Ghimob is Not a New Dance Step from Brazil

SWIFT: India City Union Bank Heist

TLP AMBER ANNOUNCEMENT:

On Saturday 17 February 2018, India’s City Union Bank disclosed that its systems were hacked. They discovered that three fraudulent remittances, totaling nearly $2 million, were sent to accounts in Dubai, Turkey, and China via the SWIFT financial platform. SWIFT, or the Society for Worldwide Interbank Financial Telecommunication, is the world’s largest electronic payment messaging system, facilitating the exchange of more than $6 trillion a day. The majority of international interbank messages use the SWIFT network. This network enables financial institutions worldwide to send and receive information about financial transactions in a secure, standardized and reliable format. SWIFT sends payment orders, which must be settled by correspondent accounts that the institutions maintain with each other. SWIFT bank heists in the past have been attributed, with medium confidence, to North Korean actors...READ MORE

Wapack Labs has cataloged and reported on cyber threats targeting SWIFT in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

This TLP AMBER report is available only to Red Sky Alliance members.

China Bank Regulation and Foreign Bank Access

During 2017, Chinese banking regulatory agencies have issued a series of new banking restrictions with serious impact on Chinese banking practices and potential impact on foreign financial institutions as well. They have been forcing compliance with the new regulations with USD $400 million in fines on banking institutions in 2017 alone. The key measures introduced include:

• Stamping out cryptocurrencies - The government has ordered all bitcoin/cryptocurrency exchanges in China to cease operations, and it was using electrical power control to close bitcoin mining operations.
• Suppression of underground banks - To prevent foreign exchange transactions by unauthorized entities abroad, the government blacklisted 40 entities and apparently blocked access to their websites from inside China.
• Slowing capital outflow - The government targeted capital outflows by cracking down on underground money transfers and restricting large overseas mergers and acquisitions.
• Foreign bank access - However, one component of this effort involved a relaxation of regulations rather than a tightening up. In November 2017 China announced that it would soon allow foreign companies to own Chinese banks and investment firms. The cap on foreign investment in Chinese banks will be removed and foreign investors will be allowed to own 51% in financial institutions. Now, foreign banks which set up branches in China will be allowed to conduct business directly with Chinese in Chinese yuan...READ MORE

Wapack Labs has cataloged and reported on Chinese banking regulations in the past. An archive of related reporting can be found in the Red Sky Alliance portal.  

WWW.WAPACKLABS.COM

Terdot Banking Trojan

TLP AMBER ANNOUNCEMENT:

Terdot is a multipurpose banking trojan developed using Zeus source code leaked in 2011. The latest version of Terdot surfaced in 2016 and incorporates new surveillance capabilities. Now that the Terdot trojan features cyber espionage capabilities it is more likely to be sought after by attackers. Like its predecessor Zeus, some of Terdot's features and configurations indicate a high likelihood of Russian origins. This report examines Terdot’s new capabilities, infrastructure, attribution and delivery mechanisms...READ MORE

Wapack Labs has cataloged and reported on banking trojans in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

This TLP AMBER report is available only to Red Sky Alliance members.

Ukrainian Independence Day, Potential NotPetya-Like Attack?

Wapack Labs has received information suggesting a possible NotPetya-like attack that may be targeting Ukrainian Banking and critical infrastructure, today, to coincide with the Ukrainian Independence Day. On 11 August 2017, The National Bank of Ukraine (NBU, the Central Bank of Ukraine) notified Ukrainian banks about an up-coming NotPetya-like attack. Journalists reported it on 16 August 2017. Several English and Russian speaking news sites reported on the issue, but most if not all were resulting from circular reporting from the original sources:

• NotPetya-like attack
• Hitting corporate networks of the Ukrainian businesses
• On or around the Ukrainian Independence Day (24 August 2017)
• Via a malicious MS Word attachment
• Not known to anti-viruses at the moment of the NBU warning
• NBU cooperates with CERT-UA to stop similar attacks...READ MORE

Wapack Labs has cataloged and reported extensively on Ukraine and NotPetya in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

New Carding Shop Owner

Wapack Labs reports that an underground forum member, who is a new carding shop owner/operator, has been selling debit and credit cards on hacker/carder forums - boasting a 90% validity rate. The actor created a thread for card dumps and has a large base of various credit cards for sale; some belonging to a Red Sky Alliance member. He is still actively posting credit card dumps and providing a link to a web shop where the cards can be purchased. Lately, he has been selling large amounts of cards from numerous banks in the United States...READ MORE

Wapack Labs has extensively reported on card dumping in the past. An archive of related reporting can be found in the Red Sky Alliance Portal. 

The following organizations were cited in this report: Red Sky Alliance member

TLP: AMBER

ACTOR TYPE: (III)

SERIAL: IA-003-2017

COUNTRIES: RU

INDUSTRIES: Financial

REPORT DATE: 20170217

Vast Quantities of Credit Cards Being Sold in the Underground

Wapack Labs has monitored an underground forum member, who provides a web page link, where he sells debit and credit cards. The actor created a thread for card dumps and has a large base of various credit cards for sale; some belonging to a Red Sky Alliance member. He is still actively posting credit card dumps and providing a link to a web shop where the cards can be purchased. Lately, he has been selling large amounts of cards from numerous banks in the United States.

Wapack Labs has extensively reported on card dumping in the past. An archive of related reporting can be found in the Red Sky Alliance Portal. 

The following organizations were cited in this report: Red Sky Alliance member

TLP: AMBER
ACTOR TYPE: (II)
SERIAL: TR-027-2017
COUNTRIES: US
INDUSTRIES: Financial
REPORT DATE: 20170203

Morocco: Business in Sub-Saharan Africa

Morocco has recently initiated the Octopus Development Plan: an economic strategy designed to better assist Senegal.  Experts believe the underlying purpose for this plan is to further link banking and communication industries under Morocco and the United Arab Emirates (UAE) conglomerates.  The ability to control, disrupt or influence banking and communications on these networks by extremists or radicals is a major concern.  This information is being supplied for your situational awareness.

• Morocco is a major investor and developer in the banking and telecommunications industries in Africa.

• The Octopus Development Plan will further expand their interests in banking and communication is Western Africa.

• The United Arab Emirates and Morocco own controlling interests in the banking and communications industries in Northern, Western, and Sub Saharan Africa.

Publication Date:                    14 November 2016

Handling Requirements:        Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:     Unknown

Actor Type:                              Adversary capabilities have been assessed as Tier II*

Potential Targets:                    Morocco, West Africa and Sub Saharan Africa

Past Reporting:                        DOC-4360, DOC-4423

* Practitioners with a greater depth of experience, with the ability to develop their own tools (from publicly known vulnerabilities).


The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.

Better than Cash Alliance: Risks and Rewards in West Africa

The ‘Better than Cash Alliance’ project is a globally funded financial venture to promote e-commerce in Western Africa.  With this giant leap from rudimentary bank practices to electronic banking, which is a push from cash to digital payments, is fraught with many cultural challenges - to include the current influx of financial focused cyber-attacks.  This information is being supplied for your situational awareness. 

Publication date:                            1 October 2016

Handling requirements:                  Traffic light protocol (TLP) GREEN

Attribution/Threat Actors:              African based threat actors / unknown at this time

Actor Type:                                     Adversary capabilities have been assessed as Tier II*

Potential Targets:                            Senegal and West Africa

Past Reporting:                                Red Sky Alliance: DOC-4297, DOC-4322

*Practitioners with a greater depth of experience, with the ability to develop their own tools (from publically known vulnerabilities). 

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.