The Carbanak group is infamous for infiltrating various financial institutions, and stealing millions of dollars by learning and abusing the internals of victim payment processing networks, ATM networks and transaction systems.
\nRecently, researchers detected Carbanak campaigns attempting to:<\/p>\n
Campaign Targeting Middle East (URLs leading to Exploit Docs) On March 1st 2016, Proofpoint detected a targeted email sent to hand-picked individuals working for banks, financial organization, and several professional service companies and companies selling enterprise software. The Carbanak group is infamous for infiltrating various financial institutions, and stealing millions of dollars by learning and abusing the internals of […]<\/p>\n","protected":false},"author":120,"featured_media":128,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[],"class_list":["post-52","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-phishing"],"_links":{"self":[{"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/posts\/52","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/users\/120"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/comments?post=52"}],"version-history":[{"count":1,"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/posts\/52\/revisions"}],"predecessor-version":[{"id":2628,"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/posts\/52\/revisions\/2628"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/media\/128"}],"wp:attachment":[{"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/media?parent=52"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/categories?post=52"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tikaj.com\/wp-json\/wp\/v2\/tags?post=52"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nThese targets are high level executives and decision makers such as directors, senior managers, regional\/country managers, operations managers.
\nThe majority of targets work in the Middle East region in countries such as UAE, Lebanon, Kuwait, Yemen and others.
\nThe email contained a URL to a Microsoft Word document hosted on a compromised site churchmanarts[.]com. The document, WRONG_AMOUN-01032016.doc (SHA256: ac63520803ce7f1343d4fa31588c1fef6abb0783980ad0ba613be749815c5900), exploits CVE-2015-2545 when opened to drop and execute a downloader from the client\u2019s temporary folder. This document drops essentially the same payload every time, but slightly modified, possibly so that every execution results in a dropped file with a different hash.
\nGet the full report at:\u00a0https:\/\/www.proofpoint.com\/sites\/default\/files\/proofpoint-threat-insight-carbanak-group-en.pdf<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"