart contract implementation for Target Coin (TGT), a tradable Ethereum ERC20 token, allows a potential trap that could be used to cause financial damage to the seller, because of overflow of the multiplication of its argument amount and a manipulable variable sellPrice, aka ...