Research has revealed that banks, telecommunication companies and government organisations in Africa, the US, South America and Europe are among the top targets, with the GCMAN and Carbanak groups being the primary suspects.
Kaspersky Lab experts have discovered a series of “invisible” targeted attacks that use only legitimate software: widely available penetration-testing and administration tools as well as the PowerShell framework for task automation in Windows – dropping no malware files onto the hard drive, but hiding in the memory. This combined approach helps to avoid detection by whitelisting technologies, and leaves forensic investigators with almost no artefacts or malware samples to work with. The attackers stay around just long enough to gather information before their traces are wiped from the system on the first reboot.
At the end of 2016, Kaspersky Lab experts were contacted by banks in CIS which had found the penetration-testing software, Meterpreter, now often used for malicious purposes, in the memory of their servers when it was not supposed to be there. Kaspersky Lab discovered that the Meterpreter code was combined with a number of legitimate PowerShell scripts and other utilities.
The combined tools had been adapted into malicious code that could hide in the memory, invisibly collecting the passwords of system administrators so that the attackers could remotely control the victim’s systems. The ultimate goal appears to have been access to financial processes.
Kaspersky Lab has since uncovered that these attacks are happening on a massive scale: hitting more than 140 enterprise networks in a range of business sectors, with most victims located in the USA, France, Ecuador, Kenya, the UK and Russia.
In total, infections have been registered in 40 countries. It is not known who is behind the attacks. The use of open source exploit code, common Windows utilities and unknown domains makes it almost impossible to determine the group responsible – or even whether it is a single group or several groups sharing the same tools. Known groups that have the most similar approaches are GCMAN and Carbanak.
Such tools also make it harder to uncover the details of an attack. The normal process during incident response is for an investigator to follow the traces and samples left in the network by the attackers. And while data in a hard drive can remain available for a year after an event, artefacts hiding in the memory will be wiped on the first reboot of the computer. Fortunately, on this occasion, the experts got to them in time.
“The determination of attackers to hide their activity and make detection and incident response increasingly difficult explains the latest trend of anti-forensic techniques and memory-based malware. That is why memory forensics is becoming critical to the analysis of malware and its functions. In these particular incidents, the attackers used every conceivable anti-forensic technique; demonstrating how no malware files are needed for the successful exfiltration of data from a network, and how the use of legitimate and open source utilities makes attribution almost impossible,” said Sergey Golovanov, Principal Security Researcher at Kaspersky Lab.
The attackers are still active, so it is important to note that detection of such an attack is possible only in RAM, the network and registry – and that, in such instances, the use of Yara rules based on a scan of malicious files are of no use.
Details of the second part of the operation, showing how the attackers implemented unique tactics to withdraw money through ATMs will be presented by Sergey Golovanov and Igor Soumenkov at the Security Analyst Summit, to be held from 2 to 6 April, 2017.
Kaspersky Lab products successfully detect operations using the above tactics, techniques and procedures. Further information on this story and Yara rules for forensic analysis can be found in the blog on Securelist.com.
Technical details, including Indicators of Compromise were also provided to customers of Kaspersky Intelligence Services.
Combatting attacks by groups like GCMAN or Carbanak requires a specific set of skills from the security specialist guarding the targeted organisation. During the Security Analysis Summit 2017, Kaspersky Lab’s top-notch specialists will be running exclusive security training sessions designed to help specialists detect sophisticated targeted attacks. Apply for training on “Hunting targeted attacks with Yara rules” here. Apply for training on Malware reverse engineering here.
Mobile is the new branch
Standard Bank has launched an account for mobile devices that gives back 500MB of data a month
Standard Bank has introducd a R4.95p/m bank account called MyMo that customers can open on their mobile devices, loaded with data and airtime offerings and other benefits such as virtual and Gold physical card.
MyMo account holders will also enjoy the convenience of a cheque account through a Visa and Mastercard gold card. Once the account is open, users can choose to either receive R50 in airtime or 500MB of data a month, if their card is swiped more than four times a month. A further megabyte of data is loaded on the account for every R20 spent.
“MyMo is an account for everyone, whether you just landed your first job or have been around the block. With no documentation required it only takes a few minutes to open the account,” says Funeka Montjane, Chief Executive for Personal and Business Banking, South Africa, at Standard Bank Group. “For just R4.95 a month customer will be able to enjoy free swipes and ATM withdrawals at only R6.50 for amounts under R 1 000.
“Mobile is the new branch. This account is about bringing the mobile branch into customers hands, it is about convenience and security while banking.”
She says mobile offers low cost transactional banking which integrates people and businesses into the new connected economy, making mobile the new branch ecosystem that will drive and connect Africa’s growth. Physical connections to the economy are rapidly changing to digital where banks have to move from being financial institutions to service organisations.
“In the past people congregated in communities and eventually cities to maximise the advantages of connectivity. Today a simple hand-held device has the potential to open infinite doors, transforming individuals’ access to opportunities, regardless of where they are, and like never before in history.
“Historically, a bank account represented access to economic citizenship. Today, having a simple device enabling digital access to a modern banking platform is a passport to global connectivity and vast human development potential.”
The bank says it is using technology, and mobile phones in particular, to deliver low-cost transactional channels accessible to all our customers. The evolution in mobile can be seen in transaction options like cash back at the retail checkout till rather than the ATM, free digital banking rather than using a branch, and the ability to transact using digital wallets, even without a bank account.
“Developing comprehensive connected ecosystems requires a mind-set change from Africa’s banks,” says Montjane. “Banks will evolve away from traditional financial service organisations, into service ecosystems enabling broad universal access to almost everything like enhanced purchasing experiences of vehicles and homes, online procurement of goods and services and lifestyle elements like rewards and travel.
“These connectivity drivers will also act to future-proof evolving connectivity ecosystem by allowing us to offer untold future services while deriving income from as yet unrealised revenue streams,.
From a customer perspective, the kind of ecosystems of knowledge, access and, ultimately, connectivity that banks will come to provide will radically transform the share of life that almost all individuals will be able to access.”
Two-thirds of SA staff hide social media from bosses
With 90% of people in employment going online several times a day, it can be hard for most workers to keep their private and work-life separate during the working day (and beyond). The recently published Global Privacy Report from Kaspersky Lab reveals that 64% of South African consumers choose to hide social media activity from their boss. This secretive stance at work also extends to their colleagues, with 60% of South Africans also preferring not to reveal online activities to their co-workers.
Globally, the average employee spends an astonishing 13 years and two months at work during their lifetime. Interestingly though, not all this time is directly related to solving work tasks or earning a promotion: almost two thirds (64%) of consumers admit visiting non-work-related websites every day from their desk.
Not surprisingly, 35% of South African employees are against their employer knowing which websites they visit. However, more interestingly, 60% of South African are even against their colleagues knowing about their online activities. This probably means that colleagues constitute an even greater threat to future perspectives of an office slouch or maybe the relationships with colleagues are more informal and therefore, more valuable.
On the contrary, social media activity appears to be a less private domain for many and therefore, more suitable for sharing with colleagues but not the boss. This is probably because workers fear harming the public image of a company or interest in decreased staff productivity motivates companies to monitor employees’ social networks and make career changing decisions based on that. Such policies have led to 64% of South Africans saying that they don’t want to reveal their social media activities to their boss and 53% even don’t want to disclose this information to their colleagues.
A further 29% are against showing the content of their messages and emails to their employer. In addition, 3% even said that their career was irrevocably damaged as a consequence of their personal information being leaked. Thus, people are worried about how to build a favourable internal reputation and how not to destroy existing workplace relationships.
“As going online is an integral part of our life nowadays, lines continue to blur between our digital existence at work and at home. And that’s neither good nor bad. That’s how we live in the digital age. Just keep remembering that as an employee you need to be increasingly cautious of what exactly you post on social media feeds or what websites you prefer using at work. One misconceived action on the internet could have an irrevocable long-term impact on even the most ambitious worker’s ability to climb the career ladder of their choice in the future,” comments Marina Titova, Head of Consumer Product Marketing at Kaspersky Lab.
To ensure workers don’t fall prey of the internet threats at a work, there are some core guidelines to adhere to in the digital age:
- Don’t post anything that could be considered defamatory, obscene, proprietary or libellous. If in doubt, don’t post.
- Be aware that system administrators may at least, in theory, be informed about your web browsing patterns.
- Don’t harass, threaten, discriminate or disparage against any colleague, partner, competitor or customer. Neither on social networks or in messages, emails, nor by any other means.
- Don’t post photographs of other employees, customers, vendors, suppliers or company products without prior written permission.
- Start using Kaspersky Password Manager to ensure your social media and other personal accounts are not at risk of unauthorised access by someone else in an office. Install a reliable security solution such as Kaspersky Security Cloud to protect your personal devices.