GCMAN: At the Security Summit for the Security Analyst Summit (SAS 2016) held in Tenerife, Spain, Kaspersky researchers uncovered a new cybercrime group.
The group is called GCMAN and targets Russian banks.
The nickname comes from GCC (GNU Compiler Collection), the compiler the group used to create their custom-made malware.
The distribution of the malicious software was carried out via spear-phishing e-mail that are sent to key individuals through the bank's organogram.
If these individuals open the malicious RAR file attached to the e-mail, their computer becomes infected with the group's malicious software.
This malware is specifically designed to move within the bank's IT infrastructure. It actively searches for computers that are handling financial transactions using penetration testing tools such as Meterpreter, Putty, and VNC to gain access to the systems.
Once it discovers machines that perform transactions, the malware uses a simple cron script that starts sending $200 per minute to various cryptocurrency accounts, which are obviously controlled by the malware's developers.
The cron script of GCMAN was discovered by accident
Kaspersky reports the script was discovered by chance by a bank employee who encountered the GCMAN malware and managed to stop it before it executed a transaction.
Immediately afterwards, Kaspersky researchers discovered that the entire network of the bank's computers that performed transactions contained the malicious software. The infection had occurred 18 months earlier on a computer.
The hackers used the machine to attack 70 other computers on the bank's network, and to breach the 56, until they gained access to what they were looking for. Eighteen months later, they returned to place the cron script on the server and start the withdrawals. However, it seems luck was not on their side.
