Criminals Steal Millions Of Belgian Banks Via Malware

Criminals have malware through millions of Belgian banks managed to steal, according to research by the Belgian federal prosecutor's office which De Standaard today message. 12,000 Belgian computers were infected with malware.

After the malware was active were able to make the criminals via internet banking money to other accounts. At about 1500 people there was also actually achieved money from the account, including customers of Belfius and KBC. The case came rolling after a tip from Denmark. A Brussels woman had large amounts of Denmark had deposited in her accounts. Eventually, the Belgian authorities knew to bring a network of money mules in card that the money received via the malware was stolen.

For the Brussels pantry currently running a procedure in which an attempt is made to get 21 people to court, including five Russians who are suspected of money laundering. The other suspects are prosecuted for money laundering and computer fraud.

Criminals Use Malware To Empty ATMs

In the first months of this year, criminals in four European countries malware used to empty the contents of ATMs. These are so-called 'cash out' or 'jackpot ting' attacks, reports the European ATM Security Team (EAST) in a new report ( pdf ).

Which countries will be concerned and how many do not know when the attack was captured late EAST. Malware to empty with ATMs is not new and was last year for the first time in Western Europe discovered . Criminals with physical access to the machine and then install the malware via a USB connection or CD-ROM. Through the malware and entering a special key combination can then be emptied the contents of the cash cassettes. Late last year, however, there were also discovered attacks in Russia where attackers remote ATMs with malware had infected by first banks to attack .

Most countries had so far mainly due to skimming, although seven countries recorded a decline in the number of skimming incidents and two countries saw an increase. There is also avoid a growing trend skimmers countries with an EMV chip. The greatest damage was skimming through this years ago in Indonesia, followed by the United States and the Philippines. The data from the EAST report come from 19 countries in the Single Euro Payments Area (SEPA) and two non-SEPA countries.

Banks Hacked And Robbed By Missing Word Updates

About a hundred banks and financial institutions for a period of two years by cyber criminals hacked and robbed because security updates for Microsoft Word had not been installed. According to a published today report of the Russian antivirus company Kaspersky Lab, the gang of cyber criminals gave the name Carnabak. This is the same gang that late last year by the Dutch Fox-IT and the Russian Group-IB was unmasked .

This weekend was the New York Times all with a message about the gang. It stated that Dutch banks had been targeted.Something later by both the Dutch banks as Kaspersky Lab was denied. In an old version of the report, which include Computer Emergency Reponse Teams (CERTs) was dispersed, the Netherlands was mentioned. However, it was in fact a false positive.

Although the New York Times Kaspersky had received a report that newer Netherlands ceased, it still used the information from the old report, says Jornt van der Wiel, analyst at Kaspersky Lab. Another detail that was highlighted in the media is wrong to use recording software. The gang has monitored no security cameras inside the attacked banks, but made ​​via software images from the desktop. This gave insight into the methods and processes within the banks.

It now appeared online report also shows how the attackers went to work. Bank employees who sent emails with Word documents, and in some cases, RAR files containing CPL files. However, there were mainly used Word documents, Van der Wiel. The documents were abuse of leaks in 2012, 2013 and 2014 all were patched by Microsoft. Patches that were missing on the attacked systems. There was in this operation no zero-day vulnerabilities. The advice given to both consumers and businesses, namely installing security updates timely, was not followed by the banks.

Once bank employees with a vulnerable version of Microsoft Office documents of the attackers opened there was malware installed on the system. In some cases, were also used RAR files there, including a CPL file. CPL (Control Panel) files are used for configuration Protect. The programs in the Control Panel as 'System', 'Printers' and 'Programs and Features', all CPL files. They are also used as malware. Furthermore, Kaspersky Lab says that there may be traces of classic drive-by download attacks are detected, in which bank staff when visiting a Web site became infected, but this is not confirmed yet.

Once the attackers had access to the system was installed additional software, such as the Ammyy Remote Administration Tool. Probably the attackers used this tool because it is on a whitelist in many environments. Ammyy gives administrators namely remote access to the computer. Then the attackers tried to steal the credentials of the system. For this, there were internal emails from the infected computers again sent infected Word files. In this way, could be infected, other systems on the network.

Eventually the attackers access to the transaction systems and made the money to other accounts or left-recording infected ATMs. Researchers have one shot where there is to see how someone at night with a bag goes to the ATM of a bank. At exactly 3:00 am spitting automatics the notes from that stopped and taken into the bag by the man.

The damage from the surgery is difficult to determine. Although in the media amounts of $ 1 billion mentioned, this amount is not confirmed. Kaspersky used a calculation method whereby a damage of $ 10 million per bank is used, although this amount is not stolen at all banks. Thus in the report but one victim mentioned that lost $ 10 million and a second bank where 7.3 million dollars were diverted.

Yet Kaspersky multiplied the amount of $ 10 million with 30 affected banks. In addition, there might also be some 30 banks that did not report and the police should also know of some 30 affected banks. For these banks, most of which are located in Russia, $ 10 million was used, eventually yielding an unconfirmed amount of around $ 900 million. The actual damage is probably about $ 300 million or maybe even much lower, Van der Wiel notes. Kaspersky also involves a battle report to hand.

What is certain is that the criminals to strike because the banks did not follow the basic rules for safe Internet, namely the installation of security updates, and do not open unsolicited attachments. Two of the hijacked Russian banks were due to the poor security of their banking license be lost. According to Kaspersky, the attackers are still active.

Cyber ​​Criminals Steal Millions From Banks Worldwide

A group of cyber criminals worldwide millions of dollars from more than 100 banks in 30 countries stolen.Most of the affected banks are located in Russia and the US, followed by banks in Germany, Ukraine and China. Dutch banks would not have been a target in contrast to previous reports.

This was discovered by the Russian anti-virus firm Kaspersky Lab on Monday a report on the operation will publish the cybercriminals, but part of all details with the New York Times reported. The Russian virus fighter came the criminals on the track when an ATM in Kiev randomly money bills issued without there was an ATM card in the machine plugged. Research showed that cyber criminals had infiltrated the internal banking network.

By sending infected e-mails, for example, a news item that appeared from a colleague who became infected by staff opened the bank computers. Through these computers knew the attackers to gain access to the systems that used the bank staff for daily transactions and accounting. Through the installed malware was then included the process of the bank employees.

This information used the criminals to pose as bank staff, where there are millions of banks in Russia, Japan, Switzerland and the United States was transferred to accounts in other countries. To include also the money the criminals ruled the ATMs of the bank, so that the expenses banknotes at a certain time. In addition, the money was transferred through online banking systems.

However, the largest amounts were stolen by hacking the accounting systems of the banks and temporarily change the account. For example, a bill of $ 1,000 to $ 10,000 raised, and $ 9,000 was transferred to another bank. The original account holder noticed nothing of this and the bank fraud after discovering some time. Many banks accounts were found to check every 10 hours. Within this time window, the criminals were able to change the accounts and transfer the money.

In total, were attacked according to Kaspersky Lab over a period of nearly two years, more than 100 banks in 30 countries.Which banks will want the anti-virus company can not say. Researchers from the virus fighter would have seen evidence that the gang $ 300 million has been captured and possibly even triple this. This estimate, however, would be impossible to prove because the criminals a limit of $ 10 million per transaction wielded.

Some banks, however, were repeatedly struck. The New York Times reports that most transactions were modest, probably in order not to let the warning systems of the banks go. "If going to the tactics and methods used by the cybercriminals to go unnoticed, this is probably the most sophisticated cyber attack that has taken place so far," said Chris Doggett of Kaspersky Lab.

Kaspersky Lab know that no Dutch bank or banks are affected there as previously reported, on which the article was adapted. In addition, would also no banks in Belgium and Luxembourg have been targeted. In the article by the New York Times, however, still always stated that money from one or more Dutch banks has been stolen. A survey of Kaspersky Lab shows that after Russia and the US banks in Germany, the Ukraine and China are most affected.

According to the virus fighter used the attackers emails with the attached "Carnabak-malware" and emails were also used with exploits. Or were these exploits of unknown leak or leaks which use an update was available is not yet published. However, the attackers would at banks have infected hundreds of computers to find the computer system, which then accesses the transaction systems were obtained.

Kaspersky Lab has also announced that the New York Times, the cooperation between the anti-virus company and the Dutch National High Tech Crime Unit (NHTCU) may have misinterpreted. The Russian virus fighter has information about the case is sent to the NHTCU. Further, the report will tomorrow during Kaspersky Security Analyst Summit (SAS) are presented, together with Peter Zinn of the NHTCU.

Possibly, the US newspaper based on this that Dutch banks have become victims. However, the Netherlands is in the report that tomorrow does not appear in the list of affected countries. Furthermore, Kaspersky Lab that it has no evidence that Dutch financial institutions have fallen victim.

f0xy Malware: "Malware Hides By Using Microsoft BITS Download Service"

Researchers have discovered a malware specimen that Microsoft's own download service used to hide.The malware by security firm Websense 'f0xy' and is among other because of the use of the Microsoft Background Intelligent Transfer Service ( BITS ).

This service uses available bandwidth for downloading files. Many Windows services use this service, including Windows Update and Windows Defender. According to researchers used f0xy download service to avoid being noticed. Virus scanners would beat slower alarm when network requests BITS see coming than an unknown .exe file would be the case. The malware itself is developed to mine infected computers to digital currency.

Hashes:

f522e0893ec97438c6184e13adc48219f08b67d8

080c61c9172cd49f6e4e7ef27285ccaaf6d5f0ac

c25da337ec5ac041312b062e7fb697e4f01ca8d9

cd4e297928502dece4545acbe0b94dd1270f955c

adbf0e4d37e381fe7599695561262d1a65205317

54d2810aaae67da9fa24f4e11f4c2d5fe4d2b6d4

7de3ed8f751a528fde1688d35c6eb5533b09ae11

812e453c22e1a9f70b605cd27d3f642c3778d96d

55c9d015b1f8d68e6b5ce150f2dbab2b621dac1c

e80d7f27405ece2697a05d6c2612c63335851490

f4f1d8bceb62c72f2fe6713c5395555917fc40ad

2a4837fdb331f823ca474f521248b2cdb766528f

f522e0893ec97438c6184e13adc48219f08b67d8

US State Block Zip Files After Malware Attack

The US state of Arkansas decided this week all zip files via e-mail were sent out to block after several state computers were infected with malware. According to a spokeswoman would amount to a fraction of the more than 15,000 state computers.

"There are fewer than 50 machines were infected," said Janet Wilson against the Democrat Gazette . "We have multiple layers of protection. Some filtering malicious traffic and there are other measures. These filters have noticed the malware attack. We conducted a test on the computers in the network, and that 50 were quickly found and removed from the network and replaced . "

"The Department of Information Systems" that is responsible for the automation late in a statement on Facebook know that the only way to prevent the spread of infected files on the network is blocking was zip files. "We apologize for the inconvenience and will deliver these files as it is safe."