Legit tools exploited in bank heists

Common IT administration tools are being hijacked to act as invisibility cloaks for cyber criminals targeting financial institutions, according to a report by security firm Carbon Black.

The report is based on a survey of CISOs at 40 financial institutions and notes that cyber attacks against financial institutions are most often conducted for the purpose of yielding illicit financial gain and are typically undetectable, global and instantaneous.

During the past three years, the report said researchers have seen a tremendous amount of innovation from cyber criminals, with marked evolution in attack methods in the past six months.

“Cyber criminals are leveraging new techniques, tactics and procedures (TTPs) specific to maintaining persistence and countering incident response,” the report said.

The top finding of the survey is that cyber criminals are continuing to hide in plain sight and move laterally using attack methods that do not involve malware.

Instead, attackers are using legitimate tools such as PowerShell (89%), Windows Management Instrumentation (59%) and secure file transfer protocol (28%) to carry out activities so that they remain undetected.  

Native tools such as PowerShell and Windows Management Instrumentation (WMI) grant users exceptional rights and privileges to carry out the most basic commands across a network.

These “non-malware” or fileless attacks account for more than 50% of successful breaches, the report said, with attackers using existing software, allowed applications and authorised protocols to carry out malicious activities.

In this way, attackers are able to gain control of computers without downloading any malicious files and therefore remain unnoticed by malware-detection security systems.

For example, someone in the targeted organisation is lured to a compromised website, which launches Flash. This in turn invokes PowerShell, enabling the attacker to feed instructions to it through the command line, all operating in memory.

Finally, PowerShell is used to connect to a command and control server to download a malicious PowerShell script designed to find sensitive data and send it to the attacker, all without downloading any malware.

Almost every Carbon Black customer (97%) was targeted by a non-malware attack during each of the past two years, but the report notes that awareness of malicious usage for tools such as PowerShell has never been higher, with 90% of CISOs reporting seeing an attempted attack using PowerShell.

The report also reveals that 90% of financial institutions reported being targeted by a ransomware attack in the past year.

This is not surprising, the report said, with Carbon Black researchers observing in the past year a 2,502% increase in the sale of ransomware on the dark web. Cyber criminals are increasingly seeing opportunities to enter the market and looking to make money fast through one of the many ransomware offerings available, the report said.

“Unlike many other forms of cyber attacks, ransomware can be quickly and brainlessly deployed with a high probability of profit,” the report added.