Kaspersky: Physical devices used to steal 'tens of millions' from Eastern Europe banks

Researchers dubbed the scheme "DarkVishnya" and said attackers intruded in-person to plant malicious devices on banks' networks to steal money.

Banks in Eastern Europe were targeted with cyberattacks that involved the planting of physical devices on premises, according to a report from Russian cybersecurity company Kaspersky Lab published Thursday.

Researchers say the attacks have resulted in “tens of millions of dollars” in damage at at least eight banks. “In some cases, it was the central office, in others a regional office, sometimes located in another country,” the report says.

Kaspersky says the attacks, dubbed “DarkVishnya,” were carried out in-person by a third party who planted devices that connect directly to the banks’ networks. The attackers used one of three tools, the researchers say: a laptop, a Raspberry Pi computer or a Bash Bunny — a USB drive-looking device specifically designed to deliver a malicious payload.

Sergey Golovanov, a security expert at Kaspersky, told CyberScoop in an email that the researchers realized that physical devices were being used because of a discrepancy between the number of authorized devices versus connected devices on the banks’ networks.

“Once we compared these numbers, it became clear they didn’t match. In some cases, we were basically tracking a malicious device by following the wires,” Golovanov explained.

Once on the network, the attackers remotely used the planted devices to probe for openly available data relating to making payments and login credentials, the report says. Galovanov said they were using “ATMs and other services that provide clients with funds.” The perpetrators reportedly then used remote desktop software to maintain their presence on the targets’ systems.

According to the report, the cyber-intruders used evasive tactics to hide their presence on the banks’ networks. The attackers apparently used PowerShell scripts — a way to run commands on system without using files that can trigger defensive software — and disguised their planted devices to look like and “unknown computer, an external flash drive, or even a keyboard” on the network.

Golovanov said the identity of the DarkVishnya attackers is not clear and that it’s up to “local security services” to figure that out.

“Judging from the fact that a physical device was, in each case, brought inside the building and connected to the bank equipment, we can suggest that it was one of the visitors to each financial institution,” Golovanov said. “As a cybersecurity provider, we concluded our job as we made sure that the institutions are protected and the threat is eliminated.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure