Nation-State Moneymule's Hunting Season – APT Attacks Targeting Financial Institutions
summary
Five recent operations are disclosed against banks, ATM operators and Bitcoin exchanges by Lazarus, Bluenoroff and Andariel: a South Korean major bank breach uses a VDI name pipe to jump into an air‑gapped SWIFT host and deploy a manuscript family backdoor; an ATM‑maintenance firm sees 68 of ~2,000 ATMs infected after an AV zero‑day, leaking 1.9 million records; multiple exchange intrusions use HWP/PostScript and mobile malware; CVE‑2017‑0199 lures drop a Frankie downloader and a “milk” loader; C2s paid in Bitcoin and compile timestamps match weekday office hours.
AI-written summary · about
chapters (31)
- 0:00Start
- 3:30BACKGROUND- who are they? Lazarus
- 5:50BACKGROUND - Activity Timeline
- 7:01KOREA MAJOR BANK ATTACK BY BLUENOROFF-Background
- 14:55VANXATM - ATM OPERATOR COMPANY BREACH
- 24:37BITCOIN EXCHANGES HACKING CAMPAIGN
- 27:54BITCOIN EXCHANGES HACKED - Phishing Email Attack Vector
- 28:58BITCOIN EXCHANGES HACKED-Attack Timeline
- 29:47TARGETING BITCOIN EXCHANGES USERS - Before July, 2017
- 30:27BITCOIN EXCHANGES HACKED-Before July, 2017
- 31:12BITCOIN EXCHANGES HACKED-CASE 1: IMPERSONATED as FSI
- 31:51CASE 1: IMPERSONATED as FSI - Malicious scripts in HWP file
- 32:27CASE 1: IMPERSONATED as FSI - Files
- 33:17CASE 1: IMPERSONATED as FSI-Postscript
- 34:48CASE 1: IMPERSONATED as FSI - Postscript vulnerability
- 35:44CASE 1: IMPERSONATED as FSI - Agent Dropper
- 36:56CASE 2: IMPERSONATED as A NATIONAL POLICE OFFICER - Files
- 39:05Campaign targeted Egypt bank and SK banks - Background
- 41:12Campaign targeted Egypt bank and SK banks - Delivery Method
- 41:47Campaign targeted Egypt bank and SK banks - Powershell Script
- 42:13Campaign targeted Egypt bank and SK banks - Javascript
- 42:49Campaign targeted Egypt bank and SK banks - Trojan downloader
- 44:35Campaign targeted Egypt bank and SK banks - Milk loader
- 45:42Campaign targeted Egypt bank and SK banks - Interesting Decoys
- 48:14Directory browsing open on C&C server
- 49:02Interesting "Victim"(?) Information
- 49:51More Possible Targets Discovered on C&C server
- 50:40TTP & Key-finding
- 53:27Getting new C&C server with (stolen? ransomed?) bitcoin
- 54:54Sample Timestamp Analysis of Andariel Group
- 56:06BLACK HAT SOUND BYTES (CONCLUSION)
related talks
55mNation-State Moneymule's Hunting Season – APT Attacks Targeting Financial Institutions
25mGlobal Threat Brief: Hacks and Adversaries Unveiled
43mBackground Story of "Operation neutralizing banking malware"
51mIf It’s Smart, It’s Vulnerable
18mBehind enemy lines
28mGoldilocks and the Three ATM Attacks
46mAttacks, Lies and the Underground World
12mWinning the fight, losing the war