Full Report
Group-IB has uncovered a hacker group attacking banks in the USA and Russia
Analysis Summary
# Threat Actor: MoneyTaker
## Attribution & Identity
* **Name:** MoneyTaker
* **Aliases:** None mentioned, though they are identified as a distinct, organized hacker group.
* **Identity:** A sophisticated group characterized by their ability to remain undetected for long periods (over 1.5 years) and their proficiency in targeting financial transfer and processing systems.
## Activity Summary
MoneyTaker has conducted over 20 successful attacks across the USA, UK, and Russia. Their activities date back to at least May 2016. The group is notable for its "silent operations," carefully erasing traces of their presence and utilizing legitimate administration tools to blend in with normal network traffic. Their primary focus is the compromise of inter-bank transfer systems and card processing platforms.
## Tactics, Techniques & Procedures
* **Initial Access:** Compromising internal networks via the home computers of bank system administrators.
* **Persistence:** Use of PowerShell and VBS scripts, which are difficult for traditional antivirus to detect and easily modifiable.
* **Evasion:**
* Use of "fileless" malware that exists only in RAM and is deleted upon reboot.
* Eradication of malware traces and logs after successful operations.
* Making "on the fly" changes to source code during an active attack.
* **C2 Communication:**
* Employing SSL certificates generated using legitimate brand names (e.g., Bank of America, Federal Reserve Bank, Microsoft, Yahoo) to bypass security filters.
* Utilization of LogMeIn Hamachi for remote access (particularly in US-based attacks).
* **Post-Exploitation:** Modifying cash withdrawal and overdraft limits within compromised card processing systems to facilitate large-scale ATM withdrawals by money mules.
**MITRE ATT&CK Mapping (Derived from text):**
* **T1059.001/.005:** Command and Scripting Interpreter (PowerShell and VBScript)
* **T1027.004:** Fileless Storage
* **T1588.004:** SSL/TLS Certificates (Impersonating known brands)
* **T1219:** Remote Access Software (LogMeIn Hamachi)
* **T1070:** Indicator Removal on Host
## Targeting
* **Sectors:** Financial Services, Banking, and Card Processing.
* **Geography:** USA, Russia, and the UK.
* **Victims:** Multiple banks (unnamed), First Data’s STAR network portal operators.
## Tools & Infrastructure
* **Malware:** Custom "fileless" malware, PowerShell scripts, and VBS scripts.
* **Remote Access:** LogMeIn Hamachi.
* **Infrastructure:** C2 servers utilizing spoofed SSL certificates.
* *Note: Specific IPs/URLs were not provided in the source text for defanging.*
## Implications
MoneyTaker represents a high-tier threat to the global financial sector. Their ability to compromise the personal devices of privileged users (sysadmins) to bridge the gap into corporate networks highlights a significant weakness in traditional perimeter security. Their focus on high-value transfer systems (like STAR) rather than just consumer banking indicates a strategic objective of high-volume theft. Their stealthy nature suggests they may maintain long-term residency in networks before executing a final strike.
## Mitigations
* **Endpoint Security:** Implement Advanced Endpoint Detection and Response (EDR) solutions capable of detecting fileless malware and unauthorized PowerShell/VBS execution.
* **Network Monitoring:** Inspect SSL traffic for anomalies and monitor for the use of unauthorized remote access tools like Hamachi.
* **Privileged Access Management (PAM):** Enforce strict policies for system administrators, including the prohibition of using personal devices for work-related tasks and mandatory Multi-Factor Authentication (MFA).
* **Limit Management:** Implement real-time monitoring and alerting for unauthorized changes to withdrawal and overdraft limits within card processing environments.
* **Zero Trust:** Implement a Zero Trust architecture to minimize lateral movement if a system administrator's credentials or home device are compromised.