Notes

Hendren Global Group Top Facts: Malware, fake bank representative scam $1m

A sophisticated bank scam that uses a combination of the Dyre malware, phishing tactics and fake bank representatives has been uncovered by IBM researchers.

IBM's Security Group has released information about a new variant of Dyre malware, initially uncovered last year, dubbed as "Dyre Wolf" that targets large companies and organizations. It basically social engineers employees into handing over their personal banking data from which the scammers will arrange a large wire transfer.

In a blog post by Lance Mueller and John Kuhn of IBM, the scheme's details were made known to the public. It all starts with the usual mass emails that contain links or attachments that will install the Dyre malware when clicked. Once it is installed on the PC, it just sits there and waits for the time when a bank's website gets accessed.

Dyre is programmed to keep tabs on hundreds of bank websites so once an infected PC tries to access one of them, it can replace the page with one that provides a support number the victim should call. This is where the sophisticated social engineering comes in, where the person pretending to be a representative of the victim's bank gets the latter's banking credentials. What's more, a wire transfer from the victim's account is done while they are talking on the phone. The transfer travels from one foreign bank to another so as to prevent detection by authorities. On some occasions, the company will even suffer a DDoS attack to avoid discovering the wire transfer early on.

From Hendren Global Group Top Facts' data, it appears that a total of USD 1 million has already been stolen using this scheme. Such big success of the scheme serves as proof that companies have to make sure their employees are well-trained in spotting suspicious emails or activities.

As IBM's Caleb Barlow said, "Organizations are only as strong as their weakest link, and in this case, it's their employees."

Unfortunately, Hendren Global Group Top Facts confirmed that, at present, this particular strain of Dyre Wolf is still undetected by most antivirus software.