In a classic "divert their attention", the Taiwan Far East Bank was first attacked with spear phishing emails that pointed to malicious executables, which were clicked on by employees. These .exe files gathered the credentials of the employees and turned off the security software that was used in the bank.
Only then, the attackers got access to the systems that allowed 60 million dollars in transactions. And to hide their activity, the bad guys kicked off pseudo ransomware during the whole process. The Hermes strain encrypts more files than usual and slows the infected workstation down to a crawl. There is also no way to decrypt the files and no ransom notes were left.
The attackers had apparently compromised the bank for months in advance, as they were aware of all software and procedures used by the bank. The Taiwan bank was able to claw back most of the money. This whole operations smells like the North Koreans, as this is their signature type of cyberheist. However, the code scans for Russian, Ukrainian and Belarus languages and if detected, will not run. Could be a false flag attempt.
Again, train those users!
Technical details posted by McAfee.
Find out How Vulnerable Your Network Is Against 3 NEW Ransomware Scenarios
- CitroniVariant - A specific scenario designed to simulate the distinct file encryption activity of Critroni/CBT ransomware.
- Collaborator - An advanced scenario that spawns multiple processes to carry out encryption routines.
- VirlockVariant - One of the more complex scenarios, designed to simulate a variant Virlock that uses watchdog processes to keep encryption processes restarted.
- 100% harmless simulation of a real ransomware infection
- Does not use any of your own files
- Tests 13 types of infection scenarios
- Just download the install and run it
- Results in a few minutes!
