Crooks took control over operations of a Brazilian bank for 5 hours
5.4.2017 securityaffairs CyberCrime

Cyber criminals launched a sophisticated cyber heist that compromised the entire DNS infrastructure of a major Brazilian Bank.
A cyber criminal organization took over online service of a major Brazilian bank for five hours. The hackers compromised the bank DNS system and intercepted all the connections to the financial institution.

According to Kaspersky Lab who investigated the incident, the attack was very sophisticated, attackers used a valid SSL digital certificates and Google Cloud to support the phony bank infrastructure.


Kaspersky Lab did not disclose the name of the bank that was victim of the attack.Crooks compromised 36 domains belonging to the bank, including internal email and FTP servers.
The hackers took control of the bank’s DNS account after they have compromised the bank’s Domain Name Service (DNS) provider Registro.br.

It is still unclear how hackers compromised the DNS provider, but the experts believe the cyber attacks began at least five months prior to the day of the hack.

The attack occurred on October 22, 2016 and lasted five hours during which the attackers captured the transaction of hundreds of thousands or possibly millions of the bank’s customers worldwide. When the bank customers tried the accessed the online services offered by the bank they were infected with a malware posing as a Trusteer banking security plug-in application.

The malware was designed to disable victim’s security solutions and steal login credentials, email contact lists, and email and FTP credentials.

The experts explained that it is the first time they observed a so massive attack.

“As far as we know, this type of attack has never happened before on such a big scale,” explained Dmitry Bestuzhev, director of Kaspersky Lab’s research and analysis team in Latin America.

The experts at Kaspersky highlighted the DNS provider Registro.br fixed a cross-site request forgery flaw on its website in January, it is possible the attackers have exploited the flaw for the attack.

“Maybe they [the attackers] exploited the vulnerability on that website and got control. Or … We found several phishing emails targeting employees of that registrar, so they could have spear-phished them,” added Kaspersky. “We don’t know how exactly they originally compromised” the DNS provider, he says.

A disconcerting aspect of the story is the fact that the Brazilian bank didn’t enable the two-factor authentication option implemented by Registro.br.

The malicious code targets a specific list of other banks in many countries, including Brazil, US, the UK, Japan, Portugal, Italy, China, Argentina, and the Cayman Islands.

The attackers used a modular malware that could infect both Windows and Mac OSs.

The malware was identified as Trojan-Downloader.Java.Agent; Trojan.BAT.Starter; not-a-virus:RiskTool.Win32.Deleter; and Trojan-Spy.Win32.Agent.

The crooks also launched a phishing campaign against specific bank clients during the five-hour attack.

The stolen information was sent by hackers to a server in Canada,

Kaspersky suspects the involvement of a sophisticated Brazilian cybercrime gang.

“They spent five months just waiting. This is not someone who is a newbie,” added Bestuzhev.