For the first time in three years, the company's cybersecurity specialists Group-IB have identified a successful attack on the interbank transfer system of the AWP KBR (automated workstation of a client of the Bank of Russia).
In February 2021, the attackers carried out a hacker attack against one of the banks and stole funds, gaining access to the interbank transfer system of the AWP KBR. Analysts of the cybersecurity company Group-IB associate the hacking with the activities of the MoneyTaker group involved in previous similar attacks.
According to the Group-IB report, the attack began in June 2020 "through the compromise of a company affiliated with the bank," after which the bank's internal network was investigated for six months.
In 2021, the attackers registered fake domain names using the name of the bank and the zone .org and .com, not .ru. After that, the attackers "stole digital keys and later used them to sign payments passing through the transport gateway of the Bank of Russia."
Hackers were able to steal more than 500 million rubles ($6.7 million).
The experts emphasized that in the future, an increase in the number of such crimes is expected. “Taking into account the fact that we are more and more involved in electronic payments, then there will be more and more attempts to violate the law in this area”, said Nikolay Kulbaka, Financial Analyst and Associate Professor of Economics at RANEPA.
It is interesting to note that the hacker group Moneymaker was able to steal money from a Russian bank from its account in the Central Bank for the first time since 2018. Then more than 58 million rubles ($781 thousand) were withdrawn from the account of PIR Bank to the Central Bank. In the same year, the Central Bank revoked the license from PIR Bank due to violations of anti-laundering legislation.
The Central Bank of Russia has warned of the emergence of a group of hackers investigating vulnerabilities in banks' mobile applications.
The Bank of Russia has detected a shift in hackers' attention from the banking infrastructure to customers' financial mobile applications in order to steal data or money from their accounts. The regulator suggests that a highly skilled hacker group has emerged in the financial market specializing in the deep analysis of mobile applications in order to detect and exploit weaknesses and vulnerabilities.
The survey is based on information exchange between the Central Bank and financial market participants. 818 organizations, including 365 banks, are currently included to it.
"The data available to the Bank of Russia suggests the emergence of at least one group of attackers focused on the skilled hacking of financial mobile applications," the survey said.
The Central Bank cited two examples in which cybercriminals discovered vulnerabilities in mobile apps and used them for hacking. As a result, in the first case, a server containing files with the personal data of a bank's customers - more than 100,000 lines - was published on the Web: Name, gender, mobile phone number, email address, place of work, account and bank card number, account type, currency. In the second case, the hackers managed to steal money by logging into the bank's mobile app and, when making a transfer, substituting their account number with that of another bank customer, who became the victim.
"These two examples are not the only cases of attacks on mobile applications of financial institutions that have occurred recently," the review specifies. In this regard, the Central Bank has recommended banks to strengthen the protection of mobile components of remote service systems.
According to the Vice-President of the Association of Banks of Russia Alexey Voilukov, information processing can take several hours or even days, while a fraudster can withdraw money from the card within an hour.
President of the Association of Banks of Russia Georgy Luntovsky sent a letter to Vadim Uvarov, Director of the Information Security Department of the Bank of Russia, with a proposal to organize direct interaction between market participants in order to exchange data on suspicious transactions.
Now financial organizations use an automated system to inform the Regulator about all operations that have signs of being performed without the knowledge of customers. Then the Regulator accumulates all the collected data about attacks and returns them to banks in a consolidated form. According to Alexey Voilukov, information processing can take several hours or even days, while a fraudster can withdraw money from the card to which they were withdrawn within an hour.
Mr. Voilukov noted that the creation of a centralized mechanism will speed up the exchange of information by about five times, and the time for providing information in some cases will be reduced to 20-30 minutes.
"For example, several people complained to the Bank about unauthorized transfers within an hour. It detects a fraudulent account and promptly sends information about it to the organizations from which the money was transferred. With a quick response, there is a chance to prevent theft," he explained Mr. Voilukov. According to him, this scheme of work will allow us to fight against fraudsters who work using social engineering methods.
The Central Bank told that they will study the proposals. VTB, MKB, Rosbank and Tinkoff support the Association of Banks of Russia initiative. VTB added that the system for exchanging information on incidents needs to be improved, as this will speed up and automate the processes of the rapid response of banks to fraudulent attacks.