Glossary term
MITRE ATT&CK
MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.
Read more
Significant cyber incident
Bankshot implant attacks on the Turkish financial sector
MITRE ATT&CK says that in 2018 Lazarus Group used the Bankshot implant, a remote access tool, in attacks against the Turkish financial sector.
In short
MITRE ATT&CK says that in 2018 Lazarus Group used the Bankshot implant, a remote access tool, in attacks against the Turkish financial sector. The US Department of Homeland Security first reported Bankshot in December 2017. The DHS and FBI report does not mention Turkey, and the MITRE entry gives only the year, with no month, bank or loss.
What happened
MITRE ATT&CK describes Bankshot as a remote access tool first reported by the US Department of Homeland Security in December 2017. It says that in 2018 Lazarus Group used the Bankshot implant in attacks against the Turkish financial sector.
The US report on the tool is a malware analysis report, number MAR-10135536-B, dated 13 December 2017. DHS and the FBI wrote it together. It says the two agencies identified trojan variants used by the North Korean government and called BANKSHOT. It says the FBI has high confidence that the actors use the variants together with proxy servers to keep a presence on victim networks and to extend their access. The US Government calls this activity HIDDEN COBRA. A US-CERT alert of 21 December 2017 pointed readers to the report.
The report does not mention Turkey. The link to the Turkish financial sector comes from the MITRE entry alone. That entry gives the year 2018, no month, no bank and no loss.
How the attack worked
What the tool does
The DHS and FBI report analyses seven malicious executable files. Five are proxy applications that use a similar cipher to hide the traffic between the malware and the remote operator. Two of those five can create fake TLS handshake sessions using valid public SSL certificates, which disguises the connection to the operator. The other two files are remote access tools that let a remote user run commands on an infected system.
One of the remote access tools adds a cipher and the OpenSSL library to protect traffic with its command server. The report says this tool may have been used to install the proxy servers on compromised systems.
One analyzed proxy binds to the victim system and listens on port 110. Its main purpose is to make the compromised system act as a proxy server, so the operator can reach the internet through it. Data is encoded to stop firewalls and network analysis tools from spotting the proxy sessions.
What the sources do not say
Neither source describes how the tool reached Turkish financial organizations, which systems were hit, or what the attackers did with the access. This page does not fill that gap.
Who says who was behind it
Who attributed it, and how firm it is
Attributed by the US Government to the North Korean government (DHS and FBI report, 13 December 2017). MITRE ATT&CK attributes the 2018 use against the Turkish financial sector to Lazarus Group. The two sources do not overlap on victims: the DHS report describes the malware and does not mention Turkey, and MITRE gives the Turkish link and the year but not a month or a victim.
Impact
MITRE does not name the organizations affected and does not report losses or counts. The DHS and FBI report counts files, not victims. No figure on the number of Turkish institutions, accounts or amounts is available in the official sources opened.
Government and regulator response
DHS and the FBI shared the report on 13 December 2017 to enable network defense and reduce exposure to North Korean government cyber activity. They asked users and administrators to flag activity linked to the malware, report it to the DHS National Cybersecurity and Communications Integration Center or to the FBI Cyber Watch, and give it the highest priority for stronger mitigation. The report includes a detection rule and a list of best practices.
The sources opened contain no statement from a Turkish authority or from a Turkish bank about the 2018 attacks.
Lessons
-
A published report is an early warning
The tool was documented by the US agencies in December 2017, before the 2018 attacks that MITRE describes. The report came with a published detection rule, so defenders had something to check against before 2018.
-
The traffic was built to blend in
The proxies encode their data and can fake TLS handshakes with valid public certificates. A check that only asks whether a connection looks like normal encrypted traffic would miss it.
-
The public record is thin
Only one source ties the tool to Turkey, and it names no victim. Treat the sector link as a warning for banks in the region, not as a description of a specific breach.
What to check in your own organization
-
Keep antivirus signatures and engines current
First item in the US-CERT best practice list in the report.
-
Limit who can install and run software
The report advises restricting users' permissions to install and run unwanted applications.
-
Treat attachments with caution
The report advises caution with attachments even when expected and from a known sender, and scanning attachments to confirm the file type matches the extension.
-
Patch the operating system and disable unneeded services
Both are on the report's list for workstations and servers.
-
Use the report's detection rule and report findings
The report publishes a detection rule for the proxies and remote access tools and asks organisations to report activity to DHS or the FBI.
Where it happened
Questions
What is the Bankshot implant?
MITRE ATT&CK describes Bankshot as a remote access tool first reported by the US Department of Homeland Security in December 2017. The DHS and FBI report calls it a trojan variant used by the North Korean government.
Who used Bankshot against the Turkish financial sector?
MITRE ATT&CK says Lazarus Group used the Bankshot implant in attacks against the Turkish financial sector in 2018. The DHS and FBI report itself does not mention Turkey, so the link comes from the MITRE entry alone.
How does Bankshot hide its traffic?
The DHS and FBI report describes proxy applications that use a cipher to hide traffic between the malware and the remote operator. Two can create fake TLS handshake sessions with valid public SSL certificates to disguise the connection.
Sources
- Bankshot, Software S0239 | MITRE ATT&CK MITRE ATT&CK
- Lazarus Group, Group G0032 | MITRE ATT&CK MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.