MoneyTaker__2017__Group-IB_MoneyTaker_report.pdf

## Executive summary Group-IB's report analyzes the MoneyTaker campaign (May 2016–Nov 2017), a financially-motivated, highly targeted criminal group that exfiltrated funds and banking documentation from ~20 organisations using Metasploit/Meterpreter, fileless PowerShell/VBS persistence, bespoke MoneyTaker modules that automated replacement of interbank transfer data (AWS CBR), banking and POS trojans (Citadel, Kronos, ScanPOS), and operational security such as forged SSL certs and whitelist-based persistence servers; the report includes detailed IOCs (hashes, IPs, SSL fingerprints), attack timelines, and defensive recommendations.