Customers of the secure global financial messaging service SWIFT are the latest targets of a financial Trojan called Odinaff. It is believed to use similar tools as another sophisticated Trojan, Carbanak; which has been around since 2013.
To get the malware into the network, the attackers use various tools. One of which is free remote desktop access software called Ammyy Admin. This particular site has been repeatedly attacked and used to spread more malware. Yet, administrators and others continue to use the tool. It is 
recommended that anyone needing a remote access tool find an alternative to this one, as security does not seem to be a priority.
Other ways Odinaff has been let loose on networks is by phishing and spear-phishing. Documents are sent in email messages that are infested with a malicious macro or a password-protected RAR (compressed) file. In addition, it spreads via the botnet Andromeda and Snifula; a Trojan that steals confidential information from compromised systems.
Training, educating, and making users aware of the fact that phishing is abundant, how to detect attempts, and what to do should one identify or fall victim should play a priority role in the security strategy for any organization. There are many organizations that can help put a plan together. Once it is in place, it should be reviewed and updated annually. Technology and malware change and evolve quickly. Therefore, it’s not reasonable to expect a security strategy to be valid year after year without any updates.
How do the researchers know Odinaff is targeting SWIFT? Because they are seeing similarities to previous attacks on SWIFT and because there are tiny executable files that monitor SWIFT customers’ logs for particular keywords referring to transactions with specific International Bank Account Numbers.
Attacks were seen earlier in the summer have hit over 100 financial institutions over ten months, including banks, trading, securities, and payroll organizations. The SWIFT network handled nearly 17 million messages per day in 2015. Unfortunately, due to the amount of activity it sees, the 11,000-member base in over 200 countries, and millions of current and former employees, it is difficult to thwart and attack by someone who really wants to succeed. SWIFT has not ignored this and is calling for tighter anti-fraud controls and more cooperation among its members. It also has introduced a set of core security standards and an associated assurance framework for customers. They will be required to prove compliance of these standards annually. According to SWIFT’s website, this is in an effort to support and help them improve their own security measures which will in turn, help improve security and awareness for the entire industry.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
