A notorious hacking gang has struck again, stealing almost £700,000 ($910,000) from a Russian bank, reports a cyber-security company.
The raid is believed to have been carried out by the MoneyTaker gang which has hit other financial firms. In 2017 it was suspected of stealing nearly £7.5m ($10m) from Russian, British and American companies.
Group-IB was called in to help Russia’s PIR Bank after it noticed the theft. They reported that the cash was taken in a series of transfers on 3 July via a computer at the bank to which the gang had obtained access.
Staff at PIR were able to stop some of the transfers, said Group-IB, but the gang’s swift action to “cash out” using paid helpers or “mules” at ATMs stopped the bank recovering much of it.
Group-IB said the tools and techniques used by the gang to penetrate the bank and lurk on its internal systems were known to have been used by MoneyTaker in other robberies.
The attack began in late May, said Group-IB, and initially concentrated on a piece of networking hardware known as a router, which the gang was able to compromise. By taking over this router, the gang gained access to the bank’s internal network.
Once on the network, the gang took time to find a specific computer used to authorise transfers of cash. It then used its knowledge of this system, known as the Automated Work Station Client of the Russian Central Bank (AWS-CBR), to set up the bogus transfers.
“In 2016, МoneyTaker hackers withdrew about $2m using their own self-titled program, and this remains one of the largest attacks of this kind”.