Inside a $15M Cyber Heist: From Home Router Intrusions to Social Engineering

Inside a $15M Cyber Heist: From Home Router Intrusions to Social Engineering

Speakers: Jefferson Macedo, Founder and Technical Director, PurpleBird Security

Conference: Ekoparty Miami

YouTube: https://www.youtube.com/watch?v=0_hoCamzzfg

Overview

In this compelling talk at Ekoparty Miami, Jefferson Macedo, Founder and Technical Director of PurpleBird Security, unravels the intricate details of a multi-million dollar cyber heist that combines sophisticated social engineering tactics with surprisingly low-tech physical intrusions. Titled "Inside a $15M Cyber Heist: From Home Router Intrusions to Social Engineering," Macedo shares a real-world incident response timeline, detailing how a persistent and highly organized threat actor, known as Plum Spider, systematically targeted financial institutions in Brazil, ultimately pilfering $15 million from a single reserve account and being linked to a staggering $200 million breach.

Macedo's presentation highlights the critical vulnerabilities that arise when fundamental security controls are neglected, even within large, regulated financial entities. He demonstrates how Plum Spider leveraged everything from modified home routers and remote management tools to advanced social engineering and an intimate understanding of Brazil's instant payment system, PIX, to achieve their objectives. The talk serves as a stark reminder that while the industry often focuses on cutting-edge threats and AI, the most significant risks frequently stem from failures in basic cybersecurity hygiene and the increasing involvement of organized crime in the digital realm.

This deep dive into Plum Spider's modus operandi is crucial for cybersecurity professionals, incident responders, and financial sector stakeholders. It underscores the importance of a holistic security strategy that encompasses physical security, robust network segmentation, vigilant monitoring, and a proactive approach to social engineering defense. Macedo’s firsthand account of the investigation, from discovering rogue devices to analyzing compromised systems, provides invaluable insights into the real-world challenges of combating a determined and well-resourced adversary.

Background

▶ Watch: Introduction to the $15M Cyber Heist (0:00)

The financial landscape in Brazil has become a prime target for sophisticated cybercrime, particularly with the advent of PIX, the country's instant payment system. Introduced approximately four to five years ago, PIX revolutionized financial transactions by enabling real-time money transfers that must be settled within a mere 10 seconds. This rapid settlement requirement places immense pressure on financial institutions and necessitates a specialized infrastructure. Many smaller financial institutions and fintechs cannot directly connect to the Central Bank of Brazil's SPI (Brazilian Payment System) and thus rely on PSTIs (Payment Service Technical Infrastructures) – tech providers like CNM Software – to facilitate this connectivity.

A critical component of the PIX ecosystem is the reserve account, an amount of money that every participating financial institution must maintain to settle transactions. These accounts often hold millions of Brazilian reais, making them highly attractive targets for cybercriminals. The scale of the threat was dramatically illustrated in June 2025 (as mentioned in the talk, likely a typo for 2023, given the surrounding dates), when CNM Software, a major PSTI, suffered a catastrophic breach. This incident resulted in the removal of approximately 1 billion Brazilian reais, equivalent to $200 million USD at the time, from reserve accounts managed through their infrastructure. This event sent shockwaves through the Brazilian financial sector, highlighting the systemic risks associated with third-party providers and the potential for massive financial losses.

PurpleBird Security's involvement with these types of incidents began much earlier, in January 2023, when they started observing a consistent pattern of attacks. Clients reported social engineering attempts, password spraying, and the discovery of rogue devices within their branch networks. These early cases, affecting call center operators, large financial institutions, and fintechs, exhibited a remarkably similar Threat, Tactic, and Procedure (TTP) footprint, pointing to a single, organized adversary. The culmination of these attacks was a $15 million heist in April 2025 (again, likely 2023), confirming the pervasive and persistent nature of this threat actor.

The threat actor behind these attacks was later identified and named Plum Spider by CrowdStrike in September 2023. However, PurpleBird's investigations suggest Plum Spider had been active for at least a year prior, possibly since January 2022. Plum Spider's primary objective is to gain access to internal payment systems to commit fraud. They strategically avoid targeting individual end-users, instead focusing on financial institutions themselves, where the potential for multi-million dollar gains is significantly higher. A chilling finding is Plum Spider's deep, almost insider-level knowledge of the Brazilian payment ecosystem, strongly suggesting the involvement of insiders or individuals with intimate knowledge of these systems. Initial access for Plum Spider frequently involves vishing (voice phishing) and impersonation of help desk staff, setting the stage for their multi-faceted intrusions.

Key Findings

▶ Watch: Discovery of the "Frankenstein" MikroTik Router (23:00)

The investigation into Plum Spider's activities, spanning multiple high-impact incidents, revealed several critical findings about their operational methodology and the vulnerabilities they exploit:

• Sophisticated Blending of Attack Vectors: Plum Spider masterfully combines seemingly disparate attack vectors, ranging from highly targeted social engineering (vishing, help desk impersonation) to physical intrusions involving modified hardware, and exploiting systemic weaknesses in network and endpoint security. This hybrid approach makes them exceptionally difficult to detect and defend against.
• Exploitation of Basic Security Failures: Despite targeting large, regulated financial institutions, Plum Spider's success often hinged on the absence or misconfiguration of fundamental security controls. Key examples include the lack of a cleanup rule in firewalls, XDR solutions operating in detection-only mode without active monitoring, partial or absent Multi-Factor Authentication (MFA) for critical services like VPNs and Citrix, and weak password policies (e.g., companyname@year).
• Rogue MikroTik Router Deployment: A unique and highly effective tactic was the physical infiltration and deployment of customized MikroTik routers within target branch networks. These small, inexpensive devices were modified with 4G chips to establish an independent, public IP connection, acting as a persistent reverse access point for the attackers. Their small size and placement within network cabinets made them incredibly difficult to discover.
• Insider Knowledge and Organized Crime: Plum Spider exhibits a profound understanding of the Brazilian payment ecosystem, including its architecture and operational nuances. This, coupled with evidence of collaboration with individuals from internet providers to physically install devices, points towards a highly organized crime operation rather than typical cybercrime. The speaker explicitly noted that this is no longer about digital crime but about organized crime sponsoring digital intrusions.
• Persistent and Undetected Presence: In one significant case, Plum Spider maintained a presence within the client's infrastructure for at least 25 days without detection. This extended dwell time allowed them ample opportunity for reconnaissance, lateral movement, and ultimately, the execution of large-scale fraud.
• Leveraging Legitimate Tools and Infrastructure: The threat actor frequently used legitimate remote management (RMM) tools like AeroAdmin, AnyDesk, and TeamViewer, as well as open-source VPN software like SoftEther VPN. They also hosted malicious tools on compromised, less-secure Brazilian government websites (.gov.br domains from small cities), lending a false sense of legitimacy and evading basic URL filtering.

Technical Deep Dive

▶ Watch: Social Engineering and $15M Reserve Account Heist (32:00)

Plum Spider's operations are characterized by a multi-stage approach, meticulously designed to achieve initial access, establish persistence, move laterally, and ultimately exfiltrate funds. The technical execution showcases a blend of social engineering and technical exploitation, often exploiting the most basic security oversights.

Initial Access and Reconnaissance:

The initial vector for Plum Spider predominantly relies on social engineering. This includes vishing attacks and sophisticated help desk impersonation. Attackers would contact employees, often via platforms like WhatsApp, and convince them to install "support tools" or "updates" on their machines. These tools were frequently hosted on compromised, less-secure Brazilian government websites (e.g., gov.br/1.exe), leveraging the inherent trust in government domains to bypass some security filters. The "malicious tools" were typically legitimate Remote Monitoring and Management (RMM) software such as AeroAdmin, AnyDesk, or TeamViewer, providing the attackers with direct remote control over the compromised endpoint.

Simultaneously, Plum Spider engages in password spraying attacks. For one client, they attempted to spray approximately 3,000 accounts. A critical vulnerability was the use of incredibly weak default or easily guessable passwords, such as company name@year. This particular pattern allowed the attackers to breach at least 173 accounts. To automate these attacks, Plum Spider utilized a homemade LDAP tool, indicating custom tooling developed for their specific objectives.

Persistence and Command & Control:

Once initial access is gained, persistence is established through several mechanisms:

1. Rogue MikroTik Routers: This is a hallmark of Plum Spider's physical intrusion tactics. Attackers physically deployed small, inexpensive MikroTik routers (costing around $40) within the target's branch networks. These devices were modified to include a 4G chip, providing them with an independent internet connection and a public IP address. This setup created a reverse access tunnel, allowing Plum Spider to bypass the target's corporate firewall and VPNs, effectively creating their own back door. The routers were often concealed by removing their external casing and wrapping them in black insulating tape, making them extremely difficult to spot within a network cabinet.
2. RMM Tools: The initially installed RMM tools (AeroAdmin, AnyDesk, TeamViewer) provide persistent remote access to compromised endpoints.
3. SoftEther VPN: Plum Spider frequently installs SoftEther VPN, an open-source VPN solution, on compromised internal endpoints. This allows them to create a VPN gateway directly within the target's network, enabling them to ingress and egress the network at will without triggering alarms on traditional perimeter defenses.
4. Tunneling: Beyond SoftEther, Plum Spider employs other tunneling techniques, including Cloudflare D-agent and Azure tunneling, to maintain covert communication channels and exfiltrate data.

Lateral Movement and Privilege Escalation:

Plum Spider's lateral movement strategy capitalizes on internal network misconfigurations and a lack of proper segmentation and monitoring:

• Firewall Misconfigurations: A critical finding was the absence of a cleanup rule in the target's firewalls. This meant that anything not explicitly blocked was allowed, effectively rendering the firewall a "transparent wall" and facilitating unrestricted movement between network segments (e.g., from a call center network to a financial institution network within the same enterprise group).
• Unmonitored XDR/EDR: Even when advanced XDR solutions were in place, they were often configured in detection-only mode and, critically, were not actively monitored. Forensic analysis revealed that the threat actor's activities – such as executing Nmap for network discovery and installing SoftEther VPN – were logged by the XDR, but no alerts were generated or acted upon, allowing the attackers to operate with impunity for extended periods (up to 25 days).
• Partial MFA Implementation: Multi-Factor Authentication was either partially implemented or entirely absent for critical services like VPN access and Citrix environments, making it easier for attackers to leverage stolen credentials.
• Unpatched Vulnerabilities: Prior penetration tests conducted by PurpleBird Security for the client revealed a "bloody" report with numerous critical vulnerabilities. During one such test, PurpleBird was able to achieve Domain Admin privileges within 15 minutes, indicating severe underlying security weaknesses that Plum Spider could readily exploit.

Execution of Fraud:

The ultimate goal is to access internal financial systems. Plum Spider typically moves laterally through the network, often compromising a developer's endpoint first, and then pivoting to a financial analyst's endpoint. From these highly privileged workstations, they gain access to systems capable of initiating financial transactions. Funds are then transferred to several "common people's accounts" controlled by the attackers, which are then quickly moved to cryptocurrency agencies to obscure the money trail and facilitate rapid laundering.

Forensic Process on Routers:

The forensic analysis of the rogue MikroTik routers required specialized techniques. Since these devices do not use standard SD cards or easily accessible storage, investigators had to use an EEPROM reader and USB adapters to extract the firmware. A significant finding was that the firmware on these home routers was not encrypted, allowing investigators to access clear-text logs and configuration data, which revealed the attackers' reverse connection setup and operational details. This process was challenging, with the speaker admitting to "killing almost three hours" before successfully extracting the data.

Demo / Proof of Concept

▶ Watch: Critical Security Failures: Easy Passwords and Blind XDR (37:00)

While a video demonstration of discovering a device in a branch failed to play during the live talk, Jefferson Macedo provided a compelling physical demonstration and detailed explanation of the rogue devices and their forensic analysis. He physically presented a MikroTik router to the audience, highlighting its remarkably small size and how it could be easily concealed within a network cabinet, especially after removing its external casing.

Macedo described the initial discovery of these devices by client B's CISO, who reported finding a "device wrapped in a black insulating tape" in one of their branches. Initially, Macedo suspected a Raspberry Pi with an easily removable SD card for forensic analysis, but upon inspecting the device firsthand, he realized his assumption was incorrect. The device was a modified MikroTik router, further emphasizing the attacker's ingenuity in adapting readily available, low-cost hardware for their nefarious purposes. Over a five-month period, at least 11 such devices were discovered across various branches.

The demonstration extended to the method of deployment, where branch managers reported unrequested visits from "internet provider" personnel for "maintenance." These individuals, likely bribed or coerced by Plum Spider, would physically connect the modified routers to the branch network. This highlights a critical intersection of cyber and physical security, where trusted third parties become unwitting or complicit vectors for intrusion.

The forensic process on these specialized devices was also detailed. Macedo explained that because these routers lack standard storage like SD cards and their firmware is not encrypted, specialized tools were required. He specifically mentioned using an EEPROM reader and USB adapters to extract the firmware. This allowed PurpleBird Security to mount the firmware, extract clear-text logs, and reconstruct the attackers' activities, including their reverse connection setup and command structures. This hands-on explanation of the device and its analysis served as a powerful "proof of concept" for Plum Spider's physical infiltration strategy.

Defensive Implications

▶ Watch: Key Takeaways: Missing Basics, Visibility, Organized Crime (42:00)

The Plum Spider incidents offer critical lessons for defenders, emphasizing that sophisticated attacks often succeed by exploiting fundamental security weaknesses. Addressing these gaps is paramount:

1. Enforce Basic Security Controls Rigorously:

• Multi-Factor Authentication (MFA): Implement and strictly enforce MFA for all critical services, including VPNs, remote access solutions (Citrix), and internal systems. Partial implementation is a significant vulnerability.
• Strong Password Policies: Mandate complex, unique passwords and regular rotations. Actively monitor for and block common patterns like companyname@year. Implement account lockout policies to thwart password spraying.
• Firewall Hardening: Implement a robust cleanup rule (deny all by default) on all firewalls to block any traffic not explicitly permitted. Regularly audit firewall configurations to ensure no transparent walls exist.
• Vulnerability Management: Prioritize and remediate critical vulnerabilities identified in penetration tests. The ability to gain Domain Admin in 15 minutes is an unacceptable risk.

1. Enhance Network and Endpoint Visibility:

• Active XDR/EDR Monitoring: Deploy XDR/EDR solutions in enforcement mode, not just detection-only. Crucially, actively monitor alerts and telemetry. An XDR solution that costs a lot but is not watched or enforced is useless.
• Network Access Control (NAC): Implement NAC solutions across all networks, especially branch offices, to detect and block unauthorized devices connecting to the network.
• Network Detection and Response (NDR): Deploy NDR solutions to detect anomalous network traffic patterns, especially those indicative of tunneling, RMM tool usage, or unauthorized VPNs like SoftEther VPN.
• Log Management and SIEM: Centralize logs from all devices (routers, firewalls, endpoints) and monitor them for suspicious activity, including RMM tool installations, VPN gateway creations, and lateral movement.

1. Strengthen Physical Security:

• Access Control: Strictly control physical access to network cabinets, server rooms, and critical infrastructure, especially in branch offices.
• Third-Party Vendor Vetting: Implement rigorous vetting processes for all third-party contractors, including internet service providers. Verify service requests and personnel identities before allowing access to internal networks. The "internet maintenance" social engineering vector is a significant risk.
• Regular Physical Audits: Conduct periodic physical audits of network infrastructure to identify rogue devices. Train branch staff to recognize and report suspicious hardware.

1. Combat Social Engineering and Insider Threats:

• Security Awareness Training: Conduct frequent and engaging security awareness training, focusing on vishing, help desk impersonation, and the dangers of installing unauthorized software. Employees must be empowered to question suspicious requests.
• Phishing/Vishing Simulations: Regularly test employees with realistic phishing and vishing simulations to gauge their susceptibility and reinforce training.
• Insider Threat Program: Implement an insider threat program to monitor for unusual behavior, especially from individuals with deep knowledge of internal systems or payment processes. The evidence of insiders working with Plum Spider is a major concern.

1. Secure Critical Infrastructure and Payment Systems:

• Network Segmentation: Implement strict network segmentation to isolate critical financial systems and reserve accounts from less secure segments, such as call center networks.
• Supply Chain Security: Conduct thorough security assessments of all third-party tech providers (PSTIs) that connect to critical financial infrastructure. The CNM Software breach underscores this vulnerability.
• Incident Response Preparedness: Develop and regularly test incident response plans specifically for financial fraud, physical intrusions, and social engineering. Ensure rapid forensic capabilities, even for embedded devices like routers.

By addressing these defensive implications, financial institutions can significantly reduce their attack surface against sophisticated threat actors like Plum Spider and build a more resilient security posture.

Key Takeaways

• Organized Crime's Digital Evolution: The Plum Spider case unequivocally demonstrates that cybercrime has evolved beyond individual hackers to highly organized criminal enterprises. These groups possess significant resources, enabling them to sponsor digital intrusions and blend cyber tactics with real-world physical operations, including bribing insiders or third-party contractors.
• The Primacy of Security Fundamentals: Despite the focus on advanced threats, the success of Plum Spider largely hinged on the failure of basic security controls. Neglecting MFA, weak password policies, misconfigured firewalls (lack of a cleanup rule), and unmonitored security tools are critical vulnerabilities that continue to be exploited.
• Visibility is Non-Negotiable: The ability of Plum Spider to remain undetected for 25 days highlights a severe lack of visibility within the target environments. Comprehensive logging, active monitoring of XDR/EDR solutions (in enforcement mode), and network detection capabilities are essential to identify and respond to persistent threats.
• Physical Security and Supply Chain are Critical Attack Vectors: The deployment of rogue, modified MikroTik routers via bribed internet provider staff underscores the importance of physical security controls and rigorous vetting of third-party vendors. The physical supply chain can be just as vulnerable as the digital one.
• Insider Threat and System Knowledge: Plum Spider's deep knowledge of the Brazilian payment ecosystem and the strong evidence of insider involvement are alarming. Organizations must implement robust insider threat programs and restrict access based on the principle of least privilege.
• Don't Underestimate "Low-Tech" Tactics: The combination of simple home routers, basic social engineering, and common RMM tools, when executed by a persistent and organized adversary, can lead to multi-million dollar losses. Defenders must account for all potential attack surfaces, both high-tech and seemingly low-tech.

About the Speaker(s)

Jefferson Macedo, affectionately known as Jeff, is the Founder and Technical Director of PurpleBird Security. With over 16 years of extensive experience in information security, Jeff brings a wealth of practical knowledge to the field. While he also holds a law degree in Brazil, his primary passion and background lie firmly in information technology and cybersecurity. Before founding PurpleBird Security in 2022, Jeff served as the previous Lead of X-Force Incident Response for IBM in Brazil, a role that significantly shaped his expertise and deep-seated love for incident response and investigation. He also shares his knowledge as a professor at local universities and is an authorized instructor for EC-Council in Brazil. Jeff's dedication to understanding and dissecting real-world security incidents, as evidenced by his detailed presentation, makes him a highly respected voice in the cybersecurity community.