Fileless Malware Attack on Russian Banks Helps Hackers Steal $800K

[Bot]

Two banks in Russia were hit by fileless malware that allowed attackers to get away with $800,000 in a single night. Had it not been for surveillance cameras, the banks wouldn't have even known something was amiss.

So how does this whole thing work? Well, this type of fileless malware uses the legitimate tools on the ATM machine so that no malware gets installed on the system. Alternatively, attackers use malware that resides only in the infected machines RAM, rather than on the hard drive. once it's gone, there's very little evidence it was even there.

During Kaspersky's Security Analyst Summit, the firm's principal security researcher Sergey Golavanov, delved into the attack that targeted two Russian banks.

With no malware evidence in its systems, the banks had CCTV recordings showing a culprit walking to the ATM and grabbing stacks of bills like it was the most natural thing in the world. About $100,000 worth of cash was taken from each machine and it took ...

Read more: Fileless Malware Attack on Russian Banks Helps Hackers Steal $800K

 

[Luke17]

Very interesting attack. I wonder how exactly the legitimate tools running on ATMs are subverted by hackers. I guess it is very difficult to have access to those tools while they run on ATMs. Can something like this happen without an insider ? (e.g. via the internet, somehow)

 

[Winter Soldier]

This type of attack is very dangerous. Unlike normal malware, new malicious code are not installed on the hard disk, but they work in RAM, where they remain long enough to allow hackers to put their hands on user data. Indeed when your PC restarts, every track is eliminated by the resetting of the RAM memory. In this way, it becomes really difficult to find the malware and its authors.

 

[In2an3_PpG]

This type of attack is very dangerous. Unlike normal malware, new malicious code are not installed on the hard disk, but they work in RAM, where they remain long enough to allow hackers to put their hands on user data. Indeed when your PC restarts, every track is eliminated by the resetting of the RAM memory. In this way, it becomes really difficult to find the malware and its authors.

If only they had AppGuard

 

[Deleted member 178]

If only they had AppGuard

ROFL, i was thinking the same

 

[509322]

If only they had AppGuard

ROFL, i was thinking the same

There is an ATM version of AppGuard.

The linked article provides insufficient information so I won't even hazard a guess.

 

[Solarquest]

Security researchers have uncovered one of the most sophisticated ATM heists to date, involving a group of cyber criminals specialized in hacking bank networks using fileless malware, and ATM malware that spits out cash and then self-deletes.

These ATM heists are the work of a group of hackers that's been active for years. Most recently, starting 2016, this group has switched to using legitimate Windows apps and fileless malware to hack into government agencies and banks in at least 40 countries.

Because those attacks used stealthy techniques that left a minimal footprint on infected servers, investigators weren't able to detect what the crooks were after. Nevertheless, they suspected the hackers stole data from infected systems, albeit they didn't know what data.

Hackers breached banks to get control of ATM systems
......

 

[Winter Soldier]

I read today this news, well if malware is working in RAM (volatile memory ) then I think we need Ghostbusters