A Moscow-based security firm said on Monday that a previously undetected group of Russain-language hackers stole about $10 million from mostly U.S. and Russian banks by targeting interbank transfer systems.
Group-IB researchers have warned that the attacks, which began 18 months ago and allow money to be stolen from banks’ automated teller machines (ATMs), appear to be ongoing and that banks in Latin America could be targeted next.
The first attack occurred in the spring of 2016 against banks in First Data’s (FDC.N) “STAR” network, the largest U.S. bank messaging system connecting ATMs at more than 5,000 organizations, Group-IB researchers disclosed.
A number of small financial institutions operating on the STAR network had their credentials breached for administering debit cards earlier in 2016, leading First Data to implement new mandatory security controls. The STAR network was never itself breached, First Data said in a statement.
The firm said it was sustaining investigation on a number of incidents where hackers studied how to make money transfers through the SWIFT banking system, while stopping short of saying whether any of such attacks had been carried out successfully.
SWIFT revealed in October that hackers were still targeting its interbank messaging system, but security controls instituted after last year’s $81 million heist at Bangladesh’s central bank had frustrated many of those attempts.
The unidentified hackers used a mix of constantly changing tools and tactics to bypass anti-virus and other traditional security software while being cautious to get rid of traces of their operations, helping them to go largely unnoticed.
To disguise their moves, hackers used security certificates from brands such as Bank of America, the Fed, Microsoft and Yahoo.
Group-IB disclosed that it had notified Interpol and Europol in order to assist in law enforcement investigations.
