Attacks/Breaches

3/26/2018
04:55 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Leader of Cybercrime APT Behind $1.2 Billion in Bank Heists Arrested

The Carbanak group has caused more financial losses to financial institutions than any other cybercrime group since it surfaced in 2013.

In a big victory for international law enforcement, Spanish police have arrested the alleged leader of Carbanak, a cybercrime group believed responsible for stealing over $1.2 billion from more than 100 banks in 40 countries.

The question now is whether the arrest will completely stop the group — one of the most financially destructive ever — or merely disrupt its operations in the short term.

"Much like traditional organized crime, the serpent has many heads so when one is caught even at the upper echelon, there are many more eager and willing to take that person's place," says Brian Hussey vice president of cyber detection and response at Trustwave.

He predicts a short pause in the group's day-to-day operations, but not much more. "A billion-dollar hacking operation is just too lucrative to be completely reliant on a single person." 

Europol announced the arrest of the alleged Carbanak ringleader on March 26 but did not identify the individual or the circumstances leading to the arrest. An Associated Press report quoting Spanish authorities described the individual as Ukrainian and identified only as Denis K. Three accomplices said to be from Ukraine and Russia have also been arrested in connection with the Carbanak group's activities, the AP report noted.

In the statement, Europol described the arrests as stemming from a massive international effort involving the FBI, Europol's European Cybercrime Centre (EC3), law enforcement in Romania, Belarus and Taiwan, and several private companies.

Also key was the role of the European Banking Federation (EBF), which for the first time actively cooperated with Europol on a specific investigation. "The arrest of the key figure in this crime group illustrates that cybercriminals can no longer hide behind perceived international anonymity," Steven Wilson, the head of EC3 said in the statement.

The Carbanak group first surfaced in August 2013 and was initially associated with Anunak, a malware campaign that targeted mostly Russian banks and payment systems. The group began testing and later using Carbanak malware a short time later, and by the end of 2014 had infiltrated over 100 financial institutions and caused nearly $1 billion in cumulative losses.  

Security vendor Kaspersky Labs was the first to warn publicly about the Carbanak group in a February 2015 report. The report described the group's modus operandi as involving the use of phishing emails to install the Carbanak backdoor on systems belonging to targeted individuals at banks. The group then has used the malware to log keystrokes, spy on the institution's operations in other ways, and to move laterally through the compromised network to find specific systems of interest. In some instances, the threat actors have used infected computers to actually record videos of people working at their computers as part of the information-gathering process.

Cashing Out

The group has used multiple methods to steal money. One tactic is to infect servers controlling a bank's ATM systems and instructing the machines to dispense cash at specific locations and specific times so mules can collect the money without having to interact with the ATMs at all.

In other instances, Carbanak gang members have used the SWIFT financial services network to transfer money out of victim banks and into accounts held by the criminals. The Carbanak group has on several occasions also modified bank databases to create fake accounts and to inflate balances in existing accounts, and then transferred the money in these accounts to mules around the world.

After the Kaspersky Lab report, the group switched from using Carbanak malware to using the Cobalt Strike penetration-testing tool to launch even more devastating attacks. According to Europol, banks that the Carbanak group has targeted with Cobalt have suffered losses averaging $12.5 million.

"Carbanak is the most successful APT group in terms of stolen money," says Sergey Golovanov, principal security researcher at Kaspersky Lab's global research and analysis team.  One reason has been its ability to copy the tactics, techniques and procedures of state-sponsored attackers such as the use of spear-phishing, hidden persistence, and months of data exfiltration.

From a malware standpoint, there is little to separate the Carbanak group from other advanced persistent threat groups. What does sets it apart is its connections with criminals worldwide, Golovanov says. These connections have been critical to the group's ability to understand the language of documents and systems installed in target financial institutions around the world and to steal money from them.

"The law enforcement action against Carbanak showcases the idea of [the] inevitability of punishment," Golovanov says. "We understand that the arrest of one man will not solve all cases reported to the police, but this is a step towards catching others."

He predicts that a lot of the people associated with the Carbanak group will go offline for a while following the arrests. "Some of them will never become active again, because of the fear of being arrested."

Ilia Kolochenko, CEO of High-Tech Bridge, is less optimistic. It is quite likely the arrests will not lead to more arrests because many cybercriminals are good at covering their identities even from each other, he says. "It's difficult to estimate, but [it is] unlikely such arrests will make substantial improvements [from] a long term prospective," Kolochenko says.

Related Content:

 

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here. Register with Promo Code DR200 and save $200.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Empathy: The Next Killer App for Cybersecurity?
Shay Colson, CISSP, Senior Manager, CyberClarity360,  11/13/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15769
PUBLISHED: 2018-11-16
RSA BSAFE Micro Edition Suite versions prior to 4.0.11 (in 4.0.x series) and versions prior to 4.1.6.2 (in 4.1.x series) contain a key management error issue. A malicious TLS server could potentially cause a Denial Of Service (DoS) on TLS clients during the handshake when a very large prime value is...
CVE-2018-18955
PUBLISHED: 2018-11-16
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAP_SYS_ADMIN in an affected user namespace can bypass access controls on resour...
CVE-2018-19311
PUBLISHED: 2018-11-16
Centreon 3.4.x allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring > Status Details > Services" screen.
CVE-2018-19312
PUBLISHED: 2018-11-16
Centreon 3.4.x allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.
CVE-2018-19318
PUBLISHED: 2018-11-16
SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account.