Cybercriminals are using spam, phishing e-mails, keystroke loggers and Remote Access Trojans (RATS) in order to steal the login credentials of employees in the financial sector, the FBI has warned.
In a statement released September 17, the FBI, in collaboration with the Financial Services Information Sharing and Analysis Center (FS-ISAC) and the Internet Crime Complaint Center, revealed startling new information about how cybercriminals were initiating unauthorised wire transfers in order to steal upwards of US$900,000 at a time.
The hackers used spam and phishing e-mails in order to trick bank employees into installing keyloggers and RATs, which then provided them with the information needed to access secure networks containing private customer information.
Operating outside of business hours, the hackers were also able to view account transaction histories as well as read manuals which gave them information and training as to how to use and manipulate the payment systems.
The parties also reportedly used Denial of Service (DDoS) attacks in order to distract their targets – which were mostly small or medium sized banks – while they went about their work.
The FBI is encouraging any financial institutions concerned about the level of their own vulnerability management to restrict employee access to the internet and make sure employees are well educated as to how to discern whether a link or email is safe to open.
They also suggest carefully monitoring for any unusual activity on company servers and reviewing anti-malware defences, as well as ensuring that employees do not attempt to access administrative accounts from their own personal devices.
This sort of social engineering attack is becoming increasingly popular amongst cybercriminals looking to take advantage of an unsuspecting public.
Whether your organisation operates in the financial sector or any other industry, it is well worth taking the time to assess your current level of cyber security and ensure you are minimising the risk of being a victim of an attack such as this.
The best way to do this is through a Red Cell ethical hacking assessment, which can simulate a legitimate hacking attempt and identify any backdoors or vulnerabilities that might provide a cybercriminal with the opportunity to access secure servers.
Following the report, and other concerning news regarding a critical vulnerability in Microsoft .
says the FS-ISAC.