How malware moved the exchange rate in Russia

One Friday, around about lunchtime, a Russian bank placed a set of orders totaling more than 500 million USD on an interbank currency trading system. The orders made the ruble-dollar rate swinging between 55 and 66 RUB/USD – a range by order of magnitude bigger than normal. While the bank, Kazan-based Energobank, only suffered marginal financial losses, it is still a notable incident – it was not unwary trader who placed the orders, but malware.

Interestingly, this all took place a year ago. However, details have been published only recently, delayed by investigations by Energobank, the Russian central bank, the Moscow Exchange and also the police. Energobank hired Group-IB, an information security consultancy; ESET; and a few other companies from the information security sector to assist in the investigations.

How malware moved the exchange rate in Russia