MoneyTaker: in pursuit of the invisible

MoneyTaker is a financially motivated criminal group attributed by Group-IB with >20 successful attacks (2016–2017) against banks, card-processing systems and financial service providers; they used custom tools (MoneyTaker v5.0, screenshotter/keylogger), common offensive frameworks (Metasploit, PowerShell Empire) and evasive techniques (fileless payloads, SSL C2 using trusted brand names, whitelisted persistence servers) to modify payment orders, exfiltrate data and launder funds via mule networks with average losses reported around $500,000 per incident.