Hackers Target Bank Networks with new Rootkit to Steal Money from ATM Machines

A financially motivated threat actor has been observed deploying a previously unknown rootkit targeting Oracle Solaris systems with the goal of compromising Automatic Teller Machine (ATM) switching networks and carrying out unauthorized cash withdrawals at different banks using fraudulent cards.

Threat intelligence and incident response firm Mandiant is tracking the cluster under the moniker UNC2891, with some of the group’s tactics, techniques, and procedures sharing overlaps with that of another cluster dubbed UNC1945.

The intrusions staged by the actor involve “a high degree of OPSEC and leverage both public and private malware, utilities, and scripts to remove evidence and hinder response efforts,” Mandiant researchers said in a new report published this week.

Even more concerningly, the attacks spanned several years in some cases, during the entirety of which the actor remained undetected by leveraging a rootkit called CAKETAP, which is designed to conceal network connections, processes, and files.

Mandiant, which was able to recover memory forensic data from one of the victimized ATM switch servers, noted that one variant of the kernel rootkit came with specialized features that enabled it to intercept card and PIN verification messages and use the stolen data to perform fraudulent cash withdrawals from ATM terminals.

Also put to use are two backdoors known as SLAPSTICK and TINYSHELL, both attributed to UNC1945 and are used to gain persistent remote access to mission-critical systems as well as shell execution and file transfers via rlogin, telnet, or SSH.

“In line with the group’s familiarity with Unix and Linux based systems, UNC2891 often named and configured their TINYSHELL backdoors with values that masqueraded as legitimate services that might be overlooked by investigators, such as systemd (SYSTEMD), name service cache daemon (NCSD), and the Linux at daemon (ATD),” the researchers pointed out.

Additionally, the attack chains have employed a variety of malware and publicly-available utilities, including –

  • STEELHOUND – A variant of the STEELCORGI in-memory dropper that’s used to decrypt an embedded payload and encrypt new binaries
  • WINGHOOK – A keylogger for Linux and Unix based operating systems that captures the data in an encoded format
  • WINGCRACK – A utility that’s used to parse the encoded content generated by WINGHOOK
  • WIPERIGHT – An ELF utility that erases log entries pertaining to a specific user on Linux and Unix based systems
  • MIGLOGCLEANER – An ELF utility that wipes logs or remove certain strings from logs on Linux and Unix based systems

“[UNC2891] uses their skill and experience to take full advantage of the decreased visibility and security measures that are often present in Unix and Linux environments,” the researchers said. “While some of the overlaps between UNC2891 and UNC1945 are notable, it is not conclusive enough to attribute the intrusions to a single threat group.”

Podziel się postem :)



Czy unijne regulacje DORA i NIS2 zwiększą bezpieczeństwo sieci?

Średnio już 4,45 milionów dolarów wynoszą koszty neutralizacji skutków incydentu naruszenia bezpieczeństwa danych w firmach1. W ostatnich latach cyberprzestępcy coraz częściej prowadzą tzw. ataki na łańcuch dostaw, w których wprowadzenie złośliwego kodu do produktu jednej firmy lub włamanie do jej cyfrowych systemów może dotknąć setki, a nawet tysiące jej partnerów i podwykonawców. O tym, że problem jest poważny, świadczą najnowsze regulacje wprowadzane na całym świecie: w Wielkiej Brytanii, USA, Chinach czy Unii Europejskiej (NIS2 i DORA), które mają zwiększać bezpieczeństwo klientów i dostawców.


Luka w chipach Apple. Eksperci opracowali atak typu GoFetch

Eksperci z kilku uniwersytetów w Stanach Zjednoczonych połączyli siły podczas pracy nad wyodrębnianiem sekretów kryptograficznych z komputerów Apple z procesorami ARM M1 i M2. Atak nazwano “GoFetch Attack”.


Ukończono montaż nowego superkomputera ,,Helios”. To numer 1 w Polsce

Superkomputer Helios to system zainstalowany w ACK Cyfronet AGH, a powstały w wyniku prac realizowanych w koordynowanym przez Cyfronet projekcie Narodowa Infrastruktura Superkomputerowa dla EuroHPC – EuroHPC PL. Superkomputer został zbudowany według projektu Cyfronetu przez Hewlett-Packard Enterprise w oparciu o platformę HPE Cray EX4000 i składa się z trzech partycji obliczeniowych

Dodaj komentarz

Twój adres e-mail nie zostanie opublikowany. Wymagane pola są oznaczone *