A Russian cybercriminal group consisting of highly skilled hackers has carried out targeted attacks on financial institutions, stealing approximately $25 million since 2013, using Anunak, a Trojan built with code from the infamous Carberp.
More than 50 Russian banks and five payment systems have been hacked, but it appears that in 2014 the group's focus shifted to US and European retail businesses, which were compromised using malware for terminals PoS.
The hackers carried out spear-phishing attacks to breach the targeted network, and each successful attack resulted in the theft of an average of $2 million. The hackers targeted users with administrative privileges, such as technical support engineers, and continued to move within the network until they gained access to the banking system’s servers and management terminals.
Hacking email servers was also part of their efforts to monitor internal communications. “This approach allowed them to track when their activity was detected on the network, what technique was used to detect the activity, and what steps bank employees took to address the issue,” says a report based on findings by security firm Group-IB and Fox-IT.
Through monitoring the hacker group's activity, security researchers discovered that the main members are citizens of Russia and Ukraine, but they collaborated with other cybercriminals, such as botnet operators, to distribute malware.
However, it was observed that the Anunak Trojan created in August 2014, with its own botnet, affected over 500,000 computers in the first half of the year.
Once hackers gained access to the bank's internal network, they attempted to gain complete control over transactions, as well as the network of ATMs belonging to the target.
It took hackers an average of 42 days from the time a target was breached to the time they were able to extract money.
In addition to bank and retailer thefts, the Anunak group has also been involved in cyber espionage operations targeting government agencies, according to researchers.
The servers used by the cybercriminals were located in Kazakhstan, Germany, and Ukraine and belonged to a service that also offered traffic routing through the network TOR and VPN servers.
