Connect with us

Hi, what are you looking for?

HEADLINES

Russia’s largest cybercriminal arrest detain hackers who stole $45M

An investigation into the Lurk cybercriminal gang has resulted in the apprehension of 50 people in Russia, the largest ever arrest of hackers to have taken place in the country.

Sberbank, one of Russia’s largest banks, worked closely with Russian Law Enforcement Agencies and Kaspersky Lab experts in the probe.

Those detained are suspected of involvement in the creation of infected computers networks that resulted in the theft of more than 45 million dollars (3 billion rubles) from banks, other financial institutions and businesses since 2011. 

In 2011, Kaspersky Lab detected the activity of an organized cybercriminal gang using the Lurk Trojan – a sophisticated, universal and multi-modular malware with wide functionality – to gain access to victims’ computers. In particular, the gang was looking for a way into remote banking services so that it could steal money from customer accounts. 

“From the very start, Kaspersky Lab experts were involved in the law enforcement investigation into Lurk. We realized early on that Lurk was a group of Russian hackers that presented a serious threat to organizations and users. Lurk started attacking banks one-and-a-half years ago; before then its malicious program targeted various enterprise and consumer systems. Our company’s experts analyzed the malicious software and identified the hacker’s network of computers and servers. Armed with that knowledge the Russian Police could identify suspects and gather evidence of the crimes that had been committed. We look forward to helping to bring more cybercriminals to justice,” said Ruslan Stoyanov, Head of computer incidents investigation at Kaspersky Lab.

During the arrest the Russian police managed to prevent the transmission of fake money transactions worth more than 30 million dollars (2,273 billion rubles).

The Lurk Trojan

Advertisement. Scroll to continue reading.

In order to propagate the malware, the Lurk group infected a range of legitimate websites with exploits, including leading media and news sites. A victim simply had to visit a compromised webpage to become infected with the Lurk Trojan. Once inside the victim’s PC, the malware would start to download additional malicious modules that enabled it to steal the victim’s money.

Media websites were not the only non-financial target of the group. In order to hide their traces behind VPN-connection, the criminals also hacked into various IT and telecom companies, using their servers to remain anonymous. 

The Lurk Trojan is distinctive in that its malicious code is not stored on the victims’ computer but in the random access memory (RAM). Also, its developers tried to make it as difficult as possible for anti-virus solutions to detect the Trojan. So they made use of different VPN-services, the anonymous Tor network, compromised Wi-Fi connection points and servers belonging to the attacked IT organizations. 

We urge companies to pay close attention to their security measures and to regularly perform an IT infrastructure security check, so that at the very least they are protected from known vulnerabilities. It is also extremely important to teach employees the basics of responsible cyber-behavior. 

In addition, a company needs to introduce measures that will enable it to detect an on-going targeted attack. The best strategy here is to complement the approach to threat prevention with significant investment in threat detection and response. Even the most sophisticated targeted attacks can be spotted by their abnormal activity when compared to regular business workflow. 

Advertisement. Scroll to continue reading.
Advertisement
Advertisement
Advertisement

Like Us On Facebook

You May Also Like

HEADLINES

The NTSC is an industry-wide alliance of corporate security professionals representing the country’s major telecommunications companies, including PLDT Inc., Smart Communications, Inc., Globe Telecom,...

HEADLINES

Globally, almost one in four report losses exceeding $5,000,000, and for some, it surpasses $10,000,000. These findings were revealed in a joint study conducted...

HEADLINES

In a new report covering Q2 2024 – Q1 2025, Kaspersky has found over 250,000 cyberattacks disguised as popular anime among other shows and streaming platforms...

HEADLINES

From January to December 2024, Kaspersky solutions used by businesses here detected and blocked more than 53 million bruteforce attacks. 

HEADLINES

According to Kaspersky experts, 2024 saw over 3 billion malware attacks globally, with a daily average of 467,000 malicious files detected. Windows systems were...

HEADLINES

Cybercriminals target SMBs, schools, and other smaller organizations because they often have less robust security compared to large corporations and other institutions. 

HEADLINES

Sophos Counter Threat Unit revealed the NICKEL TAPESTRY threat group’s scheme involving fraudulent workers operating on behalf of North Korea (formally known as the...

HEADLINES

PRSP is a staunch advocate of communication based on honesty and integrity. While our role is to uphold and strengthen the reputation of our...

Advertisement