Carbanak Trojan Targets Russian Security Service - Trend Micro

The register.co.uk published news on 25th May, 2015 quoting Maxim Goncharov, Security Researcher of Trend Micro, as saying "Carbanak is one of the world's most sophisticated and dangerous bank-robbing Trojans and it is now focusing on Federal Security Service (FSB) of Russia."

Federal Security Service or FSB is an institution which is especially responsible for activities ranging from counter-intelligence to counter-terrorism, surveillance and internal and border security. President of Russian Federation oversees its activity.

Carbanak is a campaign which attacks targeted banks and financial organisations in the beginning of the year. According to reports, it employed techniques and methods like spear phishing email and exploits which are normally seen in targeted attacks.

Security researchers of Kaspersky published a detailed report on the activity of Carbanak in February and revealed that Carbanak took at least two months (in some cases even four months) to complete one robbery resulting losses ranging from $2.5 / 2.3 Euro and $ 10 / 9 Euro million to financial institutions attacked by it.

It is believed that the group behind Carbanak victimized up to 100 people robbing them of around $1 billion/908 Euro million in total. Kaspersky says that Carbanak group is a multinational gang consisting members from Ukraine, Russia, China and some European countries.

While studying indicators of compromise of Carbanak, Goncharov recently found that one domain (systemsvc.net) acting as a C&C server for the malware resolved to an IP address (213.24.76.23) and when he checked this address, he traced it to a location in Moscow City under the Federal Security Service of Russian Federation.

The register.co.uk published news on 25th May, 2015 quoting Goncharov as saying "I checked for other interesting details in other indicators of compromise but did not find anything related to this particular variance."

Scmagazineuk.com published news on 25th May, 2015 quoting Goncharov as saying about the change "I still do not know about this happening and I don't really think that FSB Russia would point the Carbanak-related domain to an IP address which is connected to the Russian Federal Security Service. May be, the owner of the domain has done this as a hoax."

» SPAMfighter News - 6/5/2015