Who's by Your Side? From Insider to APT: Latin American Financial System under Attack

Who's by Your Side? From Insider to APT: Latin American Financial System under Attack

Speakers: Diego Matos (LA X-Force Incident Response Leader, IBM); Wesley Silva (Brazil X-Force Incident Response Leader, IBM)

Conference: Ekoparty Miami

YouTube: https://www.youtube.com/watch?v=bz8ylyD5Taw

Overview

This talk, presented by Diego Matos and Wesley Silva of IBM X-Force, delves into the evolving landscape of cyberattacks targeting the Latin American financial system. Titled "Who's by Your Side? From Insider to APT: Latin American Financial System under Attack," the presentation highlights a concerning trend: the blurring lines between traditional cybercrime and sophisticated Advanced Persistent Threat (APT) groups. The speakers, drawing from extensive incident response experience, underscore a significant shift in attacker methodologies, characterized by increased stealth, customized tooling, and, critically, the pervasive and often underestimated role of insider threats.

The core of the discussion revolves around a detailed case study of a highly sophisticated, long-term compromise within the Brazilian financial sector. This incident exemplifies how attackers are leveraging a combination of insider access, legitimate tools, and compromised government infrastructure to achieve their objectives, which extend beyond mere data exfiltration to include data manipulation for direct financial fraud. The talk serves as a crucial warning to financial institutions and security professionals, urging a re-evaluation of defensive strategies in the face of these complex, multi-faceted threats.

Matos and Silva emphasize that the observed changes are not merely incremental but represent a fundamental shift in how threat actors operate, making attribution and detection increasingly challenging. The incident they dissect showcases a level of planning and persistence typically associated with nation-state actors, yet executed with the financial motivation often seen in organized crime. This convergence demands a more holistic and adaptive approach to cybersecurity, focusing not just on external threats but also on the often-overlooked vulnerabilities within an organization's own ranks and its extended ecosystem.

Background

▶ Watch: Introduction and evolution of financial system attacks (0:00)

The evolution of attacks on the financial sector provides a critical backdrop to understanding current threats. The speakers trace this history back to the 1980s, when financial compromise primarily involved physical attacks on ATMs (Automated Teller Machines). Early actors used large, cumbersome tools to physically manipulate ATMs, primarily for credit card theft. This evolved into skimming, where devices became smaller and more discreet, allowing for continued card data compromise.

A significant shift occurred with the advent of software-based attacks. Malware like Plutus, originating from Mexico around 2013, marked the transition from card data theft to jackpotting – forcing ATMs to dispense cash directly. By 2015, these techniques became more global, incorporating "deep insert" methods and using incredibly small, stealthy devices such as Cube and Black Box. These devices were designed to be difficult to detect within ATMs or POS (Point of Sale) systems, enabling the injection of malware like PIX and Pilix to steal payment data directly during transactions.

The narrative then moves to the modern "era of the insider," which the speakers identify as a persistent and growing threat. This period is characterized by attackers leveraging insider access, either through direct recruitment or by planting operatives within target organizations. Two primary types of insiders are observed:

1. Nation-state operatives, such as those associated with North Korea's Lazarus Group, who actively seek employment within companies (especially in the US) to exfiltrate sensitive data for national interests.
2. Recruited employees, who are enticed with financial incentives to provide access or credentials to external threat actors. These employees are often assured anonymity and minimal consequence, making them vulnerable to such propositions.

Alongside insider threats, the pervasive issue of credential theft through info-stealers and compromise of platforms like Microsoft 365 fuels many attacks. This stolen access is then used to orchestrate larger compromises. The speakers highlight the financial impact of such incidents, citing a specific case involving STDC M where a single incident resulted in an estimated 1 billion Brazilian Reales (equivalent to $200-300 million USD) in losses. This historical progression underscores a continuous trend of increasing sophistication, stealth, and a broadening attack surface, culminating in the complex scenarios observed today, where traditional distinctions between different types of threat actors begin to fade.

Key Findings

▶ Watch: Case study: Long-term incident triggered by password spray (11:59)

The in-depth case study presented by Matos and Silva reveals several critical findings that illustrate the evolving nature of threats against the financial sector:

• Blurring Lines between Cybercrime and APTs: The most significant finding is the convergence of tactics. The incident exhibited the long-term persistence, custom tooling, and sophisticated operational security typically associated with Advanced Persistent Threats (APTs), yet its ultimate goal was direct financial fraud, a hallmark of organized cybercrime. This makes traditional attribution models less effective.
• Highly Customized and Stealthy Tooling: Attackers did not rely on publicly available or easily detectable malware. Instead, they developed custom-designed tools for keylogging, lateral movement, data exfiltration, and even direct mainframe interaction. These tools were tailored to the specific target environment, making them virtually undetectable by conventional security solutions that rely on known signatures or typical attack patterns.
• Long-Term Persistence and Operational Security: The attack unfolded over a period exceeding 12 months, demonstrating remarkable patience and persistence. The attackers maintained access and conducted operations while actively evading detection, a characteristic often seen in nation-state operations rather than typical "smash-and-grab" cybercrime.
• Exploitation of Legitimate Infrastructure and Supply Chain: A critical aspect of the stealth was the use of legitimate administration tools like OpenVPN for persistence and MicroTik devices for managing infected endpoints. Furthermore, the Command and Control (C2) infrastructure was hosted on a compromised Brazilian governmental website, leveraging the inherent trust associated with such domains to bypass network defenses and avoid suspicion.
• The Critical Role of the Insider Threat: The investigation unequivocally identified an insider as central to the attack. Shockingly, this individual was initially detected, arrested, and jailed, only to be re-hired by the same organization in a different city, under a different name, and using false documents. This highlights profound vulnerabilities in HR and security vetting processes.
• Beyond Data Exfiltration: Data Modification for Fraud: The attackers not only exfiltrated sensitive customer data (credit card numbers, personal identifiers, addresses, account balances) but also modified customer addresses in the mainframe database. This was a crucial step to facilitate the fraudulent re-issuance of physical credit cards to attacker-controlled addresses, enabling direct financial gain.
• Evidence of Organized Crime: While a single insider was identified, the complexity of the operation, the custom tooling, the compromise of government infrastructure, and attempts from multiple locations (even after the insider's initial arrest) strongly suggest the involvement of multiple actors or an organized crime group, rather than a lone individual.
• Targeting of Third-Party Dependencies: The talk also touched upon the broader trend of attackers targeting FinTechs – smaller, often less mature financial technology companies that provide critical services to larger, more regulated banks. These FinTechs serve as a weaker link in the highly interconnected financial ecosystem, offering an entry point to impact the broader system.

These findings collectively paint a picture of a highly adaptive and dangerous threat landscape where traditional security paradigms are increasingly challenged.

Technical Deep Dive

▶ Watch: First attack: Custom keylogger, insider detected and arrested (14:00)

The core of the talk's technical insights centers around a specific incident response case study within the highly regulated Brazilian financial system. This incident, initially perceived as a minor event, escalated into a complex, long-term compromise revealing sophisticated tactics.

The initial access phase, occurring in February of the preceding year, was surprisingly simple: a password spray attack. This often-overlooked technique targeted a computer belonging to a call center manager who possessed high-level permissions. Once initial access was gained, the threat actor deployed a custom-designed keylogger. Crucially, this keylogger was not a publicly known tool; it was specifically crafted for the target environment, with a clear objective to compromise the mainframe. The keylogger's stealth and custom nature made it difficult to detect by standard security tools.

However, a pivotal event occurred: the insider responsible for this initial compromise was detected and arrested, subsequently spending four months in jail. Unbeknownst to the incident response team at the time, this was only a temporary setback for the attackers.

The second phase of the attack commenced in July, roughly five months after the initial compromise. The attackers re-established persistence using OpenVPN, a legitimate administrative tool. This choice of tool allowed them to blend their malicious traffic with legitimate network activity, making detection challenging for Security Operations Centers (SOCs).

The Command and Control (C2) infrastructure showcased a high degree of operational sophistication. The C2 server was hosted on a compromised Brazilian governmental website, specifically denunciapegasus.gov.br. This tactic leveraged the inherent trust associated with government domains, as many companies routinely access such sites for tax payments and other official interactions. This made it highly unlikely for network defenses to flag traffic to this domain as suspicious. The download and installation of necessary components were initiated via human navigation (someone manually accessing the browser), further evading automated detection.

Following re-establishment, the threat actor performed reconnaissance in a highly surgical manner. Instead of broad network scans that generate significant noise, they limited their IP range scanning to specific IPs within the city of Piauí, a location distinct from the initial compromise in Alagoas. This precise targeting aimed to minimize detection.

A custom tool, which notably required licensing (indicating it wasn't open-source or freely available), was then used for lateral movement. This tool enabled the attackers to navigate the network, eventually circling back to the original target region in Alagoas where the mainframe was located. Forensic analysis revealed that XML configuration files associated with this tool contained hardcoded usernames and passwords, suggesting the attackers had intimate knowledge of the target environment and pre-planned their movements. The HTTP requests generated by the tool also contained hardcoded user, password, IP, and port details, further reinforcing the notion of a highly customized and pre-configured attack.

The ultimate objective was data exfiltration. A dedicated, custom-made tool was used to execute over 13 specific queries against the mainframe. The stolen data was extensive, including:

• Credit card numbers
• Client names
• CPF (Cadastro de Pessoas Físicas - Brazil's national identification number)
• Addresses
• Available balance
• Card type (e.g., "classic," "black," indicating higher limits)

During forensic analysis, security teams observed that all mainframe logins were interactive, meaning they required manual keyboard input and mouse control. This finding prompted physical security teams to review CCTV footage. The shocking revelation was that the individual using the compromised computer was the exact same insider who had been arrested four months prior. This individual had been re-hired by the company, albeit in a different city, under a new name, and using false documents. This underscored a critical failure in the organization's background check and re-hiring processes.

Further technical details emerged regarding the MicroTik devices. The attackers established a VPN client-to-site connection to these small, easily deployable network devices. MicroTik routers were used to manage persistence and maintain control over infected machines, again leveraging legitimate, hard-to-detect network components. The domain used for the C2 (denunciapegasus.gov.br) was registered only one day prior to the main attack, a deliberate tactic to avoid early detection by threat intelligence services that monitor newly registered suspicious domains.

Beyond exfiltration, the most alarming technical action was data modification. The attackers modified client addresses in the mainframe database. This was a sophisticated step to facilitate direct fraud: by changing the delivery address, they could intercept newly issued physical credit cards that clients might request (e.g., a second copy due to loss). This allowed them to receive and activate the cards themselves, enabling direct financial theft. The speakers also noted evidence of a second, similar attack attempt in São Paulo, suggesting a broader, coordinated effort rather than a lone actor. The lack of CCTV footage from São Paulo prevented identification of a second insider, but the compromised governmental sites and complex infrastructure pointed to an organized group.

This detailed technical breakdown highlights a strategic shift towards blending sophisticated cyber operations with traditional insider threats and social engineering, all while meticulously covering tracks using legitimate infrastructure and custom tools.

Demo / Proof of Concept

▶ Watch: Attacker modifies database for physical card reissuance fraud (26:00)

The talk "Who's by Your Side? From Insider to APT: Latin American Financial System under Attack" primarily focused on a detailed retrospective analysis of a real-world, highly complex incident response case. As such, the presentation did not include a live demonstration or proof of concept of the attack techniques or tools described. Instead, the speakers provided a comprehensive account of the investigation, forensic findings, and the observed tactics, techniques, and procedures (TTPs) employed by the threat actors during the actual compromise.

Defensive Implications

▶ Watch: Conclusion: Blurring lines, cybercrime-APT convergence, era of insiders (36:00)

The detailed case study and analysis presented by Diego Matos and Wesley Silva offer crucial insights for defenders, necessitating a re-evaluation of current security strategies.

1. Robust Insider Threat Programs: This is perhaps the most critical implication. Organizations must implement continuous background checks, not just at hiring, and establish stringent policies for re-hiring former employees, especially if they have a history of security incidents or legal issues. Monitoring employee behavior, access patterns, and data exfiltration attempts should be a high priority, even for employees in seemingly low-risk roles like call center managers. Physical security (CCTV) must be integrated with cyber security investigations.
2. Enhanced Supply Chain and Third-Party Risk Management: The targeting of FinTechs and the compromise of governmental websites for C2 underscore the need for rigorous security assessments of all third-party vendors and partners. Financial institutions must demand high security standards from their ecosystem, as a weak link anywhere can compromise the entire chain.
3. Advanced Behavioral and Anomaly Detection: Traditional signature-based detection is insufficient against custom tooling and the misuse of legitimate software. Defenders need to invest in behavioral analytics, User and Entity Behavior Analytics (UEBA), and anomaly detection systems that can identify unusual login times, atypical data access patterns, or the execution of legitimate tools in suspicious contexts (e.g., OpenVPN connections from unusual locations or to unexpected destinations).
4. Comprehensive Logging and Long-Term Retention: The 12-month persistence of the attack highlights the necessity for extensive and long-term logging across all systems (network, endpoint, application, and physical access logs). Logs must be centralized, protected from tampering, and retained for periods that extend beyond typical short-term incident windows to facilitate thorough forensic investigations.
5. Strengthened Credential Hygiene and Multi-Factor Authentication (MFA): The initial compromise via a password spray underscores the importance of strong, unique passwords and ubiquitous Multi-Factor Authentication (MFA) across all accounts, particularly for privileged users. Regular auditing of password policies and user accounts is essential.
6. Network Segmentation and Zero Trust Architecture: To limit lateral movement, organizations should implement stringent network segmentation. A Zero Trust approach, where every access request is verified regardless of origin, can significantly reduce the impact of compromised credentials or internal threats by restricting resource access to only what is absolutely necessary.
7. Proactive Threat Hunting and Intelligence: Given the custom tooling and stealth, organizations must move beyond reactive defense. Threat hunting teams should actively search for indicators of compromise (IOCs) and TTPs described in such incidents, focusing on unusual process executions, network connections to obscure government domains, or unexpected configuration files.
8. Data Integrity Monitoring: The modification of client addresses demands that security teams monitor not just for data exfiltration but also for unauthorized data modification within critical databases. Implementing integrity checks and alerts for changes to sensitive customer information is vital.
9. Incident Response Preparedness for Complex Scenarios: IR teams must be trained for long-duration, multi-faceted incidents involving insiders, custom tools, and supply chain compromises. This includes practicing coordination with physical security, HR, and legal teams.
10. Government Infrastructure Security: The reliance on compromised government websites for C2 highlights a broader need for governments to enhance their own cybersecurity posture. Their digital infrastructure is a critical national asset, and its compromise can have far-reaching implications for public trust and private sector security.

By adopting these defensive measures, financial institutions can better prepare for and mitigate the sophisticated, persistent, and often internally driven attacks that characterize the current threat landscape.

Key Takeaways

• Blurring Lines of Attribution: The distinction between sophisticated APTs and financially motivated organized cybercrime is increasingly blurred, with actors adopting tactics from both, making attribution and traditional threat intelligence less straightforward.
• The Pervasive Insider Threat: Insider threats are a critical and complex vulnerability, demonstrated by the re-hiring of a previously arrested insider using false documents. Organizations must implement continuous vetting, robust behavioral monitoring, and integrate physical and cyber security.
• Sophisticated, Custom, and Stealthy Attacks: Modern financial attacks utilize custom-developed tools, not off-the-shelf malware, tailored for specific environments. These tools, combined with legitimate administration utilities and compromised trusted infrastructure (e.g., government websites), enable long-term persistence and evasion of detection.
• Beyond Data Exfiltration: Threat actors are evolving beyond mere data theft. The case study highlights data modification (e.g., changing customer addresses for fraudulent card re-issuance) as a direct means to financial gain, requiring defenders to monitor data integrity as closely as data confidentiality.
• Importance of Long-Term Forensics and Behavioral Analytics: The 12-month duration of the attack underscores the need for comprehensive, long-term logging and advanced behavioral analytics to detect subtle, persistent threats that evade traditional signature-based security controls.
• Ecosystem Vulnerabilities: The reliance on third-party FinTechs and the compromise of governmental infrastructure highlight the expanded attack surface. Defenders must extend their security scrutiny beyond their direct perimeter to encompass their entire digital ecosystem.

About the Speaker(s)

Diego Matos serves as the LA X-Force Incident Response Leader at IBM, bringing extensive experience in managing complex security incidents and crisis situations across Latin America. His role involves leading teams that respond to some of the most challenging cyberattacks impacting financial institutions and other critical sectors in the region.

Wesley Silva is the Brazil X-Force Incident Response Leader at IBM. He is responsible for directing IBM's incident response efforts in Brazil, a country with a highly regulated and frequently targeted financial system. Both speakers are deeply involved in analyzing evolving threat actor behaviors and identifying new attack trends, which formed the basis of their presentation on the sophisticated threats facing the Latin American financial sector. Their combined expertise provides a unique perspective on the intersection of cybercrime, nation-state tactics, and insider threats.