A WAVE OF cyber attacks is likely to have stolen at least $80 million (€64, 024, 517) from bank accounts in Europe, the United States and elsewhere, a security report says this evening.
The joint report by Guardian Analytics and McAfee said ‘Operation High Roller’ was led by criminals attacking cloud-based servers in a global fraud campaign.
The report from the two US firms said the attacks tried to steal between $75 million (€60 million) and $2.5 billion (€2 billion) from at least 60 banks worldwide.
The ring used “sophisticated” techniques including automation and targeted high-value accounts in Europe before moving to Latin America and the United States, it said.
A statement from Guardian Analytics said:
This is a serious new threat that is actively targeting American financial institutions. To the best of our knowledge the scheme has already netted nearly $80 million worldwide, and it could be much higher.
Attempted transfers
The report offers insight into hacking into banks, which is often not disclosed by financial institutions.
As this research study goes to press, we are working actively with international law enforcement organizations to shut down these attacks.
In the attacks uncovered earlier this year, the criminals “attempted transfers to mule business accounts as high as €100,000,” the report said.
Where Europe has been the primary target for this and other financial fraud rings in the past, our research found the thefts spreading outside Europe, including the United States and Colombia.
In the United States, “victims were all companies with commercial accounts with a minimum balance of several million dollars.”
Spear phishing
In most cases, the victims were found through online reconnaissance and “spear phishing,” which uses a fake email to get an account holder’s login details and password.
The first attacks affected “a popular bank in Italy and its consumer and business accounts” and used SpyEye and Zeus malware to transfer funds to a “mule account” or pre-paid debit card where the thief could retrieve the funds quickly and anonymously.
But later attacks showed increased automation and sophistication, in some cases taking over the victim’s account without an attacker’s active participation. In some cases, the criminals were able to bypass smartcard readers which offer extra authentication used in many European banks.
“This ring adds many breakthroughs: bypasses for physical ‘chip and pin’ authentication, automated mule account databases, server-based fraudulent transactions,” the report said.
It said the attacks hit “every class of financial institution: credit union, large global bank, and regional bank.”
In some attacks, transactions were routed through a server in California, but the researchers said they “found evidence of the fraudster logging in from Moscow, Russia, to manipulate some of the transactions.”
To embed this post, copy the code below on your site
have your say