‘Silence’ Malware Attacks Russian Banks

“…NuData Security points out that that use of behavioral and passive biometrics offers just such a solution, since even when hackers attain the credentials of would-be victims…”

As if the world needs any more compelling reasons, a new piece of malware is helping to demonstrate why digital security is of critical importance: The ‘Silence Trojan’ has already infected ten banks across Armenia, Malaysia, and, primarily, Russia.'Silence' Malware Attacks Russian Banks

The malware requires an already compromised computer. Once that is in the attackers’ hands, a seemingly routine email request is sent to bank staff to open a new customer account, sometimes even using another bank staffer’s email address as the sender. The query includes an attached contract, in which the Silence malware is embedded; once opened, the code loads modules into the victim’s computer allowing the hackers to take screenshots of customer accounts.

From there, the attackers wait and watch, observing the behavior of their victims to determine the best time to drain money from the victim’s bank account.

In its analysis of the malware, Kaspersky Lab notes that the attackers’ use of legitimate administration tools after gaining access to their targets’ internal systems “makes detection of malicious activity, as well as attribution more complicated.” Looking to solutions, Kaspersky Lab points to “preventive advanced detection capabilities such as a solution that can detect all types of anomalies and scrutinize suspicious files at a deeper level, be present on users’ systems.”

And building on that recommendation, in its own analysis, NuData Security points out that that use of behavioral and passive biometrics offers just such a solution, since even when hackers attain the credentials of would-be victims, “they will not be able to use them to finalize a transaction because they will be unable to replicate the behavior associated with the account holder to access the account.” It’s a compelling recommendation; while some administrators in the US and other parts of the world may reassure themselves that the Silence Trojan is mostly targeting Russian banks, that just means there’s an opportunity to implement more powerful security measures to prevent such attacks from happening here – or to detect the ones that may already be underway.

Sources: SecureList, NuData Security Blog