TechWeb

China Implicated In Hacking Of SMB Online Bank Accounts

Apr 26, 2011 (01:04 PM EDT)

Read the Original Article at http://www.informationweek.com/news/showArticle.jhtml?articleID=229402300


This time it wasn't an "advanced persistent threat" that China was associated with: a fraud alert issued by the FBI today implicates China in a cybercrime operation that bilked U.S.-based small- to midsize businesses of $11 million over the past year.

The FBI warned that it has identified 20 incidents in which SMBs' online banking credentials were stolen and their bank accounts siphoned, with the money wired to China-based economic and trade companies near the Russia border. The attackers attempted to steal some $20 million overall during the March 2010 and April 2011 timeframe.

What was most striking about the FBI alert was the rare level of detail the bureau provided for both SMBs and banks. It spelled out the transaction increments and paths used by the attackers, as well as their geographic drops and phony company names. The FBI says the stolen funds were wired to companies located in China's Heilongjiang province, with company names that include Chinese ports such as Raohe, Fuyuan, Jixi City, Xunke, Tongjiang, and Dongning, and the words "economic and trade," "trade," and "LTD."

The transactions ranged from $50,000 to $985,000, with most above $900,000. According to the FBI, the attackers had the most success in getting their hands on the money when they transferred under $500,000 per transaction. When the money is transferred, it's immediately withdrawn or transferred elsewhere. They also use money mules in the U.S. "The malicious actors also sent domestic ACH and wire transfers to money mules in the United States within minutes of conducting the overseas transfers. The domestic wire transfers range from $200 to $200,000. The intended recipients are money mules, individuals who the victim company has done business with in the past, and in one instance, a utility company located in another U.S. state," according to the FBI. These ACH transactions from the compromised bank accounts were anywhere from $222,500 to $1.3 million.

"We'd like see more of this from the FBI--specific and actionable information on a regular basis," say Nick Selby, managing director of consultancy Trident Risk Management, and a police officer. "The FBI is telling the banks what to look out for, and the business owners [as well]--both sides of the equation."

Read the rest of this article
on Dark Reading