Group-IB, an international company that specializes in preventing cyber attacks, has established that Silence, a Russian-speaking cybercriminal group is likely to be behind the brazen attack on Dutch-Bangla Bank’s ATMs resulting in the theft of $3 million, the amount reported by the local media. The actual amount of money stolen could be much higher. This is one of Silence’s most recent international attacks, which indicates that the gang has expanded its geography and has gone global, focusing now on APAC markets.
The final stage of the brash cyber attack, which started months earlier, took place in Dhaka on May 31, 2019, according to the local media reports. In CCTV footage posted by local newspapers two Ukrainian mules with their faces covered are seen withdrawing money from Dutch-Bangla Bank’s ATMs. They made phone calls every time before withdrawing money, which immediately prompted Group-IB’s Threat intelligence team’s interest and indicated that this could likely be involvement of an organized financially-motivated cybercriminal group rather than simple skimming attack. At the time, Group-IB Threat Intelligence team was already aware that Silence had been carrying out operations in Asia.
Group-IB has been tracking Silence and their infrastructure since 2016 and published a report «Silence: Moving into the darkside» in September 2018 which was the first to describe the group’s tactics and tools in detail. The information gathered by Group-IB’s Threat Intelligence team and comprehensive knowledge about Silence’s infrastructure suggested that Dutch-Bangla Bank’s hosts with external IPs 103.11.138.47 and 103.11.138.198 had been communicating with Silence’s C&C (185.20.187.89) since at least February 2019. During the attack on Dutch-Bangla Bank, the cybercriminals have likely used the following Trojans Silence.Downloader (aka TrueBot), Silence.MainModule (MD5 fd133e977471a76de8a22ccb0d9815b2) which allows to execute remote commands covertly and download files from the compromised server, and Silence.ProxyBot (MD5 2fe01a04d6beef14555b2cf9a717615c), which executes the tasks of the proxy server and allows the attacker to redirect traffic from a hidden node to a backconnect server via the compromised PC.
Once they gained access to the bank’s infrastructure, Silence went on to the next stage of the attack money withdrawal. One of the instances was shown on the CCTV from May 31 published by the local media. Based on the TTPs used by Silence, the money could have been stolen in one of two ways: the hackers could have either compromised the bank’s card processing system or used the custom Atmosphere software, a set of tools for ATMs jackpotting. The detailed description of Silence’s toolset is available in Group-IB’s report «Silence: Moving into the darkside».
What we see now is that Silence is continuing to shift their focus from the CIS and neighbouring countries to international markets. Having tested their tools and techniques in Russia, Silence has gained the confidence and skill necessary to be an international threat to banks and corporations. Asia particularly draws cybercriminals’ attention. Dutch-Bangla Bank is not the first Silence’s victim in the region. In total, we are aware of at least 4 targets Silence has attacked in Asia recently.
Group-IB Head of Dynamic Analysis of malware department and threat intelligence expert
