Kaspersky: networks of 8 Eastern European banks were hacked by people entering the premises and planting physical hardware like Raspberry Pi and USB devices
Sergey Golovanov / Securelist :
Context & Ripple Effects
Attacks on Eastern European banking have escalated along a visible curve: a hacker gang siphoned more than $15M from regional banks using targeted phishing and malware in 2014, then Kaspersky traced at least $300M stolen from over 100 financial institutions across 30 nations starting in late 2013 — the campaign that showed remote malware alone could drain bank treasuries. What changed with this report is the delivery mechanism: rather than breaching networks from outside, operatives walked onto the premises of eight banks and planted their own hardware.
The move to physical implants closes the loop on earlier findings that bank malware had already gone infrastructure-light — researchers documented hard-to-detect code affecting 140+ banks and other organizations that could be injected straight into memory using legitimate system tools. If software can hide inside trusted processes, cheap off-the-shelf devices like a Raspberry Pi planted inside the building give attackers a foothold no firewall sees.
First-order effects
- The eight affected banks face a threat their existing defenses were not designed for: malicious devices operating inside the physical and network perimeter, meaning incident response must extend to branch access controls, device inventory, and internal traffic inspection.
- Kaspersky's disclosure shifts the threat model for every bank in the region — the assumption that unbreached perimeters equal uncompromised networks no longer holds.
Second-order effects
- Banks' security spending gets pulled toward physical-digital convergence: badge access, visitor policy, and detection of rogue compute devices join endpoint antivirus as budgeted line items, benefiting vendors who can monitor for unauthorized devices on internal networks.
- Cheap single-board computers like Raspberry Pi become dual-use risk objects — the same commodity hardware driving consumer demand is what makes an implant affordable and inconspicuous, complicating procurement and asset-tracking norms.
Third-order effects
- If the pattern holds, bank-heist tradecraft completes its migration from remote compromise (at least $300M stolen remotely since late 2013) to cyber-physical operations, pushing regulators toward treating physical access as a cybersecurity control rather than a facilities matter.
- The precedent echoes Mandiant's finding that Russia-linked Turla piggybacked on decade-old USB-spread malware for stealthy access — removable media and planted hardware persist as attack surfaces precisely because they sit outside software-only defense models, arguing for durable air-gap and media-handling standards in finance.
The trend: Bank-targeting operations are shifting from purely remote malware campaigns toward hybrid intrusions where physical presence and commodity hardware substitute for perimeter exploits.