Hackers Steal $1 Billion From Banks — Are YOU Safe?
Kaspersky Lab reported last week that a gang of hackers, known as “Carbanak” or “Anunak”, has stolen up to $1 billion (P44.2 billion) from 100 banks in 30 different nations, starting from 2013 and remaining active as of today. The Carbanak gang has been stealing money not only from banks, but also from e-payment systems and other financial institutions.
Image: Kaspersky Lab
Most of the banks robbed were in Russia, but Kaspersky Lab claims there were also many targeted banks in the US, Japan, and Europe. No banks have stepped forward to say that they are victims, but Kaspersky Lab confirms that the attacks have cost the banks at least $300 million. “The overall damage could be near $1 billion (P44.2 billion),” Kapersky Lab expert Sergey Lozhkin told Russian state-funded TV channel RT over the phone.
“These bank heists were surprising because it made no difference to the criminals what software the banks were using. So, even if its software is unique, a bank cannot get complacent. The attackers didn’t even need to hack into the banks’ services: once they got into the network, they learned how to hide their malicious plot behind legitimate actions. It was a very slick and professional cyber-robbery,” said Sergey Golovanov of Kaspersky Lab.
How did they do it?
The hackers were patient, sending wave after wave of emails with a malware called “Carbanak” that would give them access to the bank’s networks. They then spent months taking video recordings of employees’ computer screens so that they could learn how the employees used the network.
Once they understood how the employees behaved and how each bank worked, they’d use that knowledge to move money around however they wanted. They customized their attacks for each bank so they wouldn’t be detected. They could redirect money to their bank accounts or create fake accounts with high balances. They could also alter individual customers’ bank records and use it to steal money.
Image: Kaspersky Lab
For example, let’s say your account has $1,000. The hackers would alter it so that your balance would be $10,000. They’d then create a fake transaction for $9,000 and transfer it to their account. Because your balance stays the same, there are no red flags and the hackers get away with it, and it takes the bank a long time to notice that anything fraudulent has occured. By then, the hackers have already gotten away with the money.
The hack was so pervasive that the hackers could even order individual ATMs to dispense money, even without a card. “They were then remotely making the banks transfer money to ATMs, so that certain people could then come up to those ATMs and pick the money. Someone was waiting by an ATM for the money to be spitted out [sic],” Lozhkin told RT.
The gang would steal just around $10 million (P442 million) from each bank before hitting the next one, keeping a low profile so that the banks wouldn’t catch them. People only noticed the hack when in late 2013, an ATM in Kiev, Ukraine started dispensing cash for no reason.
Thomas Fox-Brewster of Forbes reports that the Carbanak hacker gang is the same gang that stole sensitive customer data from retailers such as Staples, Sheplers, and Bebe, and that they made $18 million (P796 million) in 2014 alone. “The Anunak gang was said to have brought about the “armageddon” of the Russian banking industry and is deemed one of the most sophisticated cybercriminal groups ever seen,” Fox-Brewster wrote.
How does it impact you?
Even though it was the banks’ networks that were targeted, “customers are still at risk,” said Golovanov. “Criminals had access to all banking infrastructure, so they were able to get any data about customers.”
And just because the Philippines wasn’t targeted doesn’t mean that it can’t be in the future. The Kaspersky Lab report says that “the Carbanak attackers are trying to expand operations to other Baltic and Central Europe countries, the Middle East, Asia, and Africa,” so to be safe, always be vigilant about your financial information.
Steps to protect yourself
Photo: Shutterstock
Computer experts recommend the following steps to keep you safe online generally:
- Do not open suspicious emails, especially if they have an attachment, even if it appears to be from your bank.
- Update your security software so that it has the latest data on the Carbanak malware.
- Keep an eye on your account balances and monitor for suspicious activity.
Remember that Philippine depositors are protected up to P500,000 by the Philippine Deposit Insurance Corporation (PDIC). This simple fact can protect your money from fraud and loss.
Leave your comment