Feeds

Cyber blaggers autoplunder bulging accounts on Euro pay network

'Operation High Roller' rascals in mass slurpening

Top 5 reasons to deploy VMware with Tegile

Cybercrooks have developed a Trojan that targets high-value accounts linked to the European SEPA payments network.

The highly targeted malware-based scam is an extension of the ongoing Operation High Roller, according to Intel's McAfee security division. Fraudsters have siphoned off tens of thousands from SEPA-linked accounts after infecting the computers of only a few dozen or so targets with accounts at two German banks.

Openly accessible logs on a control server behind the scam allowed McAfee researchers to work out that €61,000 in fraudulent SEPA transactions had been run against accounts held at just one of these banks.

SEPA (Single Euro Payments Area) is a payment-integration initiative of the European Union that covers all 27 EU member states, three European Economic Area countries (Iceland, Liechtenstein and Norway) and Switzerland and Monaco. It is similar to the Automated Clearing House banking network in the United States.

SEPA transactions make no distinction between domestic and cross-border transactions within the EU. So crooks only need to use money mule accounts as dropboxes for stolen funds and more sophisticated automated attacks can be applied than is possible with normal online banking fraud, as McAfee explains.

The latest attack targets the German banking industry with a targeted ATS [automated transfer system] designed with SEPA in mind. The malicious "webinjects" target two German banks with a specially crafted JavaScript payload deployed to about a dozen of their online banking customers that have SEPA as an option, keeping this attack very targeted in nature.

The targeted nature of such malware tends remain undetected for a time. Thus, these campaigns are hard to discover because they infect only dozens of customers, rather than hundreds or more.

The transaction server used in this attack is hosted in Moscow and hosts a separate control panel for each of the targeted banks. Although the control panel isn’t sophisticated, the machinery that acts behind the scenes is complex.

The ZeuS-style banking malware at the heart of the attack injects itself into the browser process of compromised machines before attempting to initiate withdrawals of between €1,000 and the SEPA transaction maximum of €100,000. The malware hides security alerts and transaction records.

These malware-based tricks are not new, and frauds against automated wire transactions have been seen before. The main significance of the latest attacks, as McAfee researchers point out, is that cybercrooks are beginning to target different types of payment channels, such as SEPA. ®

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Home Depot ignored staff warnings of security fail laundry list
'Just use cash', former security staffer warns friends
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.