Hackers Targeting Italian Banking Clients with Web-Inject Toolkit
Channel: Hacking Space Frontier
Date: 2023-05-07

Italian corporate banking clients are being targeted by a financial fraud campaign using a web-inject toolkit called drIBAN since at least 2019. The goal is to infect Windows workstations inside corporate environments to alter legitimate banking transfers by changing the beneficiary and transferring money to an illegitimate bank account. The bank accounts are controlled by the threat actors or their affiliates who launder the stolen funds. The drIBAN operators use web injects to inject custom scripts on the client side using a man-in-the-browser attack and bypass anti-fraud systems. The operators have improved their social engineering strategies and established a foothold for long periods in corporate bank networks. This year, the campaign evolved into an advanced persistent threat, and there are indications that the activity cluster overlaps with a 2018 campaign targeting users in Canada, Italy, and the U.K.