September 24, 2012, 11:26 AM — The Financial Services Information Sharing and Analysis Center (FS-ISAC) has put U.S. banks on high alert against cyberattackers seeking to steal employee network login credentials to conduct extensive wire transfer fraud.
The alert warns banks to watch out for hackers using spam, phishing emails, Remote Access Trojans and keystroke loggers to try and pry loose bank employee usernames and passwords.
The FBI has noticed a new trend where cyber criminals use stolen employee credentials to wire transfer hundreds of thousands of dollars from U.S. customer accounts to overseas banks, the FS-ISAC noted.
"The wire transfer amounts have varied between $400,000 and $900,000, and, in at least one case, the actor(s) raised the wire transfer limit on the customer's account to allow for a larger transfer," the alert said. The FS-ISAC noted that it has moved it cyberthreat level from 'elevated' to 'high' as a result of the activity.
A majority of recent victims have been small and medium-sized businesses, small banks and credit unions, the FS-ISAC said. However, a few large banks have also been hit by fraudsters.
The FS-IACS's warning comes the same week that two large U.S. banks -- Bank of America (BofA)and J.P. Morgan Chase --suffered unexplained network disruptions.
A group, calling itself the "Cyber fighters of Izz ad-din Al qassam " on Tuesday warned of an attack against BofA and the New York Stock Exchange. In a PasteBin message, the hitherto unknown group said it was targeting the two organizations in retaliation for a controversial anti-Islam movie that has roiled much of the Middle East for the past several days.
Both Chase and BofA acknowledged the network problems earlier this week but neither spelled out what caused it.
The FS-ISAC alert does not mention either bank by name nor does it refer to any specific incident. So it is unclear whether the alert has anything to do with the disruptions or whether the timing is purely coincidental.
The attacks, as described in the alert, suggest that criminals managed to gain extensive access to bank networks in at least a few instances.
According to the information-sharing center, in some cases, cyber attackers managed to steal login credentials from multiple bank employees and systems administrators. The attackers then circumvented the authentication mechanisms the banks put in place to detect and deter fraudulent wire transfers. "This allowed the intruders to handle all aspects of a wire transaction, including the approval."