The Standoff is a cyberspace where we re-create operational and business processes of real industrial, energy, transport, and finance companies.

Softville

STF Bank is one of two banks in the commercial sector, the other being the recently opened First Partner Bank. Both banks are regulated by the central bank, which supervises the banking system and issues currency. Transactions with the central bank are performed through the ARM KBR system. ARM KBR is specialized banking software that allows banks to make payments via correspondent accounts held in the central bank.
Internet banking is widely used to open accounts, make funds transfers, pay salaries, and carry out many other operations. Companies also use electronic transfers to settle accounts with one another. However, as the range of services offered by internet banking increases, so too does the number of cybersecurity threats. Statistics published by the central bank reveal that banks incur significant financial losses as a result of poor information security. Such banks risk losing their license, which has happened several times in recent years.

# Scope
The external perimeter of the segment is within subnet 10.127.12.0/24.

## Entry points
* 10.127.12.138
* 10.127.12.141
* 10.127.12.143
* 10.127.12.173
* 10.127.12.217
* 10.127.12.254
* 10.127.12.10

STF Bank

Produces electricity to supply the needs of the population and to power several large production facilities

Big Bro Group

A company with the underlying IT infrastructure: a mail server, web applications, ERP and CRM systems, and other services

Hello World Systems

Conducts financial transactions between individuals and organizations, carries out bank-to-bank transfers, and provides online banking services

Several hundred citizens of State F lost money from their bank accounts today. Hackers gained access to the remote banking system (RBS) of STF Bank, transferred customers' funds to their own accounts, then cashed out.

The bank's security service noted the expertise of the perpetrators: not only did they exploit several specific vulnerabilities, but also bypassed the anti-fraud systems. Customers of STF Bank lined up outside branches and ATMs to withdraw their money in secure "paper" format. The total amount of stolen funds is relatively small, but the reputational damage is already significant.

Withdrawal of funds from client accounts through RBS

AlinaPoteet

In an unusual case of fraud, cybercriminals used social engineering to penetrate the internal network of STF Bank, introduce malware, and seize control of a teller's workstation. This allowed the attackers to transfer money from any customer account. The total sum stolen amounted to 1.5 billion rubles. The bank's management was forced to issue a statement, and the insurance payouts are unlikely to cover all the damage, especially reputational.

Withdrawal of funds from client accounts through a teller terminal

Today, the Central Bank of State F held a press conference on national TV. A spokesperson for the regulator said that attackers had carried out a successful cyberattack on the correspondent account of one of the banks.

The ARM KBR (Bank of Russia Automated Workstation Client) system allows banks to exchange messages with the Central Bank of the Standoff. The cybercriminals substituted the beneficiary details in payment orders for transferring funds from STF Bank to the Central Bank of the Standoff. As a result, 6 billion rubles ended up in the attackers' accounts.

Withdrawal of funds from bank accounts through ARM KBR

At least half a million legal and financial documents were stolen from STF Bank and leaked on the internet. The documents contain confidential data pertaining to the bank's corporate customers, including credit reports, account statements, receipts, tax records, and transaction reports. A surge in fraud is expected in the wake of the data leak, and the financial and legal repercussions of the attack may cause the bank to collapse.

Theft of contracting party data

Hackers stole terabytes of customer data from STF Bank, including names, dates of birth, and passport and bank card details. This will turn into a financial and reputational catastrophe for STF Bank, as an investigation uncovered that the attack was made possible by major security flaws resulting from the bank's negligent approach to security.

Leak of confidential information

All offices of STF Bank have been closed for two days now due to a ransomware attack. The bank management was hoping to settle the problem privately. However, sources report significant damage: the ransomware encrypted most of the internal servers and employees' workstations.