Menu

19 February 2019

Group-IB: More than 70% of Russian banks are not ready for cyberattacks

Group-IB, an international company that specializes in preventing cyberattacks, has conducted high-tech cybercrimes research based on an analysis of responses to information security incidents carried out by Group-IB Incident Response team in 2018. According to the new research, hackers traditionally target the financial sector. Even so, 74 percent of banks were not ready for cyberattacks, 29 percent were found to be actively infected with malware, and in 52 percent of cases traces of past attacks were detected. According to experts, one of the most dangerous trends of the past year is cross-border domino-effect cyberattacks, in which the infected infrastructure of a compromised bank is used to spread the infection further to other banks. In 2018, Group-IB Incident Response team has detected the use of such vector in Russia and Eastern Europe.

The total number of Group-IB incident responses has more than doubled compared to 2017. Topping the list of the main threats faced by the compromised companies are targeted attacks, competitive espionage, ransomware attacks, and cryptomining. The main conclusion of Group-IB’s digital forensic lab is that the vast majority of Russian companies affected by hacker attacks last year did not have incident response plan and therefore were not ready to quickly mobilize its information security departments, the personnel of which are in turn often unable to resist the attackers. Group-IB experts highlight the high probability of repeated incidents in such companies.

 

An unfortunate fact: banks aren’t ready to defend against threat actors

According to the incident response study, banks were the targets of about 70% of hacker activity last year. Hackers still use the same cashing-out schemes as they used to: the stolen funds are withdrawn using payment cards pre-opened in a targeted bank, dummy law firm accounts, payment systems, ATMs and SIM cards. At the same time, the volume of cashing out in Russia has increased several times: a cash-out of 3 million USD took on average about 25-30 hours 3 years ago, but in 2018 there were incidents in which the same amount was successfully cashed out in less than 15 minutes at a time in different Russian cities.

Analysis of data obtained by Group-IB during incident responses revealed that 74 percent of banks attacked in 2018 were not ready for cyberattacks. At the same time, more than 60 percent of them turned out to be unable to centrally manage their networks (especially in the case of geographically distributed infrastructure). In more than 80 percent of financial organizations affected by the hacking activity, no sufficient level of event logging over a longer period (more than a month) was observed. Insufficient cooperation between internal departments is an additional factor that plays into the hands of attackers: more than 65 percent of the financial organizations, where the Group-IB IR team worked, spent more than 4 hours for coordination of work between departments. Meanwhile, an average of 12 hours were spent on meetings, granting access and routine work as part of one incident response.

Group-IB research revealed not only low level of elaboration of organizational procedures for establishing the source of an infection, determining the extent of compromise, and localization of the incident, but also insufficient technical skills of banks personnel. According to Group-IB researchers, 70 percent of the organizations have insufficient or no specialized skills to detect infection traces and unauthorized network activity. The same percentage lacks well-defined procedures for self-detection of hardware and software compromises. High risks result from technical specialists’ lack of readiness to react quickly to cyber incidents: according to Group-IB, more than 60 percent of banks are unable to carry out a centralized one-time change of all passwords in a short time, which allows hackers to attack new targets from within the compromised infrastructure of the bank.

A bank with compromised infrastructure can not only lose money, but also become a threat to other players in the financial market. A financially motivated hacker group always seeks to maximize the gains: by taking control over a bank’s systems it aims not only to withdraw money from a compromised bank but also to infect as many new victims as possible. For this purpose, hackers use „a domino effect“: they send out malicious phishing emails from the compromised infrastructure using the database of the bank’s partner companies. This attack vector dangerous, first of all, because these emails are sent from a legitimate bank, and the sender is not faked, which increases the probability of opening the malicious attachment. Thus, a chain reaction is started, and this can lead to multiple infections of financial institutions. In 2018, we detected the use of this vector both in Russia and Eastern Europe..

Valery Baulin

Valery Baulin

Head of Group-IB Digital Forensics Lab

Hidden agenda

According to Group-IB, at least 17 percent of companies, where incident response was carried out, have been targeted through previously unaddressed vulnerabilities within a year after the last infection. In the vast majority of cases, this was a consequence of a failure to comply with recommendations, as well as negligence of bank employees. In addition, during 2018, Group-IB experts detected active infections in 29 percent of financial sector organizations, unknown to the internal information security service. In 52 percent of cases, traces of past attacks were found.

In 2018, the Group-IB Incident Response team recorded cases in which cyberattacks were organized in order to create a negative image around a bank, leading to reputational damage and in some cases bank’s departure from the market.

A sharply negative image is created around the bank: estimates of potential damage may appear, along with negative information about bank’s level of protection. The media throw in the possible revocation of its banking license. There is an outflow of clients and partners, and the bank faces insufficient capitalization. Using cyberattack as a tool to damage bank’s reputation and even to squeeze a competitor out of the market is another dangerous vector, which can become even more popular, as the level of cyber security of smaller banks is still extremely low

Valery Baulin

Valery Baulin

Head of Group-IB Digital Forensics Lab

Group-IB is one of the leading providers of solutions aimed at detection and prevention of cyberattacks, online fraud, and IP protection. Group-IB Threat Intelligence system was named one of the best in class by Gartner, Forrester, and IDC.

Group-IB’s technological leadership is built on company’s 16 years of experience in cybercrime investigations all over the world and 55 000 hours of incident response accumulated in the largest forensic laboratory in Eastern Europe and a 24/7 CERT-GIB.

Group-IB is a partner of INTERPOL, Europol, and a cybersecurity solutions provider, recommended by SWIFT and OSCE. Group-IB is a member of the World Economic Forum.

Report an incident

24/7 Incident Response Assistance +65 3159-4398

Thank you for the inquiry! We will contact you soon.
Cookies

We use cookies on the website to make your browser experience more personal, convenient and secure. You may block or manage the use of cookies, however, in some cases they’re essential to make this site work properly. Learn more about cookies in Group-IB Privacy And Cookies Policy.

 
Report an incident