Elephant Beetle

Using an arsenal of over 80 unique tools & scripts, the group executes its attacks patiently over long periods of time, blending in with the target's environment and going completely undetected while it quietly liberates organizations of exorbitant amounts of money. Researchers are dubbing this group - Elephant Beetle. Elephant Beetle seems to primarily focus on the Latin American market, but that doesn't mean that organizations that are not based there are safe. The group is highly proficient with Java based attacks and, in many cases, target legacy Java applications running on Linux-based machines as the means for initial entry to the network. Not only that, the group even deploys their own complete Java Web Application on the victim machine to do their bidding while the machine also runs the intentional application. Elephant Beetle resembles the group tracked by Mandiant as FIN131. Elephant Beetle operates in a well-organized and stealthy pattern, efficiently executing each phase of its attack plan once inside a compromised network: 1. During the first phase, which can span up to a month, the group focuses on building operational cyber capabilities in the compromised victim's network. The group studies the digital landscape and plants backdoors while customizing its tools to work within the victim's network. 2. The group then spends several months studying the victim's environment, focusing on the financial operation and identifying any flaws. During this stage, it observes the victim's software and infrastructure to understand the technical process of legitimate financial transactions. 3. The group can then inject fraudulent transactions into the network. These transactions mimic legitimate behavior and siphon off incremental amounts of money from the victim, a classic salami tactic. Although the amount of money stolen in a single transaction may seem insignificant, the group stacks numerous transactions to what amounts to millions of dollars before the group moves on. 4. If during its efforts any fraudulent activity is discovered and blocked, they then simply lay low for a few months only to return and target a different system.