VOLUME 2
Issue 4

Understanding and Fighting Against Banking Trojans

Page 2

Issue 5

Point-of-Sale (POS) Compromise and MID Refund Frauds

Page 5

Issue 6Web Application Compromise and E-commerce Exploits

Page 8Issue 4

The Monitor - Volume 2

Understanding and Fighting Against
Banking Trojans
The Monitor, Issue 4

Kroll has seen a rise in banking trojan incidents over the last few months, with a growing number in April 2019,
including cases that involved Emotet, Trickbot and Qakbot. Much of the insight and guidance in this month’s
newsletter comes from a recent article on banking trojans by Managing Director Devon Ackerman. Banking trojans
primarily aim to steal the banking credentials of an organization or individual, usually moving silently in the
background leveraging several propagation methods, waiting until victims go to access their personal or corporate
financial accounts. At that point, credentials are captured through a variety of means and ultimately funds are
drained, paychecks are diverted, fraudulent transactions occur, etc.
According to Devon, banking trojans are most commonly introduced into networks by users at all levels of theorganization. Many of the strategies used by fraudsters are not new and include:•

Social engineering attacks, including phishing (email), vishing (voicemail) and smishing (mobile messaging),
where victims most often click on infected links•

Email attachments that contain macro viruses (i.e., maldocs)•

Compromised internet ad campaigns•“Drive-by” attacks: users visit a website infected by malware that in turn infects users’ computers•

Visiting contractors or clients with infected laptops

Devon says that two characteristics make banking trojans like Emotet particularly insidious. First, they arepolymorphic in nature, such that actors can rotate code and signatures virtually every day, enabling them to evade
standard antivirus detection. Second, beyond aiming to capture banking credentials, this malware is able to scrape
or steal the contents of locally stored emails on infected endpoints. “Imagine how much more believable a newphishing campaign is when an attacker has a technically valid email and an entire conversation thread to build on,”explains Devon. “Messages that leverage conversation threads from spoofed senders not only have an easier time
getting through email filters, they are typically recent enough that recipients will likely have lowered their “mental”
defenses from annual cyber awareness training. The ‘clickability’ of these well-disguised emails jumps
astronomically, and so the attacker gains a continuous stream of new victims.”
Statistically, Kroll usually sees less than a 24-hour turnaround between fraudulent domain registrations for spoofing
campaigns and actors leveraging those domains for email fraud.

Kroll, a division of Duff & Phelps

2The Monitor - Volume 2

Issue 4

Additionally, Devon warns that in recent months, the newest strains•

When necessary, Kroll is able to isolate infected systems toof banking trojans don’t stop at bank-related fraud. “Some join withprevent data acquisition or exfiltration from client networks dueother malware as secondary and tertiary payload drops into

to unauthorized access and network intrusions.

infected networks, which aim to saturate victims with unauthorized
remote access looking for additional information to steal. Some•

network perimeter.

infected victims become part of a larger botnet. Kroll has also
observed actor groups moving to deploy ransomware post network

Identify and block actor command and control (“C2”) IPs at the•

Pull selected events to generate a timeline of infections andsaturation as a means to cover their tracks and to further monetize

determine user accounts being utilized by malware for

their intrusion through ransomware payments,” says Devon.

installation and/or spreading.

Emotet banking on Eternal Blue•

Reset domain and local user account credentials for all
accounts known to have been used by the malware to spread

Emotet is known for its ability to maintain persistence and spread(or at the appropriate time, perform an enterprise-wide

across networks thanks to its use of the now infamous Eternal Blue

password reset); also ensure all local administrator user

exploit. Eternal Blue is an exploit that capitalizes on a vulnerability

account passwords are unique.

within the SMB (Server Message Block) protocol. If Emotet finds
an unpatched instance of this vulnerability, it can enable theinstallation of malware without human interaction. Microsoft issued
an emergency patch for the Eternal Blue vulnerability in March
2018, but many systems cannot or do not install updates.

•

Ultimately, create and deploy a custom remediation script topurge remaining malware artifacts.

Case Study

Consequently, threat actors have continued to capitalize on SMB

Kroll recently worked an investigation where a comptroller for avulnerabilities for ransomware and trojan attacks.

large engineering firm received an email request from a known,
legitimate business associate. Despite recognizing that the request

Technically Speaking

was somewhat out of character, the comptroller—who routinely
works with financial information and invoice for payment—opened

While each banking trojan is unique in the mechanisms it employs

the attachment expecting an invoice. The document was in fact a

to inflict harm and further spread malware, the following is amaliciously crafted document disguised as an older legitimate

simplified overview of the way Kroll typically handles common

invoice, which triggered a chain of events on the endpoint thatbanking trojans such as Emotet or Trickbot and provides a glimpse

were invisible to the user. The user, upon interview, stated that they

into the steps of an effective response:

discounted the invoice as having been sent in error since it was•

Deploy Kroll’s endpoint detection and response (“EDR”)

dated months earlier and was known to have been paid.

solution to combine forensic and incident response tools,

The employee’s manager soon received a call from one of thethreat intelligence feeds, human analysts and client feedback

company’s major clients saying they had received a strange email

about their own networks to identify and ban identified malware

from this employee and it could be malicious. Upon being engaged

hashes (i.e., unique fingerprints of malicious processes orby the client’s counsel, a Kroll forensics specialist immediately

binaries). This allows for containment and banning of runningbegan analyzing the supervisor’s email account remotely. Kroll

processes and prevents subsequent execution. Whenconfirmed the account had suffered unauthorized access but with

deployed at an enterprise level, this gives us the ability to block

no signs of the password to the account having been brute forced.

the execution of malware network-wide, sometimes within

Kroll then worked backwards and identified the suspicious email

minutes of sensor deployment and initial data analysis

and malicious document and turned their investigation to theuser’s computer.

Kroll, a division of Duff & Phelps

3The Monitor - Volume 2

Issue 4

Devon Ackerman
Managing Director

Kroll Experts Corner:
Mitigating Banking Trojan Risks
Following are insights on how to better defend against banking
trojan malware.
Managing Director Devon Ackerman says because of thepersistent, polymorphic nature of banking trojans, organizations
should be prepared with a diversified defense that blends “back tothe basics” security with advanced threat monitoring and response
capabilities.
Employee education and awareness still key for defense.
Devon recommends conducting more frequent training with staff at
all levels, including executive leadership and boards of directors.
•

Issuing regular bulletins that share examples of deceptive
emails can prove enlightening to employees.

•

To gauge the effectiveness of their training programs, many
enterprises are proactively making social engineering exercisespart of their technical penetration testing programs.

•

Annual training should be conducted along with tabletop
exercises that involve IT security teams, corporate staff, internaland external legal counsel and a third-party incident response
firm like Kroll.

Be prepared with threat intelligence, endpoint monitoring andexpert response. Traditional anti-virus solutions have historically
proved ineffective against polymorphic, bit-shifting and processhollowing techniques characteristic of today’s banking trojans.
••

Get the Latest Trends andInsights from Kroll In Your Inbox
Sign up for The Monitor newsletter and every month

A sophisticated endpoint detection and response solution will

you’ll gain access to exclusive cyber threat trends

continuously search for known bad and unusual behaviors andderived from Kroll’s global case intake, along withalert the organization to potential intrusions.

tailored recommendations and examples from our

Kroll’s CyberDetectER® Endpoint leverages multiple threat
intelligence sources and IOCs, including Kroll’s learnings fromthreat intelligence experts.
 Free subscription at kroll.com/themonitor

real-world intrusions.

Kroll, a division of Duff & Phelps4Issue 5

The Monitor - Volume 2

Point-of-Sale (POS)
Compromise and MID Refund Frauds
The Monitor, Issue 5

Kroll has identified a growing number of point-of-sale (POS) compromise incidents over the last few months, mostcommonly affecting the retail and service sectors. Cases included POS Shell and POSlurp malware variants as well
as fraudulent Merchant Identification Number (MID) refund incidents.
According to Managing Director J. Andrew Valentine, many POS incidents today can be traced to networks being
compromised by phishing emails. “About eight to 10 years ago, retail-focused cybercriminals saw the success otherthreat groups were having with social engineering tactics as an entry vector. They started to move from primarily
technical attacks to phishing employees such as store managers and customer care personnel to gain access to
networks,” explains Andy.
Andrew notes a recent case that underscores how cybercriminals have gotten very deliberate in their decisionmaking: “In this situation, a store manager received an email for an extremely lucrative catering order with details in
an attachment. The Word document contained remote access malware that was designed to allow unauthorizedaccess and facilitated the threat actor moving laterally to all the stores in the restauranteur’s environment. The
attackers then deployed RAM scrapers set to deploy on Fridays when system memory was loaded with a full week’sworth of transactional data ripe for a maximum return of payment account numbers.”
MID refund fraud making a comeback
Kroll has also been seeing a resurgence of MID refund fraud, which Andrew says was prevalent about two years
ago before a substantial drop-off in activity. In many of these cases, cybercriminals take advantage of virtual
terminals offered by financial institution – either merchant acquirer or processor. Merchants are offered this option
typically for instances where they don’t have physical access to customer cards, or physical payment terminals are
down. (e.g., mail or telephone orders). These solutions allow merchants to accept credit card payments using theirinternet-connected computers. The trouble is that retailers often don’t know this resource is available. Attackers
obtain merchant credentials (usernames and passwords) in any number of ways, including but not limited to social
engineering, looking for credentials not erased from POS devices resold online or through auctions, or even frommerchant information printed on receipts. With access to these merchant acquirer or processor virtual terminals,
attackers can then force high-dollar refunds to be loaded onto gift cards or compromised credit cards without acorresponding initial transaction.

Kroll, a division of Duff & Phelps

5The Monitor - Volume 2

Issue 5

“Unfortunately, many acquirers have no technology to validate that refunds are legitimate,” says Andrew, “and until very recently there were no
requirements to match refunds to corresponding sales.” Andrew also points out that people who are assigned to validate refunds might notrecognize high-dollar refunds as a red flag if these are common for the industry or business.
Beyond POS attacks, retailers are experiencing more ransomware as cybercriminals across industry sectors seek to optimize ways tomonetize network access. Andrew says, “As we described in a previous newsletter, criminals have been following up banking trojan infections
with ransomware after draining or diverting funds. We also recently had a case where attackers infected a system with cryptomining malware,
but then launched ransomware when the return wasn’t sufficient. The moral of the story is that companies have to be as strategic in theirdefense as cybercriminals are in their attacks.” (See this issue’s Experts Corner for Andrew’s best practices for preventing and mitigating
POS compromises.)

Technically Speaking – POS Malware Attack

Technically Speaking – MID Refund Fraud

POS malware attack generally follows a five-step strategy:

How and why recent MID refund frauds work:

1. Infection: Malware is introduced onto the targeted system or

1.

Intelligence Gathering: Criminals obtain a merchant’s

network, often via email compromise or after exploring

credentials (e.g., username, password, merchant ID number)vulnerable / unpatched systems.

through social engineering, email-based attacks, purchaseof used POS devices where credentials have not been erased,

2. Execution: Malware then scans and monitors processes toetc.

find data, creates or modifies registry entries to maintainpersistence, and may even introduce additional elements such2.

as keyloggers or bot functionality.

devices with the merchant’s credentials or gain access to amerchant’s virtual terminal with credentials obtained during

3. Collection: Using RAM “scrapers”, it evaluates the clear-text

intelligence-gathering.

RAM data to differentiate between encrypted payment data
versus other types of data.

3.

loaded on a gift card.

back to the criminals via a command and control (C2) server.
4.

often not vigilant; attackers can mask fraudulent requests with

(ATMs), to make online purchases, or to sell for profit on black

legitimate batches so detection becomes even harder.

market websites or forums.

Integration Cell (NJCCIC)

Kroll, a division of Duff & Phelps

Evade Detection: Refund requests are rarely validated
against real transaction IDs; monitoring is human-based andfor physical use at retail stores and automated teller machines* Source: New Jersey Cybersecurity and Communications

Attack: Refunds are forced through the payment system
without a corresponding sales transaction, and the funds are

4. Extraction: Payment card data is extracted and transmitted

5. Profit: Attackers use the information to create fraudulent cards

Compromise: Attackers program purchased POS

5.

Loss Recognition: Businesses recognize an imbalance intheir financial reporting after extensive losses.

6

The Monitor - Volume 2

Issue 5

Case Studies•

Threat actors posed as disgruntled customers and sent a
strident complaint to a company’s online customer care

Andrew Valentine
Managing Director

center. As a follow-up to the company’s initial response, thefraudsters submitted a Word document that they claimed
provided full details of their complaint. Upon opening theattachment, the customer care representative unwittingly
unleashed malware that allowed unauthorized access to themerchant’s systems environment. This was followed shortly
thereafter by a significant POS attack.
•In one MID case that Kroll examined, a threat actor was using
the credentials associated with a small enterprise’s payment
terminal to issue fraudulent refunds of up to $1.3 million. Manyof these refunds happened in the off-hours when no one wason the premises, which was indicative of a remote intrusion. An
additional red flag was the fact that this client routinely
processed only low-dollar transactions. Kroll determined thethreat actors likely compromised a virtual terminal that wasprovided to the client by their payment processor and used
this terminal to issue the fraudulent refunds.

Kroll Experts Corner:
Top Five Best Practices for Mitigating POS
Compromises
Based on their fieldwork investigating numerous POS
compromise cases, Managing Director Andrew Valentine andDirector Brandon Nesbit recommend these top five bestpractices for avoiding or mitigating POS fraud:
Segregate payment and corporate networks.
This separation will help keep intruders from moving between
these systems. On a related note, ensure systems in the
cardholder data environment cannot communicate directly tothe internet nor to other systems with that capability.
Restrict outbound activity from the card processing
environment.
Restrict this activity to only specific destinations required fortransaction processing. Consider going further by including awhitelist of only trusted programs, websites, IP addresses
and associated ports and protocols.
Implement end-to-end encryption (E2EE) on
payment devices.
E2EE effectively prevents RAM-scraping malware fromcarving cardholder data out of memory.
Conduct regular employee training andsecurity awareness.
Pay particular attention to social engineering schemes andhelp employees learn how to spot phishing emails and otherattempts to manipulate them into providing access.
Implement multi-factor authentication for all privileged
accounts and remote access.
Merchants should work to implement a multi-factor
authentication schema for all remote access into both
corporate and PCI environments.

Kroll, a division of Duff & Phelps

7Issue 6

The Monitor - Volume 2

Web Application Compromise andE-commerce Exploits
The Monitor, Issue 6

Kroll identified a growing number of web compromise incidents over the last few months, including cases thatinvolved code injection techniques and sniffers. Web compromises most commonly affected the e-commerce
platforms in the retail sector.
Web application compromises involve a variety of exploits directed at web applications (e.g., content management
systems) and e-commerce platforms, such as the popular e-commerce platform Magento. Actors use techniquessuch as structured query language (SQL) injection, cross-site scripting (XSS) and account takeover (ATO) attacks
to gain access to payment data and other personal information submitted on payment sites.
The National Vulnerability Database (NVD) posted an alert in April 2019 specifically on an SQL injection vulnerability
in Magento which could allow an unauthenticated user to execute arbitrary code and gain access to payment
information.
According to Kroll Managing Director J. Andrew Valentine, bad actors are primarily focusing their web compromise
attacks on vulnerabilities in three areas: (1) the Magento platform itself, (2) third-party plug-ins and (3)misconfigured Amazon S3 buckets.
“Users can address the S3 bucket issue by simply configuring their AWS accounts with the proper access
controls,” says Andrew. “However, dealing with the Magento and third-party plug-in issues is a more difficult
proposition and requires both proactive and ongoing mitigation efforts. For example, a Magento idiosyncrasy
requires users to patch sequentially. In other words, if a user applies the patch for the Magento issue noted in the
April 2019 NVD alert but hasn’t applied earlier patches in sequential order, that vulnerability will remain unpatcheduntil all previous patches have been applied first.”
Andrew also notes that many exploits used against the Magento platform and third-party plug-ins can be difficult to
spot: “We find alterations in nondescript areas of websites, e.g., headers and footers, which can help them evadedetection, or in PHP functions or third-party plug-ins, like customer support chat capabilities. Sometimes, attackers
will strategically alter scripts in multiple areas of an e-commerce platform; in many of these cases, website owners
may see one exploit, but not the others.”
From a proactive standpoint, Andrew says Magento users might want to consider running the Magento Security
Scan Tool on their sites to help monitor and detect potential issues. The growing risk landscape may also warrant
upgrading to a higher, more robust version of the Magento platform or exploring the PCI Security Standards Council
list of Validated Payment Applications for potential alternatives.
See more of Andrew’s recommendations in the Experts Corner of this newsletter.

Kroll, a division of Duff & Phelps8Issue 6

The Monitor - Volume 2

Magecart Compromises
Many exploits leveraged against e-commerce systems are often labeled or attributed to “Magecart.” According to Kroll consultant and dark
web specialist Samuel Colaizzi, “Magecart is a generic term that is used by the cyber security industry to classify JavaScript inject attacks
that sniff and scrape payment card data from e-commerce platforms, such as Magento. There is no specific code that would define an attack
as being Magecart; rather, any JavaScript inject that sniffs and scrapes payment card data as well as other personally identifying information(PII) from payment sites would be classified as Magecart.

Technically Speaking:
Sniffer E-commerce Exploits on the Dark Web
A packet analyzer, aka “sniffer,” is not an inherently malicious program; system administrators commonly use it to monitor network traffic. Bad
actors, however, use sniffers to intercept data that they can monetize directly or through its sale, such as unencrypted passwords, usernames,
account numbers, etc.
Below are screen captures of activity on the dark web where someone was selling a sniffer exploit (screenshot 1 below) and a credit cardaggregation/dump (screenshot 2) that could have been obtained via this type of sniffer.

What is happening in the screenshot above:•

E-commerce exploit called “Inter” for sale on the dark web•

Seller “Sochi” posted advertisement on exploits forum on December 2, 2018•

According to open sources, this exploit continues to be sold by criminal actors.

Kroll, a division of Duff & Phelps

9The Monitor - Volume 2

Issue 6

What is happening in the screenshot above:•

On July 9, 2019, JokerStash forum published an aggregated listof credit cards, which could have been obtained via a sniffer likethe one that was being offered in screenshot 1.

•

Andrew Valentine
Managing Director

The JokerStash credit card dump provided credit card
details, including track 1 and track 2 data for major U.S.
credit cards.

•

Card identifiers included bank and BIN number. (Kroll’s
CyberDetectER® BINWatch can monitor for this activity,
enabling clients to take quick action on these cards topreempt fraud.)

Case Studies•

Kroll Experts Corner:
Best Practices for Mitigating Web Compromise
Managing Director Andrew Valentine recommends the following
strategies for mitigating web compromises, particularly thoseaffecting e-commerce sites.
•

Understand and precisely follow the patching regimen for youre-commerce platform. In the case of Magento, remember thatyou must patch sequentially in order for patches to fully execute.

•

Regularly review and properly configure access controls on
Amazon S3 buckets.

•

Implement a file integrity monitoring (FIM) solution, createhash sets for payment pages and monitor the findings every
day for any alterations to payment functions.

•

Similarly, consider employing an endpoint threat monitoring
solution such as Kroll’s CyberDetectER® Endpoint Poweredby Red Canary to provide early visibility to potential attack
vectors enterprise-wide.

•

Update to the latest version of your website’s content
management system (CMS).

•

Monitor the NIST National Vulnerability Database for new
vulnerabilities related to the type of e-commerce platform yourorganization utilizes.

•

Encourage the use of secure coding practices to prevent SQL
injection and XSS.

Kroll reviewed one web compromise incident in which a
software-as-a-service (SaaS) company discovered the website
it used for transactions was injected with malicious code. When
analysts reverse-engineered the code, we discovered it was
scraping sensitive data, temporarily storing it and then sending
the data outbound. The malicious code impacted the victim’s
cloud storage platform and affected the client-side browser.

•

Another web compromise incident affected the payment systemof a food service retailer. The retailer’s web developer conducteda security scan and found a JavaScript code exploit in thecontent management system (CMS) block. According to the web
developer, the exploit was announced in March 2019 andidentified as PRODSECBUG-2198 (an exploit against Magento).

Kroll, a division of Duff & Phelps

10The Monitor - Volume 2

Contact Us

Keith Wojcieszek
Associate Managing Director, Cyber Risk
keith.wojcieszek@kroll.com | +1 443 295 5082
Based in Washington, D.C., Keith joined Kroll from the United States Secret Service, where he served with distinction
for 15 years. Most recently, Keith led the USSS Cyber Intelligence Section, Criminal Investigation Division, where
he managed the agency’s national response to cyber investigative initiatives focused on protecting the financial
infrastructure of the United States. In this role, Keith also coordinated complex international investigations that targeted
transnational organized crime networks with an emphasis on cyber and information security.

Nicole Sette
Director, Cyber Risk
nicole.sette@kroll.com | +1 609 514 8225
Based in the Secaucus office. Nicole is a highly accomplished security professional, who brings unique insightto the multiple dimensions inherent in client challenges from her years of federal law enforcement and military
experience. Nicole served as a Cyber Intelligence Analyst with the Federal Bureau of Investigation for nearly
10 years, and was an Intelligence Specialist with the U.S. Army Communications-Electronics Command for
four years.

Kroll, a division of Duff & Phelps

11

Browse the latest editions of The Monitor and subscribe free at kroll.com/themonitor

About Kroll

About Duff & Phelps

Kroll is the leading global provider of risk solutions. For more than 45 years, Kroll has

Kroll is a division of Duff & Phelps, a global advisor with nearly 3,500 professionals in

helped clients make confident risk management decisions about people, assets,

28 countries around the world. Our clients include publicly traded and privately held

operations and security through a wide range of investigations, cyber security, due

companies, law firms, government entities and investment organizations such as private

diligence and compliance, physical and operational security and data and information

equity firms and hedge funds. We also advise the world’s leading standard-setting bodies

management services. For more information, visit www.kroll.com.

on valuation and governance best practices.

© 2019 Duff & Phelps, LLC. All rights reserved. KR191868

For more information, visit www.duffandphelps.com.