[ISN] China Implicated In Hacking Of SMB Online Bank Accounts

http://www.darkreading.com/advanced-threats/167901091/security/attacks-breaches/229402294/china-implicated-in-hacking-of-smb-online-bank-accounts.html

By Kelly Jackson Higgins
Darkreading 
April 26, 2011

This time it wasn't an "advanced persistent threat" associated with 
China: Instead, a fraud alert issued by the FBI today implicates China 
in a cybercrime operation that bilked U.S.-based small to midsize 
businesses of $11 million during the past year.

The FBI warned that it has identified 20 incidents in which SMBs' online 
banking credentials were stolen and their bank accounts siphoned, with 
the money wired to China-based economic and trade companies near the 
Russia border. The attackers attempted to steal some $20 million overall 
during the March 2010 and April 2011 time frame.

What was most striking about the FBI alert was the rare level of detail 
the bureau provided for both SMBs and banks. It spelled out the 
transaction increments and paths used by the attackers, as well as their 
geographic drops and phony company names. The FBI says the stolen funds 
were wired to companies located in China's Heilongjiang province, with 
company names that include Chinese ports such as Raohe, Fuyuan, and Jixi 
City, and the words “economic and trade,” “trade,” and “LTD."

The transactions ranged from $50,000 to $985,000, with most above 
$900,000. According to the FBI, the attackers had the most success in 
getting their hands on the money when they transferred less than 
$500,000 per transaction. When the money is transferred, it's 
immediately withdrawn or transferred elsewhere. They also use money 
mules in the U.S. "The malicious actors also sent domestic ACH and wire 
transfers to money mules in the United States within minutes of 
conducting the overseas transfers. The domestic wire transfers range 
from $200 to $200,000. The intended recipients are money mules -- 
individuals who the victim company has done business with in the past, 
and in one instance, a utility company located in another U.S. state," 
according to the FBI. These ACH transactions from the compromised bank 
accounts were anywhere from $222,500 to $1.3 million.

[...]


___________________________________________________________      
Tegatai Managed Colocation: Four Provider Blended
Tier-1 Bandwidth, Fortinet Universal Threat Management,
Natural Disaster Avoidance, Always-On Power Delivery 
Network, Cisco Switches, SAS 70 Type II Datacenter. 
Find peace of mind, Defend your Critical Infrastructure.
http://www.tegataiphoenix.com/