Cybercriminals Battle Against Banks' Incident Response

Financial institutions traditionally have established some of the most secure perimeters and defenses against cybercriminals and nation-state actors, but new studies show how they often struggle to detect or quell ongoing attacks that have infiltrated their internal networks.

CISOs from major financial firms surveyed and interviewed recently by Carbon Black say they're seeing attackers moving across their networks under the cover of legitimate applications and tools such as Windows PowerShell (89%), Windows Management Interface (59%), and SSH (28%). Those camouflaged, memory-based attacks – aka file less attacks – were used in more than half of successful breaches of the bank networks, according to Carbon Black.

In addition to the usual Windows utility suspects, Google Drive, unsigned digital certificates, and legit processes hiding malicious code (aka process hollowing), each were found in about 10% of cases at banks.

Leigh-Anne Galloway, cybersecurity resilience lead at Positive Technologies, says these methods work for the bad guys because banks often don't pay close attention to the security of their internal networks. Her firm, which provides penetration testing to banks in Europe and elsewhere, uses legitimate tools in those engagements. "When doing pen tests, we try to act as close as possible to the actions of the attacker - including 'living off the land' - so that the organization can understand how well its internal monitoring tools for attacks like SIEM or SOC work," she says.

The pen testers run Mimikatz PowerShell version as well as the "procdump" utility, where they copy operating system memory. "You can extract passwords from this dump on your laptop, which naturally will go unnoticed by the protection systems. Such methods show high efficiency," she days, with the pen testers able to steal passwords from the operating system memory using Mimikatz in 100% of banks they tested.

Persistent attackers aren't backing down when banks detect them and launch their incident response processes, either. One in four bank CISOs in the Carbon Black study say their institution faced attackers fighting back when they got spotted, trying to deter defenses and the investigation into the attack.

"They are leaving wipers or destructive malware to inhibit [IR], deleting logs, and inhibiting the capacity of forensics tools," for example, says Tom Kellermann, chief cybersecurity officer at Carbon Black. "Sometimes they are using DDoS to create smokescreens during events."

These counter-IR activities are forcing banks to be be more proactive and aggressive as well, he says. "They need to have threat hunting teams. You can't just rely on telemetry and alerts."

While banks are often relying on their IR playbooks, attackers have the freedom to freelance and counter IR activities. They're changing their malware code on the fly when it gets detected, deleting activity logs to hide their tracks, and even targeting bank security analysts and engineers to help their cause. Carbon Black found in its study that one in ten bank victims say they spotted secondary command-and-control infrastructure set up in their networks – which can make response even more difficult.

Positive Technologies' Galloway says attackers also encrypt their data transmissions over the victim's network, falsify time-stamps in files, and employ file compressors and anti-debugging methods that can thwart discovery of their activity and tools.

While 90% of banks in the Carbon Black survey said they had experienced a ransomware attack threat, Kellermann says another data point appears more ominous: one in ten had spotted destructive attacks that were not ransomware-related.  "I think that's going to grow," he says, as attack groups use destructive malware such as data-wipers to "burn the house down" on their way out for cover or to send a message.

"The real dangers to financial institutions isn't just dealing with identity fraud and wire fraud," Kellermann says.

Pen testers at Positive Technologies, meantime, found gaping holes in their bank client networks: 75% of banks had employees who opened links in phishing attack tests, and 25% of them provided their credentials in a phony authentication form in the test. Positive Technologies' analysts were able to access banks' financial applications in 58% of their engagements, and compromise ATM management workstations in 25% of the cases, according to a report published this week.

And banks weren't savvy at catching the pen-tests, either. "The actions of pen testers were noticed by security employees in less than 10% of banks that we tested," Galloway says.

Related Content: