The criminals detected by Kaspersky infected bank employees’ computers with Carbanak malware, which then spread to internal networks and enabled video surveillance of staff. That let fraudsters mimic employee activity to transfer and steal money, according to Kaspersky, which said it has been working with Interpol, Europol and other authorities to uncover the plot.

Paul Bresson, a spokesman for the U.S. Federal Bureau of Investigation in Washington, declined to comment on the report.

Cash Dispensers

The Carbanak gang also used access to banks’ networks to seize control of ATMs and order them to dispense cash at certain times to henchmen, Kaspersky said. In some cases the gang inflated the balance of certain accounts and pocketed the extra funds without arousing immediate suspicion, according to the report.

Kaspersky was alerted to the hacking of cash dispensers when the security service of an Eastern European bank showed a video of its ATM dispensing cash to a thief “who wasn’t pushing any button and didn’t even have a banking card,” said Sergey Lozhkin, a senior security researcher at the company, said by phone from Cancun, Mexico.

British Police

The antivirus company at first thought the ATM was infected, but then found that hackers controlled it using the bank’s internal network. Several other global and regional banks addressed Kaspersky Lab on the matter, which helped it to unearth the entire criminal scheme, according to Lozhkin.

Kaspersky won’t disclose the identity of financial institutions hurt by the attack because of a confidentiality agreement, Lozhkin said.

The main conclusion is that large banks should know they are now targets for hackers, and should tighten their information-security policies, update software and increase antivirus protection, Lozhkin said.

“Cybercriminals have got the infection-to-cash cycle down to a fine art, proving crime does pay when the victim’s perimeter can be bypassed and systems manipulated at will,” said Mark Bower, vice president of product management at Voltage Security Inc., a Cupertino, California-based security services company.

‘Unrelenting Wave’

Details of the Carbanak gang come as companies are switching focus from keeping hackers out to minimizing the effect of attacks, the most sophisticated of which are increasingly seen as inevitable.

British police made arrests last year after more than 50 cash machines in the country were infected with malware that allowed crooks to steal 1.6 million pounds ($2.5 million). Online theft from accounts of Japanese savers increased to a total $16 million in the first six months of 2014. And in 2013, eight New Yorkers were charged with stealing $45 million from banks based in the United Arab Emirates and Oman by electronically stealing card data and eliminating withdrawal limits.

U.S. President Barack Obama convened a national summit on Friday to encourage cooperation between federal and private security specialists to combat hackers and data breaches. The event included executives and security officials from companies such as Microsoft Corp., Google Inc., Yahoo! Inc. and Facebook Inc.

“The level of collaboration between public and private sectors has to be at a much deeper level to put even a slight dent in this unrelenting wave of successful cyberattacks,” said Igor Baikalov, chief scientist at Securonix Inc., a Los Angeles-based provider of threat-detection services.

--With assistance from Chris Strohm and Jeff Kearns in Washington.

Copyright 2018 Bloomberg. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.