Use bank ATMs? Beware! Debit card details, money being stolen!

A malware created to infiltrate Indian bank ATMs and steal customers debit card data has been traced to the 'Lazarus' group controlled by the Reconnaissance General Bureau, North Korea's primary intelligence bureau. The group's activities were widely reported after it was blamed for the 2014 cyber attack on Sony Pictures Entertainment and the 2017 WannaCry ransomware attack on countries including the US and Britain. It is one of the three entities that the US sanctioned earlier this month.

"Lazarus is a rather unusual nation state-sponsored group. On one hand, as many other similar groups do, it focuses on conducting cyberespionage or sabotage operations. Yet on the other hand, it has also been found to influence attacks that are clearly aimed at stealing money," said Konstantin Zykov, Security Researcher at Kaspersky`s Global Research and Analysis Team.

See Zee Business Live TV streaming below:

Kaspersky researchers discovered ATMDtrack, a piece of banking malware targeting Indian banks in 2018. Further analysis showed that the malware was designed to be planted on the victim`s ATMs, where it could read and store the data of cards that were inserted into the machines.

Following further investigation, the researchers found more than 180 new malware samples which had code sequence similarities with the ATMDtrack - but at the same time clearly were not aimed at ATMs. Instead their list of functions defined them as spy tools -- now known as "Dtrack".

Spotted in Indian financial institutions and research centers, the Dtrack spyware is being used to upload and download files to the victims` systems, record keystrokes and conduct other actions typical of a malicious remote administration tool (RAT), Kaspersky researchers found.

Dtrack can be used as a remote administration tool, giving threat actors to complete control over infected devices. Criminals can then perform different operations, such as uploading and downloading files and executing key processes.

Entities targeted by threat actors using the Dtrack remote administration tool often have weak network security policies and password standards, while also failing to track traffic across the organisation, Kaspersky said.

If successfully implemented, the spyware can list all available files and running processes, keylogging, browser history and host IP addresses - including information about available networks and active connections.

This newly discovered malware is active and is still used in cyberattacks, Kaspersky warned.

To avoid being affected by malware, such as Dtrack RAT, Kaspersky recommends using traffic monitoring software, adopting proven security solutions equipped with behaviour-based detection technologies, performing regular security audit of an organisation`s IT infrastructure, and conducting regular security training sessions for staff, among others. (With inputs from IANS)

Tags: Cyber Crime (cyber crime is 2 words??), debit cards, banking

Keywords: