Published : 5 years ago, on 26/06/2019

By Anthony Giandomenico, Senior Security Strategist/Researcher – CTI Lead at Fortinet 

The financial services industry continues to be a target for cyber criminals who are working to steal information related to payment cards, online banking accounts, and ATM machines. These constantly evolving threats come in many forms, including ransomware, cryptomining, and other malware. Defending against risk in the finance industry is made more difficult by challenges such as the need to blend new technology with legacy systems, while meeting evolving compliance standards.

As cyber risk grows, financial institutions must be constantly aware of how they, and their customers, could be affected by a potential cyberattack. Conversely, these institutions should also have an awareness of threats that are no longer active in order to better understand the cycle of risk development. This is important, as research demonstrates that when one threat is pushed to the side, another arises to fill the gap.

Understanding the Life Cycle of a Cyber Threat 

Anthony Giandomenico

Fortinet’s Q1 2019 Threat Landscape Report highlights both the rise and fall of cyber threats that have had an impact on several industries, including financial services. One example of a threat that experienced a dramatic change this quarter was Coinhive, which originally launched in 2017. With a focus on Monero cryptocurrency, as opposed to Bitcoin, transactions between two parties on this platform were untraceable. This presented an opportunity for cyber criminals who then installed the JavaScript files on compromised websites.

While this platform found extreme success in the black market, Coinhive announced in February that it would be shutting down. This was due to both Monero crashing in value and the introduction of an algorithm update that made the process of mining Monero slower.

In spite of this one victory against cyber criminals, it should come as no surprise that, since last quarter, cyber criminals have developed several new ways of launching successful attacks.

Cyber Threats Directly Impacting Financial Services

The adoption of new technology is a critical step that the financial services industry has had to take in order to meet changing customer demands. One threat actor that has taken advantage of these digital transformation efforts is Silence Group. While this group continues to primarily target financial institutions in Russia and eastern Europe, the infrastructure they rely on to support their criminal activities has expanded to include Australia, Canada, France, Ireland, Spain, Sweden, and the United States. As time goes on, Silence Group continues to grow more sophisticated. Most recently, they have employed “living off the land” tactics that involve leveraging pre-installed and publicly available tools, such as PowerShell. This allows them to accelerate lateral movement across a network while enhancing evasiveness by leveraging processes already identified as legitimate.

By deploying a spear phishing strategy, Silence Group is able to compromise banks via email in order to gather financial data and enable attackers to remotely withdraw money from ATMs, also known as “jackpotting.” In order to achieve its goal of making as much money as possible, this group has also written their own tools, which are highly modular and crafted for the needs of a specific attack; common targets include a proxy module, a monitor module, and, unsurprisingly, an ATM module.

 Targeting Networks for Financial Gain

Similar to how Silence Group has continued to evolve since first becoming active in 2016, this report highlights other threats which have appeared to do the same this quarter. It includes Emotet, which launched several new campaigns using its latest information-stealing, ransomware, and banking Trojan modules.

One theme that stands out amongst most threats from Q1 is the shift away from random attacks and towards those that are more targeted and exacting. Tailored ransomware is becoming a choice for many cyber criminals who are looking to make a larger, more damaging impact. A top example of this attack method is demonstrated by LockerGoga, a ransomware variant that surfaced early this year. Despite causing severe disruption to several plants in Europe and the United States through attacks informed by research and due diligence, researchers have pointed out the end goal of these attacks was not extortion. There is still not a clear understanding of the motivation.

Unlike LockerGoga, Anatova has followed in the path of past ransomware attacks by demanding payment from victims in the form of Dash cryptocurrency. This variant chooses its victims carefully, not encrypting anything that can impact the permeance of the system it is infecting. Additionally, it avoids those computers that already appear to have been targeted for malware analysis or are functioning as honeypots.

 Final Thoughts

Cyber criminals continue to modify their attack methods in order to boost accuracy and better guarantee that their primary goals are achieved. For the financial services industry, this can result in the targeting of online banking accounts, payment cards, and, as was highly demonstrated in Q1, even ATM machines. In order to defend against these sophisticated threats, financial institutions must rely on threat intelligence in order to identify threats and understand the impact that a cyberattack could have on network security and customer confidence.