Skip to main content

Silence, Carbanak is back!

Kaspersky Lab experts have found a new trojan that was deployed to aid cyber-heists of banks in Russia, Armenia, and Malaysia. Experts named the new trojan Silence.

According to Kaspersky's GReAT investigation team, the trojan was spotted for the first time in September this year. Most of the attacks were against Russian banks.

While there are no clues to link the trojan to the infamous Carbanak gang (hacker group specialized in robbing banks), the attacker's mode of operation resembles some past Carbanak techniques. At this point, the Silence attacks could be a new Carbanak operation or the work of copycats that modeled their modus operandi based on Carbanak reports released by cyber-security firms.

How the Silence attacks happened

Experts were able to piece together how an attack with the Silence trojan works. It all begins with the hackers gaining access to a bank employee's email account. This can be done with malware or because the employee had reused passwords from accounts included in publicly leaked datasets.
The Silence group uses the bank employee's compromised account to send spear-phishing emails to other bank workers. The purpose is to identify other employees with access to sensitive bank management systems.
These emails contain a CHM (compiled HTML) file attachment. If the victim downloads and opens this file, the CHM file runs JavaScript commands that download and install a first-stage malware payload.
This is what experts call a "dropper." In this particular case, it's a Win32 executable that collects data on infected hosts and sends the info to the attackers' command and control (C&C) servers.

Silence works by recording a pseudo-video stream

If the C&C servers deem the PC valuable, they send over a second-stage payload, the Silence trojan. Silence's main feature is its ability to take repeated screenshots of the user's desktop.

The images are taken at quick intervals and uploaded to the C&C server, creating a real-time pseudo-video stream with the bank employee's activity.
Attackers most likely chose to take screenshots instead of recording an actual video because it uses fewer PC resources and allows Silence to remain undetected, hence the trojan's name.

The Silence group can later review these screenshots and look for data that may aid them in planning further stages of their attack, such as identifying URLs for internal bank money management systems, local applications they can exploit, or get an overview of other computers on the local network.
According to Kaspersky, the group then leverages legitimate Windows administration tools to fly under the radar in their post-exploitation phase, a technique used by the Carbanak group in the past.

Kaspersky did not reveal how the attack continues past this point, which banks were infected, or how much money attackers stole.

Bank robbers are getting creative

The Silence attacks are not the only cyber-heists carried out against Russian banks. Trustwave SpiderLabs found another hacking crew that used a new "overdraft" technique to rob banks, managing to steal over $40 million from several Eastern European financial organizations.

Other clever techniques used by Carbanak in past attacks include the use of Google legitimate services — Google Apps Script, Google Sheets, and Google Forms — to host C&C servers; and calling and tricking tech support department employees into opening malware-laden documents. The computers of tech support department employees are then used as pivot points for attacks or reconnaissance operations.

A technical analysis of the Silence trojan, along with IOCs, are available in Kasperksy's report here.



Popular posts from this blog

NanoCore developper busted and senteced for 33 months

A hacker who was arrested and pleaded guilty last year—not because he hacked someone, but for creating and selling a remote access trojan that helped cyber criminals—has finally been sentenced to serve almost three years in prison.

Taylor Huddleston, 26, of Hot Springs, Arkansas, pleaded guilty in July 2017 to one charge of aiding and abetting computer intrusions by building and intentionally selling a remote access trojan (RAT), called NanoCore, to hackers for $25.

Huddleston was arrested in March, almost two months before the FBI raided his house in Hot Springs, Arkansas and left with his computers after 90 minutes, only to return eight weeks later with handcuffs.
This case is a rare example of the US Department of Justice (DOJ) charging someone not for actively using malware to hack victims' computers, but for developing and selling it to other cybercriminals.
Huddleston admitted to the court that he created his software knowing it would be used by other cybercrimina…

ICEMAN : Infecting Crystal Finance Millennium

Iceman gang member confirms that they are behind the introduction and spreading of malwares that have affected Crystal Finance Millennium, a Ukraine-based accounting software firm. Was this a political based attack? Read more to find out.
I’ve had a chance to speak to one of the gang member on XMMP and he confirmed that the Iceman group is behind this attack. They started by a simple web attack (SQLI which lead to web shell upload, no privilege escalation was needed) in order to gain access to the web servers of the company. He confirmed that the math was simple, the Ukrainian company had many clients in the financial and medical sector which facilitated the propagation of their malware. From the archived web page, it becomes apparent they provide accounting software, personalization of medical records, blood service and "full automation of the doctor's office" - contrary to what their company name suggests, it appears they are (mostly) focused on medical software.

KillaMuvz: Undercovered british hacker

The Briton Goncalo Esteves (24), also known as KillaMuvz, has pleaded guilty to charges related to creating and running malware services. The Briton Goncalo Esteves (24) has pleaded guilty to charges related to creating and running malware services.
Such kind of platforms allows crooks to improve the development of their malicious codes. The malware created with the Esteves’ malware services would not be detected by antivirus software.
Esteves that was used the moniker ‘KillaMuvz’ is the creator of Cryptex tool commonly used by vxers to encrypt their files in an effort to avoid the detection. The first version of Cryptex was released in October 2011 and was continuously improved.
According to the NCA, Esteves has pleaded guilty to two computer misuse charges and one count of money laundering, the sentence is planned for February 12. “A cyber criminal has admitted running a product-testing service for hackers following a joint investigation by the National Crime Agency (NCA) a…