The carding ecosystem is constantly evolving. The actors have to adapt their methodology in order to continue to steal from the banks with a good cost-effectiveness ratio. To maintain this balance, the carders have moved towards infrastructure-as-a-service, making the analyst's work more and more complex.
Researchers at CSIS Security Group have discovered the infrastructure of a quiet banking trojan actor that has been targeting German users since at least 2014. Our presentation aims to give a technical insight into the whole operation: infrastructure, multi-platform trojans, money laundering schemes, and the recent move towards malware-as-a-service markets like Dreambot, Trickbot, Emotet or even Cobalt Strike.
With this presentation, we want to show how an actor progresses in the carding business, from the development of his own malware to his first million euros stolen.
We aim to show the big picture of the carding ecosystem and discuss the challenges that come with the model.