Cyber-Spy Groups are Moving Towards Using Supply Chain Attacks to Attack Financial Institutions

From spying, stealing, and leaking state, military, and trade secrets, cybersecurity researchers at Kaspersky Lab discovered that cyber criminals operating in the region now aim for monetary gain as they infect banks in APAC countries.

The global cyber security company said active Advanced Persistent Threat (APT) groups have successfully breached financial institutions in Malaysia, South Korea, Indonesia, Philippines, China (Hong Kong), Bangladesh, and Vietnam.

“This year, we have monitored the tectonic shift in APT actors’ behavior. These groups who are initially data-hungry are now going beyond traditional cyberespionage. They added money-stealing on their attack menu as they hunt for vulnerable banks in the Asia Pacific (APAC) region which they can infect mostly through the rising epidemic,” says Yury Namestnikov, Head of Research Center, Russia at Kaspersky Lab’s Global Research and Analysis Team (GReAT).

In 2017, Kaspersky Lab has been able to monitor active APT actors in the region, namely the infamous Lazarus group and Cobaltgoblin other groups that use Carbanak-style attacks.

Lazarus is the cyber gang believed to be behind massive breaches including the Sony Pictures hack in 2014 and the multi-million cyber robbery against the Central Bank of Bangladesh last year. They are known for hacking C&C servers of banks and governments as launchpads for their malicious campaigns.

Carbanak made headlines in 2014 for the $1-billion bank heists in Russia, Ukraine, Germany, and China dubbed as “The Great Bank Robbery”. The group infiltrated their victims’ networks through spear phishing emails or infected Word documents exploiting known vulnerabilities. With remote and covert access to the system, they gained control of the banks’ ATMs or websites and collected a significant amount of money.

The degree of sophistication in terms of tools and the skilled manpower of the hackers behind these groups suggest that some of them are state-sponsored actors.

“Actors are switching towards using legitimate software instead of deploying unique malicious programs, which can allows them to perform the attack stealthy. Also they penetrated networks by supply chain attacks: in last three months there were four huge incidents of these similar pattern. In terms of monetization, it could be attacks against ATM infrastructure, SWIFT servers or databases with transactions and debit/credit cards information. They are undoubtedly investing time, money, and effort so they can have good Return on Investment (ROI). So far, we can assume that cyber criminals are earning good ROI when attacking financial institutions in the region,” adds Namestnikov.

The exact monetary losses from financial institutions attacks in APAC are unconfirmed as of this time but Kaspersky Lab researchers report having been able to foil breaches before financial firms could lose their money.

In order to protect enterprises from sophisticated financial threats, the global cyber security company suggests the use of a highly sophisticated solution that enables businesses to detect targeted attacks and other malicious actions through careful monitoring of network activity, web, and email like the Kaspersky Anti Targeted Attack Platform.

Kaspersky Lab also highlights the importance of threat intelligence to keep financial institutions knowledgeable on the latest trends of threats against banks. The global cybersecurity company has a portfolio of Threat Intelligence services designed to mitigate massive attacks by providing enterprises with insights on the latest, constantly emerging threats currently targeting businesses around the world.