Hackers net almost $1m in Russian bank raid

A notorious hacking gang has struck again, stealing almost £700,000 ($910,000) from a Russian bank, reports a cyber-security company.

Group-IB was called in to help Russia's PIR Bank after it noticed the theft, said the firm.

The raid is believed to have been carried out by the MoneyTaker gang which has hit other financial firms.

In 2017 it was suspected of stealing nearly £7.5m ($10m) from Russian, British and American companies.

In its report, Group-IB said the cash was taken in a series of transfers on 3 July via a computer at the bank to which the gang had obtained access.

Staff at PIR were able to stop some of the transfers, said Group-IB, but the gang's swift action to "cash out" using paid helpers or "mules" at ATMs stopped the bank recovering much of it.

Group-IB said the tools and techniques used by the gang to penetrate the bank and lurk on its internal systems were known to have been used by MoneyTaker in other robberies.

The attack began in late May, said Group-IB, and initially concentrated on a piece of networking hardware known as a router, which the gang was able to compromise.

By taking over this router, the gang gained access to the bank's internal network.

Once on the network, the gang took time to find a specific computer used to authorise transfers of cash. It then used its knowledge of this system, known as the Automated Work Station Client of the Russian Central Bank (AWS-CBR), to set up the bogus transfers.

"Attacks on AWS-CBR are difficult to implement and are not conducted very often, because many hackers just cannot work on computers with AWS-CBR successfully," said Valeriy Baulin, head of Group-IB's digital forensics lab.

"A 2016 incident, when МoneyTaker hackers withdrew about $2m using their own self-titled program, remains one of the largest attacks of this kind," he added.

Information about MoneyTaker's attack techniques has now been circulated to other Russian banks to help them spot intrusions by the gang, said Grooup-IB.