How Do Cyberattacks Hold Banks Hostage?

TL;DR

Modern bank heists become hostage situations when attackers establish persistent access, evade defenses, steal credentials, and manipulate infrastructure instead of completing a single attack and leaving. Financial institutions must monitor Linux workloads and traffic within virtual environments because lateral movement between workloads may never reach the physical switches and taps used by traditional detection programs.

Transcript

Hey, thank you for being here. We are super excited to be back live and in person again, and to be able to interact with everybody on a topic that's very near and dear to all our hearts. Um, we are a team from VMware. I'm going... We're here to talk about modern bank heists and how they are escalating to hostage situations. We're gonna get into som... Read More

Key Insights

• Persistent access is what turns a cyber intrusion into a hostage situation. Attackers may remain inside an environment to collect intelligence, support extortion, steal credentials, deploy ransomware, or use compromised infrastructure to attack upstream and downstream constituents.
• Financial-sector attacks can preview techniques that later appear in other industries. The presenters argue that defenders should study attacks against financial institutions because adversaries use distinctive tactics, techniques, and procedures there before similar methods emerge in additional environments.
• Linux security is increasingly important because 78% of workloads are described as Linux-based. As services and workloads move onto Linux, defenders must build detections and preventive controls for lateral movement, credential harvesting, malware, and other behavior previously monitored primarily on Windows.
• Remote access trojans provide attackers with persistence and communication inside compromised environments. After gaining initial access, threat actors can deploy a RAT or dropper on a Linux system, maintain their implant, beacon back, and prepare additional actions against the organization.
• Defense evasion is presented as a leading tactic behind prolonged compromises. Attackers manipulate common ports, protocols, and ordinary-looking traffic so they can remain hidden and move laterally while taking advantage of the limited data that organizations monitor.
• Virtualized traffic can create major monitoring blind spots. When workloads on the same virtualized host communicate with one another, their traffic may never reach a physical switch, span port, or monitoring tap, leaving traditional network detection systems unable to observe the movement.
• The cognitive attack loop describes adversary activity as continuous rather than linear. After reaching an endpoint, attackers repeatedly inspect running processes, connections, and users, then use what they discover to extend access, establish persistence, obtain credentials, and pursue their objectives.
• Domain administrator credentials can let attackers disable security controls. The presenters identify credential acquisition followed by control manipulation as a specific form of defense evasion, while suggesting that Linux environments disconnected from Active Directory may offer advantages against this path.

Questions & Answers

Q: How do cyberattacks turn banks into hostage situations?

Cyberattacks become hostage situations when attackers maintain persistent access and manipulate the victim's environment instead of completing a single intrusion and leaving. That foothold can support intelligence collection, extortion, credential theft, ransomware deployment, or attacks against connected constituents. The organization is effectively held hostage because the adversary retains access, evades defenses, and can continue exploiting its infrastructure.

Q: Why do attackers remain inside financial institutions?

Attackers remain because an established footprint can serve several continuing purposes. The presenters identify intelligence gathering, extortion, attacks on upstream or downstream constituents, credential acquisition, and ransomware deployment as possible objectives. Continued access also lets adversaries study processes, connections, and users, then adapt their actions as they move through the environment and strengthen persistence.

Q: Why are Linux workloads becoming important cyberattack targets?

Linux workloads are important targets because the presenters state that 78% of workloads are based on Linux systems and nearly 80% of the world's facing applications are powered by Linux. Attackers are responding by targeting these environments with remote access trojans and ransomware, while defenders must expand programs that were historically concentrated on Windows and, in some cases, Macs.

Q: How do remote access trojans support modern bank heists?

Remote access trojans help attackers preserve access after entering an organization. Once deployed on a Linux system, a RAT can act as an implant that communicates back to the threat actor. A dropper may also be used. This persistence gives the attacker time to evade defenses, explore the environment, move laterally, harvest credentials, and potentially deploy ransomware.

Q: Why can traditional network monitoring miss lateral movement?

Traditional monitoring can miss lateral movement because workloads communicating within the same virtualized environment may never send their traffic through a physical switch. That traffic therefore does not reach the taps or span ports used by many intrusion detection designs. Attackers understand these blind spots and can move among virtual machines, workloads, or the hypervisor without appearing in sampled network data.

Q: What is defense evasion in a prolonged cyber intrusion?

Defense evasion is the attacker's effort to avoid detection and preserve access inside the organization. The presenters describe threat actors manipulating common ports, protocols, and traffic patterns to conceal lateral movement. Attackers may also acquire domain administrator credentials and use that authority to disable security controls, allowing the intrusion to continue for a longer period.

Q: What is the cognitive attack loop?

The cognitive attack loop describes adversary behavior as a continuous cycle rather than a linear sequence. Attackers do not perform reconnaissance only once before launching an attack. After landing on an endpoint, they examine running processes, connected systems, and active users, then repeatedly use new information to expand access, establish persistence, collect credentials, and advance their objectives.

Q: How can financial institutions reduce virtual infrastructure blind spots?

Financial institutions need monitoring capabilities inside the virtual space, where communication between workloads may be invisible to physical network taps. Defenders should observe traffic and attacker behavior involving virtual machines, ESX systems, workloads, and the hypervisor itself. They also need Linux-focused detection and prevention for lateral movement, credential harvesting, persistence, ransomware, and defense evasion.

Summary & Key Takeaways

• Modern bank heists increasingly involve attackers maintaining a foothold rather than entering once and departing. Persistent access can support intelligence gathering, extortion, credential theft, ransomware deployment, or attacks against upstream and downstream constituents. The presenters describe this continuing control over systems and infrastructure as a digital hostage situation.

• Linux has become a significant target because the presenters say 78% of workloads are based on Linux systems. Threat actors deploy remote access trojans, droppers, and ransomware adapted for Linux. Security teams therefore need Linux-specific detection and prevention for credential harvesting, lateral movement, persistence, and defense evasion.

• Virtualization creates visibility gaps because traffic between workloads on the same virtualized host may never reach a physical switch or monitoring tap. Attackers understand that organizations sample only part of their traffic and exploit those blind spots. Effective defense requires visibility within virtual infrastructure, including workloads, virtual machines, and hypervisors.