Alien among your own: how fraudsters recruit bank employees

[Демитрий]

The financial sector is already at the forefront of security fighters. Banks have something to lose, so they take security seriously. The activity of regulators can also be envied. And everything would be fine, but the slack is given by employees: if they do not steal themselves, then they will be caught by crooks. Not only is the default threat, but also inside.
Not my fault, he himself ...

Take the fraud of a hacker group Cobalt . In dry numbers: about 100 financial institutions from 40 countries . The total damage amounted to more than 1 billion euros. According to experts, hackers have been working since 2013, mainly through phishing mailings. In them, scammers pretended to be others and encouraged to launch attachments with viruses. As soon as the recipient agreed, the computer was infected with "copyright" malware, and criminals gained access to the machine. Then they penetrated the bank’s internal network, and there was a lull: scammers studied the institution’s network and the interaction of servers with ATMs. As soon as the preparatory part was completed, a command to issue money was sent to certain ATMs at the right time. Naturally, drops were already waiting nearby, ready to quickly withdraw cash.

In Cobalt attacks, a bank employee most often became the entry point. It was he who, deceived by the methods of social engineering, launched an infected investment, while banks and regulators improved technologies and regulations.

Almost half (48%) of the recipients of phishing emails respond to them and fall into the trap of scammers
By assessment Sberbank, almost half (48%) of recipients of phishing emails respond to them and fall into the trap of scammers. Since the beginning of 2017, the Sberbank security service has identified more than 600 domain names used for phishing, 200 scam sites and 1.3 thousand sites that distribute malicious software. But gullible and insufficiently competent in matters of cyber fraud, people still let criminals to borrow money.

Self-interest - to be

To fall into a trap is not so bad. But as soon as an employee begins to act consciously, the risks of the bank increase. For obvious reasons, this is rarely taken to court: the reputation suffers too much. Nevertheless, there are signs of an internal fraudster in different cases.

For example, in September 2016 in St. Petersburg in just five hours out of four ATMs was stolen 12.6 million rubles. A four-centimeter-diameter hole was discovered at each of the terminals: through it, unknown people connected to the control unit of the ATM and initiated the issuance of 4 million 780 thousand rubles. Identical hacks occurred that night in three more districts of the city, and it would be unlikely that the work of scammers would be so clean without an accomplice inside.

Another story - about hacking a trading system of a bank from Tatarstan - has occurred in February 2015, and, according to the First Deputy Chairman of the Central Bank of the Russian Federation Sergey Shvetsov, there could be a retribution for dismissing an employee. Fraudsters managed to change the exchange rate on the Moscow Exchange, as a result of which the dollar exchange rate for 14 minutes fluctuated by more than 15%: it could be bought at 55 rubles and sold for 62 rubles. Losses of Energobank amounted to 243.6 million rubles.

Metamorphoses: from insider to scammers

People commit crimes for various reasons: someone takes revenge, others earn. But in most cases they are spurred on from the outside, and here are the most popular incentives.

Offer to earn . To get this, you don’t even have to install Tor. Any carding forum that can be found through the search line is full of offers with lengthy wordings “bank employees are required”, “good additional earnings”, “brothers, friends, acquaintances and other intermediaries are not interested”.



Although there are specific requests indicating an interesting bank fraudster and interest for the service. By the way, some forums offer a guarantee service for “honest buyers and sellers”: the guarantor is not responsible for legality, but monitors compliance with the terms of the transaction.



Insiders do not always need qualifications; more often they are looking for “initiative” and “responsible” ones. Manuals and everything you need are provided.



Similarly, bank employees themselves do not disdain to offer services. For example, make plastic cards on scans.



Blackmail . Scammers aimed at breaking banks, unlike classic blackmailers, do not require a ransom, but a work account or a login-password link from a corporate mailbox.

Scammers look for compromising information in stolen databases and in open sources, for example, social networks. Dozens of free parsers are available on the Internet to collect information from the VKontakte social network, including non-public personal data, likes, comments, membership in closed groups, participation in polls, and accounts on other social networks. Paid versions allow you to learn even more, and cost from several hundred to several thousand rubles.

A more sophisticated way is to install spyware on the victim's PC and record fresh dirt. The first Trojan using social engineering methods to collect compromising information was discovered by researchers from Diskin Advanced Technologies in mid-2016. Infected software was distributed through playgrounds and adult sites. Once on the victim’s computer, the trojan also turned on a webcam to record video without the user's knowledge.

Avoiding Recruiting Employees
Common banking practice: first find out about the problem and only after - about betrayal, when the investigation leads to
Common banking practice: first find out about the problem and only after - about betrayal, when the investigation will lead to their own. Although assisting scammers is contrary to security policies, it’s quite difficult to convict an employee of the game on the other side. Among the signs is a change in behavior or purchase that does not correspond to income. Both of them can be skillfully hidden, so it is easier for security services to prevent a problem. Namely: to work with personnel and identify at risk groups:

- employees with problems (debts, offenses, gambling addiction, etc.);
- people who can be blackmailed by “skeletons in the closet” (fetishes, non-standard or taboo sexual preferences, etc.);
- disloyal workers (they can commit a crime to take revenge, restore justice, prove something, etc.).

Some of these people are potentially dangerous. For example, gamblers easily endure the habit of risking work. Others are vulnerable and will go to great lengths to hide their addiction, love affair or other ins and outs. To ignore this means to leave security gaps, although protection tools today can not only detect violations, but also work ahead of them: to predict risks, anticipate people’s actions in certain situations and prevent incidents.
***
Source: Alien among your own: how fraudsters recruit bank employees