How I Handled One of the Biggest Banking Fraud Incidents of 2020
summary
A combined campaign on Christmas night uses fake-bank sites proxying bank APIs and stolen internal credentials plus CDN masking to return real account balances and transactions in real time, serviced by a phishing-as-a-service portal on AWS EC2 that spins up domains in five or six clicks; investigation finds an Anubis financial malware sample, more than 10,000+ customers affected across 15+ brands, three days to access the attacker server, downloaded evidence, shared IOCs via MISP, and mitigations include reset passwords and blocked AD accounts plus new NDR rules and responsible disclosure.
AI-written summary · about
chapters (8)
- 0:00Introduction and context
- 3:23Incident identification
- 8:09Countermeasures and investigation
- 12:58Evidence gathering
- 17:05Deep dive into the attack
- 22:35Incident response framework
- 26:51Lessons and best practices
- 31:35Teamwork and conclusion
related talks
51mModern Bank Heists
47mThe Heist: Chasing an Advanced Crypto Attacker Across the Multi-cloud
40mBanking Cybersecurity: Battling DeepFakes & AI-powered Scammers
43mBackground Story of "Operation neutralizing banking malware"
30mThe Hidden Layer of Cyberattacks
01h 01mPrincess of Thieves: How I Robbed 30 Banks
27mCybersecurity During Dark Times
30mTargeted Web Skimming on E-Commerce Sites