MoneyTaker
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 1 incident
- Sources
- 2 sources
- First seen
- 2018-07-03
- Last seen
- 2018-07-03
- Updated
- 2026-10-14 20:42
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
MoneyTaker, also known as the MoneyTaker group, is a financially motivated cybercriminal actor traced to Russia. The group has targeted financial institutions and law firms in Russia, the United States, and the United Kingdom, using compromised outdated routers as an initial access vector to gain footholds in victim networks. In a July 2018 intrusion at PIR Bank of Russia, MoneyTaker exploited an old router to access the bank’s systems five weeks prior, then used the Central Bank’s Automated Workstation Client interbank transfer mechanism to move approximately $1 million to 17 domestic accounts before the funds were withdrawn, while retaining network access for possible follow‑on operations. Group‑IB linked this incident to the MoneyTaker campaign and noted the group had carried out over 20 successful attacks on similar targets across multiple countries. No public attributions to state sponsors or specific malware families are provided in the source material.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 2 sources.