US Banking System Tightens Cyber Security After Sanctions Against Russia

As tensions surrounding the situation Ukraine remain very high and following the joint decision of the US and the EU to block certain Russian banks from using the SWIFT bank messaging and transfer system, US banking institutions are entering a state of high cybersecurity alert in preparation for possible retaliatory action on part of Russia.

Banks Tightening IT Security

In its report on the subject, Reuters quoted Steven Schweitzer of the Swarthmore Group, who stated that he expects "some retaliatory measures". Banks have always been prime targets for cyber attacks, and in the current situation of escalated tensions, attacks on banking institutions are indeed more likely than ever.

When contacted by Reuters, the five biggest US banks declined any comment on the subject of cybersecurity and did not offer any insight on the specifics of their cybersecurity plans and measures. The American banking system went through a large-scale cybersecurity training exercise conducted by the US Securities Industry and Financial Markets Association. The drill took place back in November of last year.

Reuters quoted Theresa Walsh, US head of intelligence at the Financial Services Information Sharing and Analysis Center, who stated that the current effort is to put specifics to the general mantra of "be prepared". Privately held companies have been warned to be extra alert as well, as breaches and attacks targeting them are not unlikely as well.

Destructive Malware Already Used in Ukraine

This comes in the wake of reports of destructive malware attacks on Ukrainian institutions and websites that took place in January and February 2022. The US Cybersecurity and Infrastructure Security Agency published a summary and a detailed infodump on the payloads used in the attacks.

Two of the payloads used are named WhisperGate and HermeticWiper. According to CISA, Microsoft was the entity that first spotted those attacks, starting with WhisperGate in January. The WhisperGate malware appears to work as ransomware, even displaying a ransom note to the victim. However, under the hood, the malware is purely a data wiper - there is no way to recover the data once it has been hit by the malware.

February saw the deployment of HermeticWiper in attacks on Ukrainian IT targets. According to the CISA report, HermeticWiper behaves a little like WhisperGate, targeting Windows systems. The malware targets the master boot record on the system drives and renders them effectively inoperable by destroying the information needed to boot up the system.

The CISA report on the two destructive payloads includes guidelines regarding mitigation that include a lengthy list of security measures and good practices, behaviors, and protocols to follow so that infection can be avoided in the first place.