Buhtrap: The Evolution of Targeted Attacks Against Financial Institutions
← Research Hub

Buhtrap: The Evolution of Targeted Attacks Against Financial Institutions

The report outlines the activity of the most dangerous and comprehensive cybercriminal group attacking internal banking systems.

Key facts

13

successful attacks against banking institutions conducted between August 2015 and February 2016

$25 mln

stolen from Russian banks

$2 mln

average banking losses per incident

62%

the average amount of theft as compared to the bank’s charter capital

Find the most recent details about

Tactics, Technics and Procedures (TTPs) and detailed descriptions of attack vectorsTactics, Technics and Procedures (TTPs) and detailed descriptions of attack vectors

How the malware spreads through internal banking networkHow the malware spreads through internal banking network

The timeline of the Buhtrap group activity and the chronology of attacks against banksThe timeline of the Buhtrap group activity and the chronology of attacks against banks

Indicators of Compromise (IoCs) of banking malwareIndicators of Compromise (IoCs) of banking malware

Knowing the dynamics and the ways, how threat actors develop and tune their industry‑specific attacks is vital to be one step ahead cybercriminals. Anunak, Corkow and Buhtrap are not the only cyber groups actively attacking banks. We have detected at least two more cyber gangs which are believed to be preparing attacks against financial institutions.

Due to the constantly evolving threat landscape, the necessity to keep your security strategy and tactics up to pace with it has never been more crucial. We are devoted to staying ahead of the curve and providing the industry with the latest cyber threat intelligence both through public reports and our Threat Intelligence & Attribution service.

Dmitry Volkov
Dmitry Volkov
Chief Executive Officer

Advanced protection against cyber threats

Group-IB’s security ecosystem provides comprehensive protection for your IT infrastructure based on our unique cyber intelligence and deep analysis of attacks and incident response.