Will the traditional way of robbing a bank become a thing of the past? Not likely, as not all bank robbers are tech savvy.
Nevertheless, in today’s hi-tech world, cyber criminals resort to hacking into computers systems to steal money. In this case, the criminals sent out malicious emails to unsuspecting people who were the employees of numerous banks across the world.
In this way, since late 2013, an unknown hacker group has infiltrated a number of banks and financial institutions, stealing hundreds of millions of dollars. It has been reported that the amount of money stolen is to the tune of $300 million or more. More than 100 banks and financial institutions in 30 countries were attacked, making it one of the largest, if not, the largest bank heist in history.
The infected emails contained a news clip or message that seemed to come from their colleagues. When the bank employees clicked on the email, they unknowingly downloaded the malware, called Carbanak. The malware lurked for months in the computer systems, sending back video feeds and images to the criminals on how the bank conducted its daily routines. The criminals were able to crawl across the bank’s network until they found employees who administered cash transfers or remotely connected ATMs and recorded every move of the employees. As such, the criminals were able to impersonate bank officers to turn on various cash machines (ATMs) and transfer millions of dollars from banks in Russia, Japan, Switzerland, USA, and the Netherlands into dummy accounts set up in other countries. In this way, everything looked like normal, everyday transaction.
The period it took to transfer cash out the bank was reported to be between two to four months. The criminals used various methods to steal the money:
- Transferring money into hacker’s account.
- e-payment systems to send money to fraudulent overseas accounts.
- Direct ATMs to dispense cash at allocated time and locations to one of their associates.
According to the NY Times report, the largest sums were stolen by hacking into a banks accounting system and briefly manipulating account balances. As the criminals were impersonating bank officers, they would first inflate a balance – $1,000 would be altered to show $10,000. Then $9,000 would be transferred out of the bank. The account holder would be unaware that something is amiss and it would take the bank some time to figure out what happened. Kaspersky Lab found that many banks only check the accounts every 10 hours or so. In the mean time, the criminals could change and transfer the money.
Surprisingly, no banks have come forward to reveal that they have been hacked.
Below is a map of the Carbanak malware targets.
Source
- The Hacker News.
- Kaspersky Lab via the New York Times.