Banking and Finance


  • Metro Bank targeted with 2FA-bypassing SS7 attacks

    February 1, 2019

    Metro Bank has reportedly fallen victim to a sophisticated two-factor authentication (2FA) bypass attack after hackers infiltrated a telecoms firm’s text messaging protocol. The Signalling Systems No. 7 (SS7) protocol is used by telecom firms to coordinate how texts and calls are routed around the world. But according to Motherboard, hackers are more actively exploiting SS7, and ...

  • New Android Malware Apps Use Motion Sensor to Evade Detection

    January 18, 2019

    Even after so many efforts by Google for preventing its Play Store from malware, shady apps somehow managed to fool its anti-malware protections and get into its service to infect Android users with malware. Two such Android apps have recently been spotted on the Google Play Store by security researchers with the Trend Micro malware research ...

  • TA505 Crime Gang Debuts Brand-New ServHelper Backdoor

    January 11, 2019

    The latest malware from TA505 has been seen targeting banks, retailers and restaurants with two different versions. A new backdoor named ServHelper has been spotted in the wild, acting as both a remote desktop agent as well as a downloader for a RAT called FlawedGrace. According to Proofpoint, the prolific cybercriminal gang known as TA505 developed ServHelper, which has ...

  • Phishing template uses fake fonts to decode content and evade detection

    January 3, 2019

    Proofpoint researchers recently observed a phishing kit with peculiar encoding utilized in a credential harvesting scheme impersonating a major retail bank. While encoded source code and various obfuscation mechanisms have been well documented in phishing kits, this technique appears to be unique for the time being in its use of web fonts to implement the encoding. When the ...

  • Operation Sharpshooter Uses Fileless Malware to Attack Global Infrastructure

    December 12, 2018

    The McAfee Advanced Threat Research team detected a malware campaign dubbed Operation Sharpshooter which attacked nuclear, defense, energy, and financial targets from all over the world. As detailed by McAfee’s research team, the campaign dubbed “Operation Sharpshooter” makes use of an in-memory essential to download and execute a second stage payload named Rising Sun. Moreover, the Rising Sun implant ...

  • Financial Conduct Authority warns asset management industry facing cyber risks

    December 10, 2018

    The asset management industry suffers from a lack of expertise and preparedness with regard to cyber security, and is risking “serious harm to its clients” and the wider market, the Financial Conduct Authority (FCA) has warned. In a multi-firm review of the asset management and wholesale banking sectors published today (10 December), the FCA also found an overreliance ...

  • DarkVishnya: Banks attacked through direct connection to local network

    December 6, 2018

    While novice attackers, imitating the protagonists of the U.S. drama Mr. Robot, leave USB flash drives lying around parking lots in the hope that an employee from the target company picks one up and plugs it in at the workplace, more experienced cybercriminals prefer not to rely on chance. In 2017-2018, Kaspersky Lab specialists were invited to research ...

  • Singapore banks offered $21M in funds to boost cybersecurity capabilities

    December 3, 2018

    Financial institutions in Singapore now have access to a S$30 million (US$21.88 million) grant that they can use to boost their cybersecurity operations and skillsets. Monetary Authority of Singapore (MAS) unveiled the new Cybersecurity Capabilities Grant that it said aimed to beef up the local financial sector’s cyber resilience and help banks develop local cybersecurity talent. Funded ...

  • Mobile Rotexy Malware Touts Ransomware, Banking Trojan Functions

    November 26, 2018

    A mobile malware has accelerated its activity in 2018, launching more than 70k attacks in August through October. Mobile malware, dubbed Rotexy, has evolved from being spyware to now a dangerous banking trojan packing a host of new clever features. Researchers report 70,000 attacks between August and October with targets primarily based in Russia. In a technical brief released ...

  • Lazarus APT Uses Modular Backdoor to Target Financial Institutions

    November 21, 2018

    The advanced persistent threat group Lazarus with North Korean links has been observed using a modular backdoor during last week to compromise a series of Latin American financial institutions by Trend Micro’s Lenart Bermejo and Joelson Soares. As unearthed by the Trend Micro research team, the APT38 threat group successfully compromised a number of computing systems ...

  • Russian Banks Under Phishing Attack

    November 16, 2018

    Banks in Russia today were the target of a massive phishing campaign that aimed to deliver a tool used by the Silence group of hackers. The group is believed to have a background in legitimate infosec activities and access to documentation specific to the financial sector. The fraudulent emails purported to come from the Central Bank of Russia (CBR) ...

  • Devastating Cyberattack Shakes Up Pakistan’s Financial Sector

    November 14, 2018

    According to PakCERT’s Qazi Misbah, 22 banks in the country were subject to a catastrophic cyber attack on October 27th of this year. 19,864 accounts with client banking data were hit, with some victims saying that funds were stolen. Amongst the many targets was the former Chief Scientist of Khan Research Laboratories, who says that Rs3 ...

  • Emotet Campaign Ramps Up with Mass Email Harvesting Module

    November 12, 2018

    The new variant can exfiltrate emails for a period going back 180 days, en masse. A large-scale spam campaign has launched, spreading the Emotet banking trojan. Worryingly, the offensive has launched about a week after a fresh module for mass email-harvesting was detected for the malware. Emotet is technically a banking trojan, but it’s most often used ...

  • ‘Almost all’ Pakistani banks hacked in security breach, says FIA cybercrime head

    November 6, 2018

    In a shocking revelation, the head of the Federal Investigation Agency’s (FIA) cybercrime wing has said data from “almost all” Pakistani banks was stolen in a recent security breach. “According to a recent report we have received, data from almost all Pakistani banks has been reportedly hacked,” FIA Cybercrimes Director retired Capt Mohammad Shoaib told Geo News on Tuesday. When ...

  • HSBC discloses security incident

    November 6, 2018

    Banking giant HSBC disclosed on Monday a security incident that impacted an undisclosed number of the institution’s customers. “HSBC became aware of online accounts being accessed by unauthorized users between October 4, 2018 and October 14, 2018,” the bank wrote in a data breach notification lettersubmitted to Californian authorities. The bank said it suspended access to online accounts ...

  • Microsoft regularly shared data of India bank customers with US intelligence agencies, claims report

    November 2, 2018

    Technology company Microsoft has routinely shared the financial details of Indian bank customers with intelligence agencies in the United States, DNA reported on Tuesday. According to the newspaper, the Reserve Bank of India flagged its concerns on the matter in a risk assessment report it has placed before banks’ audit committees. The central bank found that the data ...

  • Malware Distributors Adopt DKIM to Bypass Mail Filters

    October 25, 2018

    In July 2018, US-CERT raised an alert regarding the Emotet banking trojan, which is also being used to distribute a secondary malware known as “Trickbot”. This alert provided recommendations on how businesses can mitigate their exposure to the Trojan. Unfortunately, it looks like criminals are also reading the US-CERT’s warnings as they have adopted new techniques ...

  • Bank Servers Hacked to Trick ATMs into Spitting Out Millions in Cash

    October 3, 2018

    The US-CERT has released a joint technical alert from the DHS, the FBI, and Treasury warning about a new ATM scheme being used by the prolific North Korean APT hacking group known as Hidden Cobra. Hidden Cobra, also known as Lazarus Group and Guardians of Peace, is believed to be backed by the North Korean government and ...

  • This is how cyber attackers stole £2.26m from Tesco Bank customers

    October 1, 2018

    The inner workings of a cyber attack against Tesco Bank which saw £2.26m stolen from 9,000 customers — and resulted in the bank being fined over £16.4m for the failings that allowed it to happen — have been revealed. The Financial Conduct Authority (FCA) has hit the bank with a £16.4m fine and said Tesco Bank failed to ...

  • DanaBot Banking Trojan Found Targeting European Countries

    September 27, 2018

    Security researchers recently discovered a banking trojan named DanaBot (detected by Trend Micro as TROJ_BANLOAD.THFOAAH) being distributed to European countries via spam emails. Here’s what you need to know about this threat, how users and businesses can defend against it, and how managed detection and response can help address this threat. What is DanaBot? DanaBot is a banking trojan, written in ...