By Raphael Satter, AJ Vicens and Anirban Sen
WASHINGTON, Aug 6 (Reuters) - Ransom-seeking hackers who use phone calls to compromise their victims targeted dozens of prominent U.S. financial institutions and other businesses over the past month, according to Google and internet intelligence data reviewed by Reuters.
The data shows the hackers devised websites aimed at stealing passwords from employees of private equity firms and companies including Blackstone, Bridgewater Associates, Apollo Global Management,
Bain Capital, KKR, TPG, CME Group and Moody's, as well as a host of financial companies and other businesses. Internet company Google said in a blog post about the hacking campaign published on Thursday that the hackers operate under a range of names, including Redact, Pink, Falcon, and Helix.
Google declined to comment on Reuters findings. It said in some cases companies, which it did not name, paid ransoms to the hackers. Reuters could not establish which companies the hackers successfully compromised.
Experts say the hackers' use of low-tech tactics such as phone calls to target the financial industry illustrates how, despite sophisticated security programs and AI-driven threats, the oldest tactics still rank among the most effective. If successful, the hacks could compromise data of some of the biggest U.S. private equity firms that provide capital to companies.
“Because the fence is now so fancy and high-tech, we just have to trick the guard into opening the door for us,” said Lee Clark, a cyberthreat intelligence production manager with the Retail and Hospitality ISAC, an industry information sharing and analysis group.
“That human element consistently is why this has exploded in the way it has," he said.
KKR, Bain Capital, CME, TPG and Apollo declined to comment. Blackstone, Bridgewater Associates and Moody's did not immediately respond to requests for comment.
HACKERS SHIFT ATTENTION: GOOGLE
In its blog post, Google — a unit of Alphabet — said the hackers had recently turned their attention to private equity, law firms, and financial ratings agencies.
Austin Larsen, the principal threat analyst at Google’s Threat Intelligence Group, said the hackers generally targeted industries based on financial calculations, often successfully.
“Really it’s a money thing,” Larsen said. “They think that these firms or organizations have data sensitive enough that, if taken, they would pay to prevent it.”
Google did not identify any of the hackers’ targets by name. Reuters reverse-engineered many of the company-specific online traps used by the hackers by running the 72 malicious websites Google listed in its report through web intelligence platforms such as DomainTools and urlscan, which flagged malicious subdomains tailored to each firm.
Speaking in general about the subdomains, Larsen said "they all were likely used in attempted intrusions" though he cautioned "they were not all successful."
Google said the hackers used “meticulous social engineering tactics,” reaching employees on their personal cellphones while pretending to call from their company’s help desk, sometimes displaying the correct help desk phone number. The hackers told their targets there was an urgent directive from IT to update their passkeys or multifactor authentication and steered the employees toward a booby-trapped website named “passkeyhelpdesk” or “secure-passkey.” If an employee followed the instructions to enter their password, the hackers would harvest their fail-safe passcode – typically sent by text or generated by an app – live over the phone and hijack their account before the call terminated.
Larsen said it was wrong to think of the tactic as particularly advanced.
"Sophisticated is not the right word," he said. "It is just really effective."
(Reporting by Raphael Satter, AJ Vicens and Anirban Sen;Editing by Rod Nickel)
