Cyber crooks are using SWIFT to launch new sophisticated attacks, security researchers warn

Disguised malware is entering multiple enterprises’ networks via email phishing campaigns

Security researchers have claimed cyber criminals are using financial messaging service SWIFT in "special, devious ways" to launch new sophisticated attacks against users.

The SWIFT system is used by millions of people around the world and connects more than 11,000 banking and security organisations, market infrastructures and corporate customers in more than 200 countries and territories.

However, experts from Comodo Threat Research Lab have warned it's not as safe as some might believe. The firm claims have discovered a security threat where the perpetrators are using SWIFT to camouflage malware penetration into multiple enterprises' networks via an email phishing campaign.

"It informs the recipient about a SWIFT message' on a wire bank transfer to your designated bank account' and recommends getting the details from the attachment," the researchers said in a blog post.

Advertisement
Advertisement - Article continues below

"In reality, [the] swift message' is nothing but malware [known as] Trojan.JAVA.AdwindRAT."

The team of malware analysts said that once it has penetrated a user's system, it modifies the registry, spawns many processes, checks for an antivirus installation and tries to kill its process.

"Additionally, the malware checks for the presence of forensic, monitoring or anti-adware tools, then drops these malicious executable files and makes a connection with a domain in the hidden Tor network," the researchers explained. "The malware also tries to disable the Windows restore option and turns off the User Account Control feature, which prevents installing a program without the actual user being aware."

Comodo said the sole purpose of this malware attack is most likely an attempt at spying or a "reconnaissance" action, where the attackers send their "cyberspy" to collect information about the attacked enterprise network and endpoints, thus preparing for the second phase of the cyberattack with additional types of malware.

"Having the precise information about the enterprise, these cyber attackers can even create malware specifically adjusted to the target environment to bypass all defensive mechanisms of the enterprise and hit the heart of the target," the firm added.

Nevertheless, Comodo said the malware is only a threat if the company being targeted has been careless about the right defence and hasn't properly protected themselves with adequate malware protections and spam filters.

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now
Advertisement

Recommended

Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/security/identity-and-access-management-iam/354289/44-million-microsoft-customers-found-using
identity and access management (IAM)

44 million Microsoft customers found using compromised passwords

6 Dec 2019
Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/network-internet/wifi-hotspots/354283/industrial-wi-fi-6-trial-reveals-blistering-speeds
wifi & hotspots

Industrial Wi-Fi 6 trial reveals blistering speeds

5 Dec 2019
Visit/hardware/354237/five-signs-that-its-time-to-retire-it-kit
Sponsored

Five signs that it’s time to retire IT kit

29 Nov 2019