Russian Hacker Group Continues Stealing Money From Industrial Enterprises

guest · Nov 7, 2020

Russian Hacker Group Continues Stealing Money From Industrial Enterprises
November 6, 2020
https://www.securityweek.com/russian-hacker-group-continues-stealing-money-industrial-enterprises

Focused on companies in Russia, the ongoing attacks are highly targeted, leveraging phishing emails for malware deployment. In some cases, legitimate documents that were stolen in previous attacks are leveraged for social engineering.

Another characteristic of these attacks is the use of remote administration utilities, including Remote Manipulator System/Remote Utilities (RMS) and TeamViewer. Malware is employed to hide the user interface of these programs, to avoid attracting attention.
Click to expand...

The campaign was first detailed in 2018, when Kaspersky said that more than 400 organizations had been hit. Now, the security researchers reveal that the attackers have updated their techniques and that the number of victim organizations has increased.

Victims of these attacks include Russian companies from the manufacturing, oil and gas, metal industry, engineering, energy, construction, mining, and logistics sectors. The attackers appear to have a particular interest in the energy sector.
The purpose of the campaign is to steal money from the targeted organizations and Kaspersky believes that a Russian-speaking group is behind it.

“Clearly, the attackers’ remote access to infected systems also poses other threats, such as the organization’s sensitive data being leaked, systems being put out of operation, etc. As the latest events have shown, the attackers use documents that were probably stolen from organizations to carry out subsequent attacks, including attacks on victim companies’ partners,” Kaspersky concludes.
Click to expand...

Kaspersky: Attacks on industrial enterprises using RMS and TeamViewer: new data

In summer 2019, Kaspersky ICS CERT identified a new wave of phishing emails containing various malicious attachments. The emails target companies and organizations from different sectors of the economy that are associated with industrial production in one way or another.

We reported these attacks in 2018 in an article entitled “Attacks on industrial enterprises using RMS and TeamViewer“, but recent data shows that the attackers have modified their attack techniques and that the number of enterprises facing the threat of infection is growing.
Click to expand...

The attackers have full control of an infected system from the moment it becomes infected. Stealing money from the organization’s accounts remains their main objective. When the attackers connect to a victim’s computer, they look for financial and accounting software (1C accounting software, bank-client, etc.).
In addition, they find and analyze procurement-related accounting documents and peruse the email correspondence of the enterprise’s employees.
Click to expand...

Log in or Sign up

Russian Hacker Group Continues Stealing Money From Industrial Enterprises

guest Guest

Log in or Sign up

Russian Hacker Group Continues Stealing Money From Industrial Enterprises

guest Guest

Useful Searches