Analysis published in August 2022 by Alexandru Angheluș (ProDefence) and Oana Buzianu (Wintech). The full document is available below.

The analysis describes a bank phishing attack targeting UniCredit, ProCredit and BCR customers in Romania through a domain whose subdomains imitated online banking pages. It all started from a single piece of information seen on a monitoring platform: the word “unicredit” in a suspicious address.

Key points

• The financial sector is disproportionately affected because it gives criminals direct access to money.
• The fake pages created a unique session for each victim and closely copied the resources of the official banking websites.
• Since 2013 the domain had been publicly linked to the Yummba web-inject tool, able to intercept SMS authentication codes.
• The server moved from Lithuania to the US during the analysis, a sign that attacks would continue.
• The conclusion: specialists, banks and customers each have a role, and customer education remains decisive.

Context: why banks are targets

Digital society needs services that are always available and sensitive data that is protected. Although attacks hit every industry, the financial sector is disproportionately affected: criminals know they can reach large sums that fund further activity. Many security decisions in banks follow real incidents or specialist analyses, which is why such reports matter.

How the attack was discovered

On a public website analysis platform, an address appeared containing “unicredit” but on a foreign domain. The platform had stored the actual access session to the fake page, confirming a phishing attack that generated a separate session for each victim.

What the analysis showed

A domain with a history

Searches linked the domain to the Yummba tool, used to steal access sessions through web injects: malicious code inserted into the page, or parameters added to the address, that let the attacker follow the victim’s activity. A 2014 Virus Bulletin analysis showed that as early as 2013 the same seller offered an inject able to intercept the SMS messages used for two-factor authentication.

Several banks targeted

The subdomains imitated UniCredit, ProCredit and BCR. The resources loaded by the fake pages (styles, scripts, logo) were copied from the official websites so that they looked as close to the real ones as possible.

Infrastructure

At the start of the analysis the server was hosted in Lithuania; during the analysis the domain moved to a server in the US, keeping its subdomains.

Who the attackers are

The analysis distinguishes two groups: those who own the malicious tools and sell them, sell the collected data or empty accounts themselves, and those who buy the tool or the banking data to withdraw funds.

Full document

What still applies today

• bank phishing remains one of the main ways money is stolen from accounts, and SMS code interception is not new;
• banks must keep protecting customers, but customers cannot rely on the bank alone;
• authentication through the bank’s app is safer than SMS codes, and any request to “update your details” via a link is suspicious.

A similar case involving 2FA bypass is analysed in Bank phishing and 2FA bypass. For the analysis of fraud or a suspicious message, ProDefence offers malware and fraud analysis.