THREAT INFORMATION

Multiple banks from post-Soviet countries have been breached by an organized crime group, resulting in a series of suspicious ATM withdrawal transactions and million-dollar losses — a well-planned and coordinated attack, which involves physical and cyber activities to achieve the threat actor’s goals.

The criminals behind this attack manipulate the overdraft limit of specific debit card accounts to allow further credit permissions and withdraw cash from ATM terminals located in foreign countries.

TARGETED ATTACK CHAIN

Click to enlarge

The crime operation of this attack is divided into multiple teams: Money Mules, who are group of individuals that perform the offline (physical) activities, and Cyber Criminals, who are in charge of attacking the bank’s network infrastructure.

• Team 1: Money Mules

  This team applies for new accounts and requests for debit cards in targeted bank branches using fake identities and information. The bank issues the debit cards and the first team of money mules forwards the debit cards to the perpetrators, who are located in different countries throughout Europe.

• Team 2: Cyber Criminals

  While the teams of money mules are performing the initial stage of the attack, a group of cyber criminals are already attacking the bank’s network infrastructure. The attack begins with a phishing email that downloads/installs a backdoor into the machine. The threat actors then abuse legitimate tools and services to perform lateral movement and asset discovery.

  The cyber criminals leverage legitimate tools and services already installed in the system, such as PowerShell and PSexec to perform lateral movement and asset discovery. It is also indicative that PuTTY Link (plink.exe) was one of the toolkits used for the lateral movement stage. Additional software, like the monitoring tool Mipko, was also installed to capture screenshots and keystrokes. This allows the attackers to study how the bank's system works, as well as to steal login credentials. Leveraging these tools allows threats actors to blend in with normal network traffic or IT/system administration tasks.

  The cyber criminal's main goal is to take control of the bank’s card management application system. Using the credentials that they were able to capture, they log into the card management application system using privileged accounts to manipulate the overdraft limit of the debit cards associated with the rogue accounts, as well as remove anti-fraud controls for these accounts.

• Team 3: Money Mules

  The role of this group of money mules is to withdraw cash from selected ATM machines located in different cities using the debit cards of the rogue accounts.

  This is a synchronized attack i.e. the entire operation was carefully planned. The team of money mules was assigned in select ATM terminals in Europe and Russia, carrying the debit cards of the rogued bank accounts. Once the team of cybercriminals manipulates the overdraft limit, they immediately give a green light to the money mules to withdraw the cash from the ATM terminals. The manipulation of the debit cards' overdraft limit and the withdrawals take place almost simultaneously. This well-coordinated attack is a strong indication of organized crime activities.