RedBanc

Date (as written): 2018-12
Year: 2018
Country: Chile
Actors (as written): Hidden Cobra
Actor pages: Hidden Cobra
Tags (as written): Finance ATM FinancialGain

Source entries (7)

lazarus.day

RedBanc · 2018-12

RedBanc, a Chilean financial network, was tied in linked reporting to a Lazarus-associated intrusion after disclosure of malware and tooling overlaps with other financial-sector activity. QuoScient reported that a Lazarus-linked tool observed in the RedBanc case matched activity against a Pakistani financial-services employee, suggesting reuse of North Korea-linked financial intrusion tradecraft across separate targets; the incident was also listed by the UN Panel of Experts in DPRK cyber-enabled financial theft context.

https://lazarus.day/incidents/redbanc/

CSIS Significant Cyber Incidents

CSIS entry 771 · December 2018

North Korean hackers targeted the Chilean interbank network after tricking an employee into installing malware over the course of a fake job interview

https://csis-website-prod.s3.amazonaws.com/s3fs-public/2026-07/260706_Significant_Cyber_Events.pdf?VersionId=1Li2342elpx5OV3lnGEYyXXB_LRbGnPm

EuRepoC

Chilean Redbanc · 01.12.2018

The North Korean state-sponsored hacking group "Lazarus Group" gained access to the network systems of the Chilean company Redbanc, which interconnects the ATM infrastructure of all Chilean banks.

https://www.zdnet.com/article/north-korean-hackers-infiltrate-chiles-atm-network-after-skype-job-interview/

https://www.flashpoint-intel.com/blog/disclosure-chilean-redbanc-intrusion-lazarus-ties/

CISSM Cyber Events Database (copy exported 21 Apr 2023, via github.com/holisticinfosec/CISSM-EDA)

Redbanc · 2019-01-15

Flashpoint analysts believe that the Lazarus Group is behind the recent intrusion suffered by Chilean interbank network Redbanc via carried out via the PowerRatankba malware.

https://www.flashpoint-intel.com/blog/disclosure-chilean-redbanc-intrusion-lazarus-ties/

UN Panel of Experts S/2019/691

Attack on Redbanc using malware called POWERRATANKBA. Sophisticated social engineering via LinkedIn, Skype. · Oct 2018

Annex 21: Suspected DPRK cyber-attacks on financial institutions (including banks and cryptocurrency exchanges) investigated by the Panel. A. Banks. Attack on Redbanc using malware called POWERRATANKBA. Sophisticated social engineering via LinkedIn, Skype.

https://undocs.org/S/2019/691

Mendeley Data: Collection of DPRK state-sponsored threat actors' activities v2 (Lyu, Sungkyunkwan Univ.)

RedBanc · 2018-12

Reported: 2018-12; Victims: RedBanc; Motivations: FinancialGain; Sectors: Finance; Countries: Chile

https://data.mendeley.com/datasets/wwb2rzgfn7/2

Hackmageddon cyber attacks timelines (Paolo Passeri)

Redbanc · 15/01/2019

Flashpoint analysts believe that the Lazarus Group is behind the recent intrusion suffered by Chilean interbank network Redbanc via carried out via the PowerRatankba malware.

https://www.hackmageddon.com/2019/02/04/1-15-january-2019-cyber-attacks-timeline/

https://www.flashpoint-intel.com/blog/disclosure-chilean-redbanc-intrusion-lazarus-ties/

Suggest a correction on GitHub