{"id":2347,"date":"2019-01-17T09:35:21","date_gmt":"2019-01-17T09:35:21","guid":{"rendered":"https:\/\/www.varutra.com\/blog\/?p=1808"},"modified":"2022-12-02T15:37:01","modified_gmt":"2022-12-02T10:07:01","slug":"security-advisory-tecnimont-cyber-theft","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/security-advisory-tecnimont-cyber-theft\/","title":{"rendered":"Security Advisory – Tecnimont Cyber Theft"},"content":{"rendered":"


\nTecnimont Cyber Theft – Security Advisory<\/strong><\/p>\n

 <\/p>\n

Background:<\/strong><\/h3>\n

Maire Tecnimont SpA is the parent company of the Italian group Maire Tecnimont, which consists of at least 50 operating companies in the engineering and main contracting sector. It deals in oil and gas, chemicals and petrochemicals, energy, infrastructure and civil engineering.<\/p>\n

This document is about a security incident of Tecnimont Cyber Theft wherein a Chinese group swindled US$18.5m from an Indian arm of Italian firm on 10 January 2019.<\/p>\n

 <\/p>\n

Financial Loss:<\/strong><\/h3>\n

USD $18.6 million \/ INR 130 Crore<\/p>\n

 <\/p>\n

How it Happened?<\/strong><\/h3>\n

\"Tecnimont<\/a><\/strong>Figure: Anatomy of Attack<\/em><\/p>\n

 <\/p>\n

Type of Attacks Involved:<\/strong><\/h3>\n
    \n
  1. Phishing<\/li>\n
  2. Cyber Theft<\/li>\n
  3. Identity Theft<\/li>\n
  4. Social Engineering<\/li>\n
  5. Malware Attack<\/li>\n<\/ol>\n

     <\/p>\n

    Prime Target:<\/strong><\/h3>\n

    Indian head of Tecnimont SpA<\/p>\n

     <\/p>\n

    Attack Scenario:<\/strong><\/h3>\n
      \n
    • The Chinese attackers sent emails to the head of Tecnimont Pvt. Ltd., the Indian subsidiary of Milan-headquartered Tecnimont SpA, through an email account that looked deceptively similar to that of group CEO.<\/li>\n
    • The email\u2019s wording imitated the writing style of the group chairman. Other communications that purported to come from various executives were similar in nature as the hackers might have managed to penetrate the IT system and study their emails.<\/li>\n
    • The hackers then arranged a series of conference calls to discuss a possible \u201csecretive\u201d and \u201chighly confidential\u201d acquisition in China. Several people played various roles during these calls, pretending to be the group CEO, a top Switzerland-based lawyer and other senior executives of the company. \u00a7 The attackers have convinced India CEO to send money for a secret acquisition happening in china.<\/li>\n
    • The hackers convinced that the money couldn\u2019t be transferred from Italy due to regulatory issues.<\/li>\n
    • After that the CEO has transferred the amount in three tranches during one week in November. The money that was transferred \u2014 $5.6 million, $9.4 million and $3.6 million \u2014 from India to the banks in Hong Kong was withdrawn within minutes. The fraudsters tried for a fourth transfer, but by then the fraud had been discovered.<\/li>\n<\/ul>\n

       <\/p>\n

      Observations:<\/strong><\/h3>\n
        \n
      • Attackers masked their Email addresses.<\/li>\n
      • Email harvesting done to identify emails of executive officers.<\/li>\n
      • Used similar domains which made the phishing emails seem legitimate. \u00a7 All people in conference call had fraudulent ID\u2019s.<\/li>\n
      • The bank account which they have used to transfer the amounts were opened using fake documents confirmed by the investigators.<\/li>\n
      • The publication reported citing internal examinations that all those on conference calls had sham identities and the top Swiss lawyer who went by the name of Luigi Corradi doesn\u2019t exist. The bank accounts into which the money was sent were opened using bogus documents.<\/li>\n
      • The attack was carried out using Social Engineering + Phishing Emails Attack.<\/li>\n<\/ul>\n

         <\/p>\n

        Recommendations:<\/strong><\/h3>\n

        With respective to this attack below are the recommendations that need to follow:<\/p>\n

          \n
        • Do not respond to unknown and\/or suspicious emails<\/li>\n
        • Conduct phishing diagnostic (red team attack) & social engineering attack to identify overall organization\u2019s security posture<\/li>\n
        • User security awareness training is required<\/li>\n
        • Periodically update the security patches and antivirus signatures<\/li>\n
        • Continuous security monitoring of critical network with securely configured solutions<\/li>\n
        • Use two factor authentications to authenticate into the emails and critical application as well as systems account.<\/li>\n
        • Secure network architecture deployment across main office to plants.<\/li>\n<\/ul>\n

           <\/p>\n

          Author,<\/p>\n

          Jinto T.K.<\/strong><\/div>\n
          SOC Team<\/div>\n
          Varutra Consulting Pvt. Ltd<\/em><\/div>","protected":false},"excerpt":{"rendered":"

          Tecnimont Cyber Theft – Security Advisory   Background: Maire Tecnimont SpA is the parent company of the Italian group Maire Tecnimont, which consists of at…<\/p>\n","protected":false},"author":3,"featured_media":2974,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[276,269,270,277,293,266,271,294,280],"tags":[181,127,182,183],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t