How Hackers Stole $1,000,000,000 From Banks

July 10th 2016 two men are walking into the entrance of a bank in Taipei they're wearing medical masks and Fisher hats one of them guards the entrance while the other stands in front of the ATM he doesn't do anything though he doesn't withdraw money with a card nor does he try to blow it up he just Waits and then something curious happens the ATM starts spitting out bank note after bank note all he has to do is collect the money as a stranger approaches they immediately abort and leave the stranger will find the cash just lying there even though it doesn't exactly look like it he just walked into a massive Heist while those two men collected their money 20 others did the same thing at other branches this is just one puzzle piece of a larger operation a 2-year long sophisticated attack That Shook the Global Financial system to its core more than 100 Banks in over 30 countries with stolen funds amounting to roughly 1 billion one of the biggest bank heists in history orchestrated by hackers the carbon act group they are led by one elusive Mastermind but on this one night in Taipei he and his team made a crucial mistake one that they will pay a heavy price for Carbono was a game changer I think poof the attackers they have the password of the administrator so at that point we knew that they were watching what we were doing it's very hard to arrest a piece of code [Applause] [Music] F this video was created in cooperation with the cyber security company kasperski Labs on the basis of their documentary series tomorrow unlocked also check out this great podcast Episode by darket Diaries on the story link in the description the actual events of this hack are known but the names of the attacked Banks and involved employees were never disclosed so to tell this story we created Maxim that's it it's the 8th of April a regular Tuesday he works in a Ukrainian Bank he's a well respected employee but he has a bad habit of not installing his Windows updates as he sips his coffee and thinks about the receptionist he has a crush on an email from his colleague Pops in it's from Sergey his coworker the mail has a Word document attached it translates into compliance with federal law 115 dated 217 2014 sounds important enough Maxim clicks on it he reads it closes it and continues his very ordinary workday a few months later Maxim is sitting in a meeting his boss seems distraught some of his bank's ATMs started spitting out Bank notes at seemingly random times of day it seems like whoever was lucky enough to show up at the right time could just grab the money the bank might be the victim of a Cyber attack the employees should act cautious and avoid suspicious emails emails meetings stress colossal hacks for many it's the same story every day what what if you want to throw in the towel and build something of your own Udo is an all-in-one platform that gives you everything you need to manage your business you don't need any Tech skills honestly you can be a complete beginner with Udo you can create a Sleek website and launch your dream project in no time it's just four simple steps what kind of website do you want Define the field of activity and the objective choose a color palette or insert your logo what pages or features do you want pick your favorite theme from the wide range available Udo AI does the rest then you can easily customize your site drag and drop blocks whenever you need them use built-in chat GPT to help you write engage and copy udoo can also handle translations if you want your site to be multilingual udo's first app is free for life with unlimited hosting and support they even give you a free custom domain name for one year on top if you're ready to scale udoo offers a range of other powerful applications to optimize your business visit fern. deal5 now and start building your own websites for free the bank hired kasperski to investigate their problem s all your ATMs are empty you know that something something has happened this is yor thunder he was part of the team on the case he checks the hard diss of the affected ATMs for malware and finds nothing not one suspicious activity not a single Trail to follow a few months later ferv gets a call in the middle of the night it's 3:00 a. m.

it's an account manager working for a large Russian Bank he says thervil and his team need to call his it guy ASAP a couple of minutes later one of Wonder's kasperski co-workers shows up at a bank in Russia the IT guy on the site is panicking someone has gained control over their domain controller that's the heart of their server network if you control the domain controller in a Windows environment you basically control everything and without a good reason it's sending data to China The kasperski Specialist starts to look for malware right away eventually he finds a software that lets you watch and control computer remotely could it be that the Intruder is watching ing them right now he has an idea he opens a Word document and writes the Russian word for hello they wait for a few minutes nothing happens then suddenly the cursor moves and letters appear the hacker answered he adds in Russian you will not catch us to which the kasperski employee replies we will catch you no you will not catch us okay it's odd [Music] it will take some time but eventually the kasperski team finds the malware it is similar to the Garber Trojan one configuration file of the malware is called anac so the team decides to call it carbon AC this incident at the Russian Bank gave Hil and his colleagues hints about what is going on and they link it all back to those hacked ATMs in Ukraine now they can reconstruct how the carbon AAC hackers operate so let's wind back this is one of the carbon act hackers again it's the 8th of April 2014 he already got into sergey's email account but he wants access to Maxim's computer so he sends out this email with that attachment the word file exploits vulnerabilities in Microsoft Word to download malware that contains the back door the hacker now has remote access to Maxim's computer Next Step gain access to the whole network and he knows exactly how to do it the hacker installs a specific software on Maxim's computer which slows it down which in turn frustrates Max ma him so he calls it to come by and check by the time the IT guy comes over the hacker has installed a key loger this way he will be able to see everything one types into Maxim's keyboard the IT guy starts to investigate to do so he needs to type in his admin password and bingo the hacker got the admin's password he tries it out on the domain controller and yep it's the same now he can go look for the computer in the network that controls the money transfers and the ATMs but he doesn't attack right away instead for months he silently observes the employees managing the transactions once he fully understands the process he proceeds to steal the money the carbonet group developed three different methods one way is to transfer money from so-called transaction management accounts to their own accounts to avoid suspicion they raise the balances by the stolen amount beforehand keeping the total unchanged since Banks Check accounts only every 10 hours the transfers go unnoticed another way is to take control of specific ATM M to let them spill out Bank notes right into the hands of money mules these are men hired through the movian mafia who collect the money and send it to their bosses in exchange they get to keep a small cut the third method is the most sophisticated the hackers set up a couple of bank accounts in the names of their money mules including debit cards then they make sure they all have the same small amount on it let's say $3. 33 then they update the bank's database exchanging that $3. 33 for 1 million suddenly all the money mules have a million dollars on their bank account now they just use their debit cards to withdraw the cash as a side effect of the database update some broke Bank customers will suddenly find themselves to be millionaires the better the kasperski team understands the methods of the carbon act group the more they begin to grasp how complex this operation is kasperski teams up with europool major European Banks and various national law enforcement agencies to hunt them down they're able to take down some of their servers but then the hackers start using different tools and continue to work under the radar by the beginning of 2015 carbon act has robbed at least 100 financial institutions in almost 30 countries most of the victims are in Russia but also in the US China and Europe within 2 years they steal roughly $1 billion they appear to be unstoppable until someone screws [Music] up the First Bank reported that over 70 million NT was withdrawn illegally the withdrawals were made in both taipe and Tai Joe across 34 ATMs and 20 branches in July 2016 carbanak attacks the so-called First Bank in Taipei but the Taiwanese police are quick on their feet very quick at least 500 police officer checking the cctvs we check all the footage from the and back to the hotels of all the suspects 22 money mules most of them Russian the rest from Eastern European countries 19 of them successfully flee Taiwan but three remain in the country with the money their faces are all over the media to escape they have to get rid of the money somehow one of them hides two sports bags with some of the money at the dongu park he then fleed to Yong County and hides there but he is caught and leads the police back to the sports bags but instead of two there is only one left an elderly man found one of the bags and took it home he probably think that would that was Fortune from God the police seiz the second bag and search for the other money mules a man called Bobby hides the rest of the money in two suitcases and stoes them in two lockers at Tai Central Station shortly after two other men from Eastern Europe arrive in Taiwan and collect the suitcases from the main station they go to a hotel to have brunch as they sit down they're interrupted by the police put down the knife your folk stay calm don't move with us such they asked the men to take them to their hotel room in their hotel room law enforcement finds Bank notes that are worth roughly 1.