Forensic scientists have identified a new virus with which hackers attacked banks and stole 1.8 billion rubles from them over six months. The attackers sent letters to banks allegedly from the Bank of Russia

Photo: Ekaterina Kuzmina / RBC

Over the past six months, from August 2015 to February 2016, using the Buhtrap virus, hackers carried out 13 successful attacks on Russian banks, as a result of which they stole 1.8 billion rubles, Group-IB, a company that investigates computer crimes, reports in its report .

The group of hackers that uses the Buhtrap virus has been operating since October 2014, but the first attacks on banks were recorded in August 2015; before that, the group attacked only bank clients.

The hackers' attacks consisted of sending letters allegedly on behalf of the Bank of Russia. The first mailing was recorded on October 22, 2015, according to a Group-IB report. Then many Russian banks received a letter from the support@cbr.ru.com mailbox with the subject “Information for bank employees,” which contained an MS Office document. Opening the document led to the launch of a program that checked the history of computer browsers for links related to Internet banking and banking software. If such links were found, the program downloaded malicious software (Buhtrap) from the Internet and installed it. However, most antivirus programs do not identify the bootloader as a malicious program, says the Group-IB report.

The hackers didn't stop there and moved on. They learned about the existence of the Antidrop club, which includes representatives of bank security services and exchange information about fraud with each other. On December 18, 2015, Buhtrap hackers sent emails from the address mironova.olga@gazprombank.com.ru with the subject line “Urgent! Updated drop database”, “Updated drop database” with a link to a malicious file, is described in the Group-IB report. But bank security officers quickly realized that the mailing was fraudulent, the report says.

Damage from the Buhtrap virus

600 million rubles. — the maximum amount of theft from a Russian bank in 2016

RUB 25.6 million — the minimum amount of theft from a Russian bank in 2016

RUB 143 million — average amount of successful theft from a bank

1 billion rub. — the amount of thefts that were stopped in January 2016

Banks' annual costs for effective means of preventing attacks are 28 times less than the average direct damage from one targeted attack.

In January of this year, hackers made a second mailing on behalf of the Central Bank with an allegedly open vacancy there. The letters came from the mailbox vakansiya@cbr.ru.net, which is a modified Central Bank domain, with the subject “Vacancy in the Central Bank” and a virus MS Office document (Buhtrap). The press service of the Central Bank responded to a request from RBC that the address vakansiya@cbr.ru.net does not belong to the Central Bank. “Based on this mailing, the Bank of Russia sent information to law enforcement agencies. The Center for Monitoring and Responding to Computer Attacks in the Credit and Financial Sphere of the Bank of Russia (FinSERT) sent relevant information to participants in the information exchange,” the press service noted.

According to Dmitry Kuznetsov, director of methodology and standardization at Positive Technologies (a company engaged in information security), another hacker mailing to banks was recorded on March 14. The hackers registered the fincert.net domain for sending letters, which bankers associate with the structural unit of the main department of security and information protection of the Bank of Russia FinCERT, which does not have its own website.

“This kind of social engineering is a common technique that hackers use when they need to gain access to the computers of a certain category of employees in an organization,” says Kuznetsov.

This year, two banks were subjected to a hacker attack, as a result of which banks had to disconnect from BESP (bank electronic urgent payments) for some time - Metallinvestbank and Russian International Bank.

On March 5, RIA Novosti, citing a source in law enforcement agencies, reported that hackers had withdrawn more than 677 million rubles. from Metallinvestbank accounts. Later, the press service of Metallinvestbank stated that the bank’s losses from the hacker attack amounted to 200 million rubles. “The amount that the attackers tried to steal is less than 1% of the bank’s assets; the amount of losses is less than the profit received by the bank since the beginning of 2016, which amounts to more than 400 million,” the press release said .

The Russian International Bank was attacked on January 21, the Banki.ru portal reported with reference to the bank's president, Grigory Afanasyev. “The fraudsters made several thousand withdrawals from the bank’s correspondent accounts to approximately 60 other banks, then this money was transferred mainly to individuals,” explained Afanasiev. They could not understand the source of the virus in the bank, says Afanasiev.

Hackers stole almost 2 billion rubles from banks. using “letters from the Central Bank”