Cyber-espionage groups are attacking financial institutions in Asia Pacific: Kaspersky Lab

New Delhi [India], October 15 (ANI): Global cybersecurity company, Kaspersky Lab has revealed that cyber-espionage groups are moving towards using supply chain attacks and legitimate tools to attack financial institutions in the Asia Pacific region.

Active Advanced Persistent Threat (APT) groups have successfully breached financial institutions in Malaysia, South Korea, Indonesia, Philippines, China (Hong Kong), Bangladesh, and Vietnam.

From spying, stealing, and leaking state, military, and trade secrets; cybercriminals operating in the Asia Pacific region aim for monetary gain as they infect banks in APAC countries, according to cybersecurity researchers at Kaspersky Lab.

"This year, we have monitored the tectonic shift in APT actors' behaviour. These groups who are initially data-hungry are now going beyond traditional cyberespionage. They added money-stealing on their attack menu as they hunt for vulnerable banks in the Asia Pacific (APAC) region which they can infect mostly through the rising epidemic," said Yury Namestnikov, Head of Research Center, Russia at Kaspersky Lab's Global Research and Analysis Team (GReAT).

In 2017, Kaspersky Lab has monitored active APT actors in the region, namely the infamous Lazarus group and Cobaltgoblin other groups that use Carbanak-style attacks.

Lazarus is also the cyber gang believed to be behind massive breaches including the Sony Pictures hack in 2014 and the multi-million cyber robbery against the Central Bank of Bangladesh last year. They are known for hacking C&C servers of banks and governments as launchpads for their malicious campaigns.

Carbanak made headlines in 2014 for the USD one billion bank heists in Russia, Ukraine, Germany, and China dubbed as "The Great Bank Robbery". The group infiltrated their victims' networks through spear phishing emails or infected Word documents exploiting known vulnerabilities. With remote and covert access to the system, they gained control of the banks' ATMs or websites and collected a significant amount of money.

The degree of sophistication in terms of tools and the skilled manpower of the hackers behind these groups suggest that some of them are state-sponsored actors.

"Actors are switching towards using legitimate software instead of deploying unique malicious programs, which can allow them to perform the attack stealthy. Also, they penetrated networks by supply chain attacks: in last three months, there were four huge incidents of this similar pattern. In terms of monetization, it could be attacks against ATM infrastructure, SWIFT servers or databases with transactions and debit/credit cards information. They are undoubtedly investing time, money, and effort so they can have good Return on Investment (ROI). So far, we can assume that cybercriminals are earning good ROI when attacking financial institutions in the region," adds Namestnikov.

The exact monetary losses from financial institutions attacks in APAC are unconfirmed as of now, but Kaspersky Lab researchers report having been able to foil breaches before financial firms could lose their money.

In order to protect enterprises from sophisticated financial threats, the global cybersecurity company suggests the use of a highly sophisticated solution that enables businesses to detect targeted attacks and other malicious actions through careful monitoring of network activity, web, and email like the Kaspersky Anti Targeted Attack Platform.

Kaspersky Lab also highlights the importance of threat intelligence to keep financial institutions knowledgeable on the latest trends of threats against banks. The global cybersecurity company has a portfolio of Threat Intelligence services designed to mitigate massive attacks by providing enterprises with insights on the latest, constantly emerging threats currently targeting businesses around the world. (ANI)