Attacks/Breaches

3/26/2018
04:55 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Leader of Cybercrime APT Behind $1.2 Billion in Bank Heists Arrested

The Carbanak group has caused more financial losses to financial institutions than any other cybercrime group since it surfaced in 2013.

In a big victory for international law enforcement, Spanish police have arrested the alleged leader of Carbanak, a cybercrime group believed responsible for stealing over $1.2 billion from more than 100 banks in 40 countries.

The question now is whether the arrest will completely stop the group — one of the most financially destructive ever — or merely disrupt its operations in the short term.

"Much like traditional organized crime, the serpent has many heads so when one is caught even at the upper echelon, there are many more eager and willing to take that person's place," says Brian Hussey vice president of cyber detection and response at Trustwave.

He predicts a short pause in the group's day-to-day operations, but not much more. "A billion-dollar hacking operation is just too lucrative to be completely reliant on a single person." 

Europol announced the arrest of the alleged Carbanak ringleader on March 26 but did not identify the individual or the circumstances leading to the arrest. An Associated Press report quoting Spanish authorities described the individual as Ukrainian and identified only as Denis K. Three accomplices said to be from Ukraine and Russia have also been arrested in connection with the Carbanak group's activities, the AP report noted.

In the statement, Europol described the arrests as stemming from a massive international effort involving the FBI, Europol's European Cybercrime Centre (EC3), law enforcement in Romania, Belarus and Taiwan, and several private companies.

Also key was the role of the European Banking Federation (EBF), which for the first time actively cooperated with Europol on a specific investigation. "The arrest of the key figure in this crime group illustrates that cybercriminals can no longer hide behind perceived international anonymity," Steven Wilson, the head of EC3 said in the statement.

The Carbanak group first surfaced in August 2013 and was initially associated with Anunak, a malware campaign that targeted mostly Russian banks and payment systems. The group began testing and later using Carbanak malware a short time later, and by the end of 2014 had infiltrated over 100 financial institutions and caused nearly $1 billion in cumulative losses.  

Security vendor Kaspersky Labs was the first to warn publicly about the Carbanak group in a February 2015 report. The report described the group's modus operandi as involving the use of phishing emails to install the Carbanak backdoor on systems belonging to targeted individuals at banks. The group then has used the malware to log keystrokes, spy on the institution's operations in other ways, and to move laterally through the compromised network to find specific systems of interest. In some instances, the threat actors have used infected computers to actually record videos of people working at their computers as part of the information-gathering process.

Cashing Out

The group has used multiple methods to steal money. One tactic is to infect servers controlling a bank's ATM systems and instructing the machines to dispense cash at specific locations and specific times so mules can collect the money without having to interact with the ATMs at all.

In other instances, Carbanak gang members have used the SWIFT financial services network to transfer money out of victim banks and into accounts held by the criminals. The Carbanak group has on several occasions also modified bank databases to create fake accounts and to inflate balances in existing accounts, and then transferred the money in these accounts to mules around the world.

After the Kaspersky Lab report, the group switched from using Carbanak malware to using the Cobalt Strike penetration-testing tool to launch even more devastating attacks. According to Europol, banks that the Carbanak group has targeted with Cobalt have suffered losses averaging $12.5 million.

"Carbanak is the most successful APT group in terms of stolen money," says Sergey Golovanov, principal security researcher at Kaspersky Lab's global research and analysis team.  One reason has been its ability to copy the tactics, techniques and procedures of state-sponsored attackers such as the use of spear-phishing, hidden persistence, and months of data exfiltration.

From a malware standpoint, there is little to separate the Carbanak group from other advanced persistent threat groups. What does sets it apart is its connections with criminals worldwide, Golovanov says. These connections have been critical to the group's ability to understand the language of documents and systems installed in target financial institutions around the world and to steal money from them.

"The law enforcement action against Carbanak showcases the idea of [the] inevitability of punishment," Golovanov says. "We understand that the arrest of one man will not solve all cases reported to the police, but this is a step towards catching others."

He predicts that a lot of the people associated with the Carbanak group will go offline for a while following the arrests. "Some of them will never become active again, because of the fear of being arrested."

Ilia Kolochenko, CEO of High-Tech Bridge, is less optimistic. It is quite likely the arrests will not lead to more arrests because many cybercriminals are good at covering their identities even from each other, he says. "It's difficult to estimate, but [it is] unlikely such arrests will make substantial improvements [from] a long term prospective," Kolochenko says.

Related Content:

 

Interop ITX 2018

Join Dark Reading LIVE for two cybersecurity summits at Interop ITX. Learn from the industry’s most knowledgeable IT security experts. Check out the security track here. Register with Promo Code DR200 and save $200.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
What We Talk About When We Talk About Risk
Jack Jones, Chairman, FAIR Institute,  7/11/2018
Ticketmaster Breach Part of Massive Payment Card Hacking Campaign
Jai Vijayan, Freelance writer,  7/10/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14084
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for MKCB, an Ethereum token. If the owner sets the value of sellPrice to a large number in setPrices() then the "amount * sellPrice" will cause an integer overflow in sell().
CVE-2018-14085
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for UserWallet 0x0a7bca9FB7AfF26c6ED8029BB6f0F5D291587c42, an Ethereum token. First, suppose that the owner adds the evil contract address to his sweepers. The evil contract looks like this: contract Exploit { uint public start; function swe...
CVE-2018-14086
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for SingaporeCoinOrigin (SCO), an Ethereum token. The contract has an integer overflow. If the owner sets the value of sellPrice to a large number in setPrices() then the "amount * sellPrice" will cause an integer overflow in sell(...
CVE-2018-14087
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for EUC (EUC), an Ethereum token. The contract has an integer overflow. If the owner sets the value of buyPrice to a large number in setPrices() then the "msg.value * buyPrice" will cause an integer overflow in the fallback functio...
CVE-2018-14088
PUBLISHED: 2018-07-16
An issue was discovered in a smart contract implementation for STeX White List (STE(WL)), an Ethereum token. The contract has an integer overflow. If the owner sets the value of amount to a large number then the "amount * 1000000000000000" will cause an integer overflow in withdrawToFounde...