{"id":11236,"date":"2016-02-08T08:20:11","date_gmt":"2016-02-08T13:20:11","guid":{"rendered":"https:\/\/www.kaspersky.com.au\/blog\/?p=11236"},"modified":"2020-02-27T04:01:15","modified_gmt":"2020-02-26T17:01:15","slug":"metel-gcman-carbanak","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.au\/blog\/metel-gcman-carbanak\/11236\/","title":{"rendered":"Dozens of banks lose millions to cybercriminals attacks"},"content":{"rendered":"<p>In 2015 we saw the rise of cybercriminals who rob banks directly. Several groups have mastered APT tools and techniques, dipping their hands into the \u201cpockets\u201d of at least twenty-nine big Russian banks.<\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/102\/2016\/02\/06023044\/metel-apt-FB.jpg\" rel=\"attachment wp-att-11237\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/102\/2016\/02\/06023044\/metel-apt-FB.jpg\" alt=\"Dozens of banks lose millions to cybercriminals attacks\" width=\"1280\" height=\"1280\" class=\"aligncenter size-full wp-image-11237\"><\/a><\/p>\n<p>The victims asked Kaspersky Lab for assistance and our Global Research and Analysis Team got down to work. The investigation revealed three separate groups of hackers who inflicted multiple millions in terms of financial damage to the banks. At the Security Analyst Summit 2016 experts from GReAT came out with an investigation report. For safety sake names of the victims have not been disclosed.<\/p>\n<p>https:\/\/twitter.com\/k8em0\/status\/696636003692314624<\/p>\n<h3>ATMs at the end of a gun<\/h3>\n<p>A banking Trojan with the melodic-sounding name Metel (also known as Corkow) was initially discovered in 2011: at that time the malware was hunting users of online banking systems. In 2015 the criminals behind Metel took aim at banks, specifically ATM machines. Using their savvy and a malicious campaign, these criminals turned their common credit cards into limitless ones. Imagine printing money, but even better.<\/p>\n<p><em>How did they do it?<\/em><\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/102\/2016\/02\/06023041\/metel-live-photo.jpg\" rel=\"attachment wp-att-11241\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/102\/2016\/02\/06023041\/metel-live-photo.jpg\" alt=\"Dozens of banks lose millions to cybercriminals attacks\" width=\"1280\" height=\"840\" class=\"aligncenter size-full wp-image-11241\"><\/a><\/p>\n<p>The criminals successively infected computers of bank employees either with the help of <a href=\"https:\/\/en.wikipedia.org\/wiki\/Phishing#List_of_phishing_types\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">spear phishing<\/a> emails that included malicious executable files or through targeting a browser vulnerabilities. Once inside the network they used legitimate software to hack other PCs until they reached the device they were looking for \u2014 the one that had access to money transactions. For example, these were PCs of call center operators or the support team.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">APT Predictions for 2016: There will be no more APTs! Oh, wait\u2026 <a href=\"https:\/\/t.co\/mLC5zQqjzK\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/mLC5zQqjzK<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/667742680491929600?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">November 20, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>As a result, each time when criminals picked up the money from a card of the compromised bank in an ATM of another bank, infected system automatically rolled back the transactions. That\u2019s why the balance on the cards remained the same, allowing the cybercriminal to withdraw money limited only by the amount of cash in the ATM. The criminals made similar cash-outs at different ATM machines.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">What is phishing and why should you care? Find out <a href=\"https:\/\/t.co\/eNlAvarhAy\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/eNlAvarhAy<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/iteducation?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#iteducation<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/itsec?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#itsec<\/a> <a href=\"https:\/\/t.co\/EJc6vW8YUX\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/EJc6vW8YUX<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/675390994137894912?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">December 11, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>As far as we know, the gang is relatively small and consists of up to ten people. Part of the team speaks Russian and we\u2019ve detected no infections outside Russia. The hackers are still active and looking for new victims.<\/p>\n<h3>Cunning criminals<\/h3>\n<p>Criminals from GCMAN group hustled through a similar operation, but instead of robbing ATMs they\u2019ve transferred money to e-currency services.<\/p>\n<p>To get into the network, GCMAN members used spear phishing emails with malicious attachments. They penetrated the devices of HR and accounting specialists and then waited until the system administrator logs into the system. Sometimes they moved the process along by crashing Microsoft Word or 1C (a program used for accounting that is very popular in Russia). As the user called for help and the system administrator came to solve the problem, criminals would steal the admin\u2019s password.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/KLReport?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#KLReport<\/a> RT <a href=\"https:\/\/twitter.com\/jeffespo?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@jeffespo<\/a>: . <a href=\"https:\/\/twitter.com\/kaspersky?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@Kaspersky<\/a> Security Bulletin. <a href=\"https:\/\/twitter.com\/hashtag\/Spam?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Spam<\/a> and <a href=\"https:\/\/twitter.com\/hashtag\/phishing?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#phishing<\/a> in 2015 via <a href=\"https:\/\/twitter.com\/Securelist?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@Securelist<\/a>  <a href=\"https:\/\/t.co\/zhDYsDekAh\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/zhDYsDekAh<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/netsec?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#netsec<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/695655222283268096?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">February 5, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Then GCMAN members laterally travelled through the bank\u2019s corporate network until they found a device, which could quietly transfer money to different e-currency services. In some organizations criminals even did it with the help of legitimate software and common penetration testing tools, like Putty, VNC and Meterpreter.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">This is how a victim can lose $200 per minute <a href=\"https:\/\/twitter.com\/hashtag\/bankingAPT?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#bankingAPT<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/TheSAS2016?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#TheSAS2016<\/a> <a href=\"https:\/\/t.co\/jEYjuqeh7U\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/jEYjuqeh7U<\/a><\/p>\n<p>\u2014 Eugene Kaspersky (@e_kaspersky) <a href=\"https:\/\/twitter.com\/e_kaspersky\/status\/696679042234224640?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">February 8, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>These transactions were made via a <a href=\"https:\/\/en.wikipedia.org\/wiki\/cron\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">cron script<\/a> , which automatically transferred small sums every minute. This was to the tune of roughly $200 at a time, as this is the upper limit for anonymous financial transactions in Russia. It\u2019s noteworthy that the thieves were very careful. In one case they quietly stayed in the network for a year and half, stealthy hacking lots of devices and accounts.<\/p>\n<p>As far as we know, GCMAN group is very small and includes only one or two members, who appealingly speak Russian.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Kaspersky Lab cybersecurity <a href=\"https:\/\/twitter.com\/hashtag\/predictions?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#predictions<\/a> for 2016 \u2013 <a href=\"https:\/\/t.co\/1JFA8qRBm9\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/1JFA8qRBm9<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/KL2016Prediction?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#KL2016Prediction<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/infosec?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#infosec<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/netsec?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#netsec<\/a> <a href=\"https:\/\/t.co\/LjGxVMG7xV\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/LjGxVMG7xV<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/674628086281994240?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">December 9, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<h3>The return of Carbanak<\/h3>\n<p>The Carbanak group has been performing acts on the Internet since 2013. It occasionally disappears and eventually comes back with a new hacking plan. Recently Carbanak\u2019s victims profile has been broadened. It now targets financial departments of any organization of interest, not only banks. This group <a href=\"https:\/\/www.kaspersky.com.au\/blog\/billion-dollar-apt-carbanak\/7519\/\" target=\"_blank\" rel=\"noopener noreferrer\">has already stolen<\/a> millions from different companies all over the world. After that they laid low for a while and came back four months ago with a new plan.<\/p>\n<p>To hack and steal these criminals use typical APT-like tools and methods. Spear phishing campaign enables initial infection of the corporate network: a deceived employee opens an email attachment and installs malware, developed by Carbanak.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Full report on the <a href=\"https:\/\/twitter.com\/hashtag\/Carbanak?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Carbanak<\/a> APT is now live <a href=\"http:\/\/t.co\/KRmjD1GhyL\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/KRmjD1GhyL<\/a> via <a href=\"https:\/\/twitter.com\/Securelist?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@Securelist<\/a> <a href=\"http:\/\/t.co\/5OMzJE0DgS\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/5OMzJE0DgS<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/567359162536194048?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">February 16, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Once a computer is compromised, criminals seek the access to a system administrator account and then use stolen credentials to hack the domain controller and steal money from banking accounts or even change data about a company\u2019s owner.<\/p>\n<p>As far as we know, Carbanak is an international group, which includes criminals from Russia, China, Ukraine and other European countries. The gang consists of dozens of people. You can read further about Carbanak <a href=\"https:\/\/www.kaspersky.com.au\/blog\/billion-dollar-apt-carbanak\/7519\/\" target=\"_blank\" rel=\"noopener noreferrer\">in this post<\/a>.<\/p>\n<h3>I work in a bank. What should I do?<\/h3>\n<p>If you work at a financial organization, you have to be vigilant. As it\u2019s clear from the above mentioned examples, one day you can turn out to be that user who accidentally invites cybercriminals into the office. You don\u2019t want to ponder what would happen if you were that person. To avoid that, we advise you read the following articles:<\/p>\n<ul>\n<li>\n<a href=\"https:\/\/www.kaspersky.com.au\/blog\/how-to-avoid-phishing\/6145\/\" target=\"_blank\" rel=\"noopener noreferrer\">Why phishing works and how to avoid it<\/a><\/li>\n<li>\n<a href=\"https:\/\/www.kaspersky.com.au\/blog\/why-bother-with-software-updates\/6863\/\" target=\"_blank\" rel=\"noopener noreferrer\">Why it\u2019s necessary to update software<\/a><\/li>\n<li>\n<a href=\"https:\/\/www.kaspersky.com.au\/blog\/ransomware-10-tips\/10673\/\" target=\"_blank\" rel=\"noopener noreferrer\">How not to become a victim of a Trojan.<\/a><\/li>\n<\/ul>\n<p>In conclusion we\u2019d like to add that <a href=\"https:\/\/www.kaspersky.com\/internet-security?_ga=1.11155894.365796296.1438633439\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Kaspersky Lab solutions<\/a> detect and disarm all known malware, created by Carbanak, Metel and GCMAN.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Fraudsters portfolio updated: now they\u2019ve learnt to steal money from banks directly. How did it happen?<\/p>\n","protected":false},"author":522,"featured_media":11238,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,2647,2646],"tags":[499,734,963,1161,1414,605,1413,1410,1424,1412],"class_list":{"0":"post-11236","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-special-projects","9":"category-threats","10":"tag-apt","11":"tag-banking-trojans","12":"tag-carbanak","13":"tag-finance","14":"tag-gcman","15":"tag-great","16":"tag-metel","17":"tag-sas-2016","18":"tag-thesas2016","19":"tag-threat"},"hreflang":[{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/metel-gcman-carbanak\/11236\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/metel-gcman-carbanak\/6649\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/metel-gcman-carbanak\/6728\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/metel-gcman-carbanak\/6638\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/metel-gcman-carbanak\/7650\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/metel-gcman-carbanak\/7418\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/metel-gcman-carbanak\/10777\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/metel-gcman-carbanak\/11236\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/metel-gcman-carbanak\/5195\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/metel-gcman-carbanak\/5963\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/metel-gcman-carbanak\/6945\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/metel-gcman-carbanak\/10350\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/metel-gcman-carbanak\/10777\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/metel-gcman-carbanak\/11236\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.au\/blog\/tag\/apt\/","name":"APT"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts\/11236","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/users\/522"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/comments?post=11236"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts\/11236\/revisions"}],"predecessor-version":[{"id":26816,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts\/11236\/revisions\/26816"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/media\/11238"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/media?parent=11236"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/categories?post=11236"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/tags?post=11236"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}