New Cyber Attacker Targeting the Banking Sector – Lazarus Group Campaign

 

Cyber attacks against the banking sector are increasing rapidly, and one of the most dangerous threat actors behind these attacks is the Lazarus Group. This group has been responsible for several high-profile financial cyberattacks worldwide, targeting banks, financial institutions, and cryptocurrency platforms.

Security researchers recently observed new campaigns where attackers are using phishing emails, malicious PowerShell scripts, and credential theft techniques to gain access to banking infrastructure. Once inside a network, they attempt to move laterally, escalate privileges, and steal financial data or transfer funds.

---

🎯 Attack Overview

Target Sector

• Banking

• Financial services

• Cryptocurrency exchanges

• Payment gateways

Primary Goal

• Financial theft

• Credential harvesting

• Data exfiltration

• Unauthorized fund transfers

Initial Access Method

• Spear-phishing emails

• Malicious attachments

• Social engineering

• Fake software updates

---

⚠️ Key Attack Flow

1️⃣ Phishing Email Sent to Bank Employees
Attackers send emails pretending to be financial partners or regulators.

2️⃣ Malicious Attachment Execution
The attachment contains a script that launches PowerShell commands.

3️⃣ Backdoor Installation
A hidden backdoor allows attackers to maintain access to the system.

4️⃣ Credential Theft
Attackers collect login credentials from memory or browsers.

5️⃣ Lateral Movement
They move across internal banking systems.

6️⃣ Financial Data Theft or Money Transfer

---

🔍 Indicators of Compromise (IOCs)

Malicious IP Addresses

185.225.17.104
103.246.246.12
45.61.136.85

Suspicious Domains

secure-bank-update[.]com
swift-verification[.]net
banking-auth-check[.]org

File Hash (Example)

SHA256:
6e8f2b9e2c6a7f7e3f1c8f4c91b9eec8e9fef3b8c7c2e6a1f6b9a1d2c4f5e6a1

Suspicious File Names

bank_statement_update.docm
swift_security_patch.exe
finance_update.ps1

🛡 Detection Using SIEM / XDR

ArcSight SIEM Query (PowerShell Attack Detection)

deviceProcessName CONTAINS "powershell.exe"
AND commandLine CONTAINS "-EncodedCommand"

---

Suspicious External Connection (Firewall Logs)

destinationAddress IN
(185.225.17.104,103.246.246.12,45.61.136.85)

---

Proxy Log Detection

requestURL CONTAINS "banking-auth-check"
OR requestURL CONTAINS "secure-bank-update"

---

XDR Hunting Query

Look for:

• PowerShell spawning from Office applications

• Suspicious network connections

• Credential dumping tools

Example:

process_parent_name = winword.exe
AND process_name = powershell.exe

---

📊 Key Takeaways

• The Lazarus Group continues to target financial institutions globally.

• Attackers rely heavily on phishing and PowerShell execution.

• SIEM and XDR monitoring can detect early signs of compromise.

• Organizations must improve security awareness and threat detection.

🔚 Conclusion

Cyber attacks targeting the banking and financial sector are becoming more advanced and frequent. Threat groups such as Lazarus Group continue to use phishing emails, malicious scripts, and credential-stealing malware to compromise organizations. Once attackers gain initial access, they attempt to move deeper into the network, steal sensitive financial data, and sometimes perform unauthorized transactions.

---

🚨 If the Attack Has Already Happened (Incident Response)

If suspicious activity or compromise is detected, organizations should respond quickly to limit damage.

1️⃣ Isolate Affected Systems
Immediately disconnect compromised machines from the network to stop the attack from spreading.

2️⃣ Block Malicious IPs and Domains
Add identified indicators of compromise (IOCs) to firewall, proxy, and endpoint security tools.

3️⃣ Reset Compromised Credentials
Force password resets for affected users and administrators.

4️⃣ Perform Threat Hunting
Search across the environment for signs of attacker activity such as unauthorized logins, suspicious scripts, or unusual network traffic.

5️⃣ Collect and Preserve Logs
Gather logs from endpoints, SIEM, firewall, and proxy systems for forensic investigation.

6️⃣ Notify Security Teams and Management
Inform the SOC team, IT leadership, and if required, regulatory authorities.

7️⃣ Strengthen Security Controls After the Incident
Update detection rules, improve monitoring, and implement stronger access controls.

---

✅ Final Advice:
Organizations should adopt a proactive security approach, combining technology, employee awareness, and continuous monitoring to detect and stop cyber attacks before they cause serious damage.