Connect with us

E-Financial

Kaspersky Exposes How Hackers ‘Lazarus Group’ Terrorise Banks

Published

on

Kindly share this post

The results of its more-than-year-long investigation into the activity of ‘Lazarus’, a notorious hacking group allegedly responsible for the theft of 81 million dollars from the Central Bank of Bangladesh in 2016 has been disclosed by Kaspersky Lab.

During the forensic analysis of artefacts left by the group in South-East Asian and European banks, Kaspersky Lab has reached a deep understanding of what malicious tools the group uses and how it operates while attacking financial institutions, casinos, software developers for investment companies and crypto-currency businesses around the world.

This knowledge has helped to interrupt at least two other operations which had one goal – to steal a large amount of money from financial institutions.

In February 2016, a group of hackers (unidentified at that time) attempted to steal $851 million USD, and managed to transfer 81 million USD from the Central Bank of Bangladesh. This is considered to be one of the largest, most successful cyber heists ever.

Further investigation conducted by researchers from different IT security companies including Kaspersky Lab revealed a high chance that the attacks were conducted by Lazarus – a notorious cyber espionage and sabotage group responsible for a series of regular and devastating attacks, and known for attacking manufacturing companies, media and financial institutions in at least 18 countries around the world since 2009.

Although several months of silence followed the Bangladesh attack, the Lazarus group was still active. They had been preparing for a new operation to steal money from other banks and, by the time they were ready, they already had their foot in a financial institution in South East Asia. After being interrupted by Kaspersky Lab products and the following investigation, they were set back for another few months, and later decided to change their operation by moving to Europe. But here too, their attempts were interrupted by Kaspersky Lab’s security software detections, as well as the quick incident response, forensic analysis, and reverse engineering with support from company’s top researchers.

Lazarus Formula
Based on the results of the forensic analysis of these attacks, Kaspersky Lab researchers were able to reconstruct the modus operandi of the group.

Initial compromise: A single system inside a bank is breached either with remotely accessible vulnerable code (i.e. on a webserver) or through a watering hole attack through an exploit planted on a benign website. Once such a site is visited, the victim’s (bank employee) computer gets malware, which brings additional components.

Foothold established: Then the group migrates to other bank hosts and deploys persistent backdoors – the malware allows them to come and go whenever they want.

Internal reconnaissance: Subsequently the group spends days and weeks learning the network, and identifying valuable resources. One such resource may be a backup server, where authentication information is stored, a mail server or the whole domain controller with keys to every “door” in the company, as well as servers storing or processing records of financial transactions.

Deliver and steal: Finally, they deploy special malware capable of bypassing the internal security features of financial software and issuing rogue transactions on behalf of the bank.

Geography and Attribution
The attacks investigated by Kaspersky Lab researchers lasted for weeks. However, the attackers could operate under the radar for months.

For example, during the analysis of the incident in South-East Asia, experts discovered that hackers were able to compromise the bank network no less than seven months prior to the day when the bank’s security team requested incident response. In fact, the group had access to the network of that bank even before the day of the Bangladesh incident.

According to Kaspersky Lab records, from December 2015, malware samples relating to Lazarus group activity appeared in financial institutions, casinos software developers for investment companies and crypto-currency businesses in Korea, Bangladesh, India, Vietnam, Indonesia, Costa Rica, Malaysia, Poland, Iraq, Ethiopia, Kenya, Nigeria, Uruguay, Gabon, Thailand and several other countries.

The latest samples known to Kaspersky Lab were detected in March 2017, showing that attackers have no intention of stopping.

Even though attackers were careful enough to wipe their traces, at least one server they breached for another campaign contained a serious mistake with an important artefact being left behind. In preparation for operation, the server was configured as the command & control center for the malware.

The first connections made on the day of configuration were coming from a few VPN/proxy servers indicating a testing period for the C&C server. However, there was one short connection on that day which was coming from a very rare IP address range in North Korea.

According to researchers, that could mean several things:

The attackers connected from that IP address in North Korea.

It was someone else’s carefully planned false flag operation.

Someone in North Korea accidentally visited the command and control URL.

The Lazarus group heavily invests in new variants of their malware. For months they were trying to create a malicious toolset which would be invisible to security solutions, but every time they did this, Kaspersky Lab’s specialists managed to identify unique features in how they create their code, allowing Kaspersky Lab to keep tracking the new samples. Now, the attackers have gone relatively quiet, which probably means that they have paused to rework their arsenal.

“We’re sure they’ll come back soon. In all, attacks like the ones conducted by Lazarus group show that a minor misconfiguration may result in a major security breach, which can potentially cost a targeted business hundreds of millions of dollars in loss. We hope that chief executives from banks, casinos and investment companies around the world will become wary of the name Lazarus,” said Vitaly Kamluk, Head of Global Research and Analysis Team APAC at Kaspersky Lab.

The company is also releasing crucial Indicators of Compromise (IOC) and other data to help organisations search for traces of these attack groups in their corporate networks.

“We urge all organisations to carefully scan their networks for the presence of Lazarus malware samples and, if detected, to disinfect their systems and report the intrusion to law enforcement and incident response teams”, added Vitaly Kamluk.

 

 


Kindly share this post

Nigeria CommunicationsWeek believes that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. So since 2007, we have devoted our energy to independent reportage of technology and how they affect lives.

Continue Reading
Comments

E-Financial

FG Makes u-Turn on Bank Account Re-Registration

Published

on

Kindly share this post

Federal government on Friday apologised for asking all account holders in financial institutions in the country to re-register their personal details.

FG makes u-Turn on Bank Account Re-Registration

Recall that the federal government had on Thursday ‎ordered that all persons holding accounts across financial institutions and insurance firms should complete and submit self-certification forms to their respective financial institutions.

The notice issued by the government to that effect read, ‎“This is to notify the general public that all account holders in Financial Institutions (Banks, Insurance Companies, etc.) are required to obtain, complete, and submit Self – Certification Forms to their respective Financial Institutions.

“Persons holding accounts in different financial institutions are required to complete and submit the form to each one of the institutions. The forms are required by the relevant financial institutions to carry out due diligence procedures, in line with the Income Tax Regulations 2019.‎”

The directive raised eyebrows, as account holders already possessed Bank Verification Numbers.

Following widespread condemnation that trailed the directive, the Federal Government backtracked on Friday, saying the fresh guidelin‎e was not for all Nigerians.

The government attributed the development to misinformation.

The clarification issued by the government on Friday read, ‎“We apologise for the misleading tweets (now deleted) that went up yesterday, regarding the completion of self-certification forms by Reportable Persons. The message contained in the notice does not apply to everybody. ‎FIRS will clarify Nigerians on the objectives of the directive.”

Also on Friday, FIRS, in a statement posted on Twitter, explained that the guidelines were only for non-residents, as well as people paying tax in more than one country.

Parts of the FIRS statement read, “The Self Certification Form is basically to be administered on Reportable Persons, holding accounts in Financial institutions, that are regarded as “Reportable Financial Institutions” under the CRS.

“Reportable persons are often non-residents and other persons, who have residence for tax purposes in more than one jurisdiction or country.”

“The information that indicates an account holder is a resident for tax purposes in more than one jurisdiction, is expected to be available to Financial Institutions during account opening processes, for the KYC and AML purpose.”


Kindly share this post
Continue Reading

E-Financial

Stanbic IBTC Bank Disowns Lagos ATM Fraudster

Published

on

Kindly share this post

Stanbic IBTC Bank PLC has disowned Tope Olajide, 22-year-old fraudster arraigned for theft of customers deposits.

Stanbic IBTC Bank Disowns Lagos ATM Fraudster

The Bank said this in a statement on Wednesday.

The statement said: “The attention of the management of Stanbic IBTC Bank PLC has been drawn to news currently circulating in the media, about the alleged arraignment of staff of the Bank on charges bordering on the theft of customers deposits.

“The Bank would like to clarify that the defendant, a 22-year-old Tope Olajide, IS NOT, and was at no point in time an employee of Stanbic IBTC Bank PLC.

“The alleged culprit was apprehended around 7:30 am, on Thursday, 27 August 2020, by security operatives after he was exposed by CCTV footage using ATM cards he had allegedly stolen and converted, to make withdrawals from the accounts tied to the stolen ATMs.

“The CCTV footage also showed the alleged culprit pretending to assist customers at ATMs whilst also attempting to fraudulently dispossess the customers of their ATMs.

“He was subsequently arraigned before an Ikeja Magistrate Court on Monday, 14 September, for stealing the debit cards of two customers and using them to unlawfully withdraw the sum of N427,000.

“The Bank would also like to implore members of the public to be security conscious when conducting transactions at ATMs. Customers are advised to report any suspicious actions around them to security operatives who are usually stationed around the Bank’s ATMs, when carrying out transactions at any of our ATM locations.

“As an organisation, we hold dear the values of integrity, and we will continue to prioritise the safety of our customers effectively.”


Kindly share this post
Continue Reading

E-Financial

Buhari Okays Establishment of CBN-Led Infraco

Published

on

Kindly share this post

President Muhammadu  Buhari has approved the establishment of an   Infrastructure Company (Infraco) to be driven by the Central Bank of Nigeria (CBN) in partnership with the African Finance Corporation (AFC) and the Nigerian Sovereign Investment Authority (NSIA).

Buhari Okays Establishment of CBN-Led Infraco

Mr. Godwin Emefiele, CBN governor

This is coming  on the heels of the foreign reserves’ slump to $36 billion following a cocktail of monetary policy interventions by the apex bank to cushion the scathing effects of the COVID-19 pandemic on the economy.

Mr Godwin Emefiele, CBN governor, made these disclosures in Abuja at the annual conference of the Chartered Institute of Bankers of Nigeria (CIBN) with the theme: Facilitating a Sustainable Future: The role of Banking and Finance.

According to him, Infraco would enable the use of private and public capital to support infrastructure investment that will have a multiplier effect on growth across critical sectors.

“This entity would also be able to raise funds from the capital markets and mobilise long term finance to address some of our infrastructure needs, while providing reasonable returns to investors. “We believe this well-structured fund can act as a catalyst for growth in the medium and the long run. The support of the banking community will be important in achieving this objective.

“A well-built infrastructure system, comprising hard infrastructure such as roads and ports, and soft infrastructure such as broadband penetration, can have a multiplier effect on growth by enabling the expansion of business activities in the country”, he explained.

On foreign reserves, Emefiele attributed its crash to the decline in foreign exchange earnings and subsequent adjustments in the value of the naira to the dollar.


Kindly share this post
Continue Reading

Trending