Cyber Threat Actor: MoneyTaker

MoneyTaker is a financially motivated cybercriminal group that operates under the alias MoneyTaker and has been linked to Russia based on investigative reporting. The actor primarily targets financial institutions and law firms, with observed activity spanning Russia, the United States, and the United Kingdom. Their strategic objective is the direct theft of funds through unauthorized interbank transfers, as demonstrated by the compromise of a regional bank’s outdated router to access the Central Bank of Russia’s Automated Workstation Client system.

The group’s typical initial access involves exploiting outdated or poorly maintained network devices, such as routers, to gain a foothold inside victim environments. Once inside, MoneyTaker leverages legitimate banking transfer mechanisms—like the AWC system—to move stolen money to multiple accounts at domestic banks, where the funds are quickly withdrawn. After completing a theft, the actors retain persistent access to the compromised network to enable future intrusions, indicating a focus on long‑term operational presence rather than a single‑hit operation. No specific malware families or custom tooling are described in the available sources; the emphasis is on abusing existing infrastructure and trusted financial protocols.

Attribution to MoneyTaker comes from forensic analysis conducted by Group‑IB, which first reported the group in November 2017 and linked it to over twenty successful attacks on financial organizations and law firms across the three regions mentioned. The PIR Bank incident on July 3 2018, in which approximately one million dollars was stolen and transferred to seventeen accounts, serves as a representative example of their operational pattern. No public evidence connects MoneyTaker to a state sponsor or a larger criminal consortium, and the group’s affiliations remain undefined in the disclosed material. The profile reflects only the facts explicitly stated in the provided context, without extrapolation or conjecture.