Some U.S. companies may unwittingly be helping to provide millions of dollars in illicit financing to businesses in China.
An alert from the FBI and the Financial Services Information Sharing and Analysis Center (FS-ISAC) this week warned small and midsize U.S. businesses to be on the lookout for online account takeovers and fraudulent Automated Clearing House (ACH) transactions.
The warning comes in the wake of a rash of recent incidents in which online bank accounts belonging to small and midsize businesses (SMB) were hijacked and money from them was stolen and transferred to accounts apparently held by several legitimate businesses in China's Heilongjiang province along the Russian border.
Between March and April, the FBI identified at least 20 incidents in which cybercriminals gained access to SMBs' banking credentials, such as usernames, passwords or authentication tokens, and used them to electronically wire money to accounts held by "Chinese economic and trade companies," the alert said.
The amounts of the illegal wire transfers have ranged from $50,000 to $985,000, with the majority involving sums of more than $900,000.
Many of the companies that have received the money are registered in port cities such as Raohe, Fuyuan, Jixi City, Xunke, Tongjiang and Dongning. The companies appear to be legitimately registered businesses and typically have accounts at the Agricultural Bank of China, the Industrial and Commercial Bank of China and the Bank of China, the alert said.
So far, the break-ins have siphoned $11 million out of SMB accounts. In all, the crooks have attempted to steal $20 million from SMBs in the past month, the alert warned.
Such online account takeovers are not new. The FBI, the FS-ISAC and NACHA, the body that oversees the ACH network, issued a similar warning in the fall of 2009.
At that time, the FBI said several new cases were reported weekly. In most instances, the crooks used sophisticated keystroke logging and Trojan horse programs to steal log-in credentials from company employees authorized to initiate funds transfers on behalf of their employers, the FBI noted in its 2009 alert.
The same warnings were repeated in this week's alert. The alert noted that the malware used in the recent attacks had not been identified in all cases, but at least some instances involved the ZeuS banking Trojan, the Backdoor.bot keylogger and Spybot, an IRC backdoor Trojan.
In addition, one victim reported being hit with malware that allowed hackers to completely erase the hard disk of the infected computer before any investigations could be done, the alert said.
Sign up for CIO Asia eNewsletters.