- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Russia(high confidence)
- Motivation
- Financial crime
- Seen
- 2016
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0222 · moneytaker
RussiaWhat it is
In less than two years, this group has conducted over 20 successful attacks on financial institutions and legal firms in the USA, UK and Russia. The group has primarily been targeting card processing systems, including the AWS CBR (Russian Interbank System) and purportedly SWIFT (US). Given the wide usage of STAR in LATAM, financial institutions in LATAM could have particular exposure to a potential interest from the MoneyTaker group.
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Russia, United Kingdom, United States
- Sectors
- Financial
Tools
The tools and malware families the sources tie to it.
- Citadel
- Kronos
- Metasploit
- MoneyTaker
- Screenshotter
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de