Tag Archive for: Dismantle

Authorities Dismantle Grandoreiro Banking Malware Operation


Group-IB, a cybersecurity firm, helped INTERPOL and Brazil dismantle the Grandoreiro banking trojan operation, as their expertise in threat intelligence and investigation was key. 

Malware samples collected during independent investigations in Brazil and Spain (2020-2022) were analyzed by Group-IB and other partners, which helped track the constantly shifting infrastructure of the attackers and pinpoint the active command and control server. 

The combined effort led to the arrest of five administrators in January 2024.

Grandoreiro, a major threat since 2017, used phishing emails mimicking legitimate organizations to target victims in Spanish-speaking countries. 

The malware steals financial data by employing a multi-pronged approach, which monitors keystrokes to capture login credentials, simulates mouse clicks for potentially fraudulent transactions, shares the victim’s screen for real-time hijacking, and displays deceptive pop-ups to trick users into compromising information.

Targeting bank accounts, the malware specifically gathers usernames and bank identifiers, granting unauthorized access, which enables criminals to completely control the victim’s account and siphon funds. 

To launder the money, they employ a money mule network, likely transferring stolen funds to Brazil and estimates suggest the malware has defrauded victims of over EUR 3.5 million, with potential losses exceeding EUR 110 million if attempted thefts were successful. 

In response to a cybercrime campaign targeting Spanish banks with Grandoreiro malware, Brazilian and Spanish authorities independently collected samples between 2020 and 2022. 

To improve their investigations, they collaborated with INTERPOL’s Cyber Crime Unit, and Group-IB, a cybersecurity firm, joined the effort to analyze the malware samples. 

Their threat intelligence and cyber investigation specialists played a key role in dissecting the Grandoreiro samples, enabling investigators to track the malware’s ever-changing network infrastructure and pinpoint the command and control server’s IP address. 

Document

Free Webinar : Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need…

Source…

U.S., partners dismantle Russian hacking ‘botnet,’ Justice Dept says


Law enforcement in the United States, Germany, the Netherlands and Britain dismantled a global network of internet-connected devices that had been hacked by Russian cyber criminals and used for malicious purposes, the U.S. Justice Department said on Thursday.

The network, known as the “RSOCKS” botnet, comprised millions of hacked computers and devices worldwide, including “Internet of Things” gadgets like routers and smart garage openers, the department said in a statement.

RSOCKS users paid a fee of between $30 and $200 per day to route malicious internet activity through compromised devices to mask or hide the true source of the traffic, the department said.

“It is believed that the users of this type of proxy service were conducting large scale attacks against authentication services, also known as credential stuffing, and anonymizing themselves when accessing compromised social media accounts, or sending malicious email, such as phishing messages,” it said.

Several large public and private entities have been victims of RSOCKS, including a university, a hotel, a television studio and an electronics manufacturer, the department said. It did not name any of them.

Source…

Romanian Authorities Dismantle Phishing Gang – Softpedia

Romanian authorities have arrested nine individuals believed to be part of a phishing gang that used hacked accounts to make bids on fake online auctions. Prosecutors from the Romanian Directorate for Investigating Organized Crime and Terrorism (DIICOT …
Read more