Cybercrime’s Epic Year

Contributor: Limor Kessom, IBM Security

Looking back at cybercrime in 2015 leaves little doubt that the year was nothing short of epic. The IBM/Ponemon Institute report 2015 Cost of Data Breach Study put the average total cost of a data breach at $3.79 million, an increase from the 2014 figure of $3.52 million.

In 2014, IBM Security anticipated the following trends for 2015:

Cybercrime breaking borders
Rising card-not-present (CNP) fraud
An escalation in the sophistication of mobile threats
Wide use of anonymity networks and stronger encryption
Burgeoning fraud methods for new payment schemes
Biometrics becoming a target

These predictions not only materialized, but actually exceeded the forecast. We expect the situation to become very intense in 2016 as more organized crime groups step up their presence in the digital realms. The mob, digital edition It is safe to say that we have never before seen the magnitude and sophistication of online crime as we did in 2015—a trend that’s already proving to persist into 2016. This prompts us to ask: What is the one most significant factor contributing to cybercrime’s escalation in scale and sophistication?

The answer lies in the increasing involvement and investment of full-blown criminal organizations in digital crime, and the resulting increase in numbers of well-orchestrated operations such as Carbanak. (“Carbanak: How Would You Have Stopped a $1 Billion APT Attack?” Security Intelligence, 23 February 2015)

The mob, digital edition

These gangs operate much like businesses, leveraging connections, employing collaboration and deploying teams for different tasks. Organized cybercrime is no longer made up primarily of small factions, and the days of lone hackers are all but gone. Instead, nowadays we fight against motivated organizations that—like legitimate businesses—are divided into teams, employ highly experienced developers with deep knowledge, leverage connections and encourage collaboration. Also like businesses, these gangs are highly organized, managed by crime lords who fund the operation and deploy various types of troops to achieve their eventual success.

Given this highly organized structure, perhaps the level of sophistication shown in malicious code such as Shifu,( “Shifu: ‘Masterful’ New Banking Trojan Is Attacking 14 Japanese Banks,” Security Intelligence, 31 August 2015) for example, should be no surprise. After all, the security and risk management site CSO reports that the average age of a cybercriminal is an experienced 35 years, and 80 percent of blackhat hackers are affiliated with organized crime and work as part of groups. (Taylor Armerding, “Cybercrime: Much more organized,” CSO Online, 23 June 2015) In fact, the same article notes, according to some experts “disorganized cybercrime” no longer exists.

The inner workings of gang-controlled malware exposes the organization and order behind the scenes, with professional programming techniques built into the malware, as well as professional development processes such as change tracking, versioning and application security.

POS deserves a mention

Information security headlines throughout 2015 also often remarked upon the unprecedented modularity of malware that had been less complex before—for example, point-of-sale (POS) malware such as ModPOS, or the JavaScript-based ransomware known as Ransom32 that can be deployed across different platforms. It is no coincidence that malicious code is seeing such a hike in sophistication, however. The promise of a hefty return on investment (ROI) draws organized crime to fund them and lures brilliant minds into the dark world of digital crime.

Shifting from consumers to big business

If there was one trend that stretched across all cybercrime domains in 2015, it was the scaling up of the magnitude and breadth of each malware-related transaction and operation. Every type of malware cyber-attack last year—from ransomware to banking Trojans, and from cyber-extortion to targeted attacks—scaled up its per-hit quota. Cybercriminals accomplished this goal by shifting some of their focus from attacking individual consumers, to targeting businesses.

As they shifted to focus on larger rewards, malware groups such as Dyre updated their malicious code with new modules such as “pn32,” which is designed to harvest administrative user credentials for enterprise email servers. We suspect that this sort of development was not only part of the process of fraudulent transactions from the corporate account, but also was further designed to enable the gang behind Dyre to target victims with Business Email Compromised (BEC) fraud. (“Business E-Mail Compromise: An Emerging Global Threat,” Federal Bureau of Investigation, 28 August 2015)

BEC fraud occurs when blackhat hackers compromise business email or enterprise email servers, then use social engineering to send a credible-looking email to the company’s accountant or treasurer with instructions to promptly make a large wire transfer. The emails typically purport to come from the CEO or CFO, and sums involved can typically reach $1 million at a time. In the context of scaling up the magnitude of attacks by targeting businesses, two striking cases demonstrate just how brazen and well-organized cybercrime has become—first the Dyre Wolf attacks, which use the Dyre Trojan against corporate banking accounts, and second the Evil Corp. attack on Penneco Oil, which used the Trojan known as Dridex.

In each of these cases, malware operators combined the characteristics of a targeted attack with the abilities of Trojan-enabled online banking fraud. Subsequent conversations IBM researchers had with affected victim organizations made it clear that the cybercrime groups that launched these attacks prepared an elaborate social engineering scheme before the actual attempt.

Preparations included moving money from other, smaller accounts the company held to the account owned by the same company the cybercriminals planned to rob; establishing special toll-free numbers for the victims to call; assigning an eloquent, professional sounding “banker” with prior information about the account to speak to the victims; and setting up the type of mule accounts that could receive a large amount of money in one transaction without raising suspicion.

While every year in the past two decades showed an escalation in cybercrime, 2015 was particularly eventful. Attacks such as Carbanak, Dyre Wolf and Dridex on corporate bank accounts made 2015 stand out as some of the grandest digital crimes we have ever seen.

On to 2016…

As we kick off 2016, we expect the intensity of threats and increasing sophistication of malware to continue trending upward.

Flagship Solution Group along with IBM Security research teams can help you keep up to date on the trends that matter to your organization—as soon as they emerge. Schedule a consultation.

If you liked this blog, you might also like: Smarter Security, Smarter Everything

Stay connected online:

Facebook | Twitter | LinkedIn | Instagram

The mob, digital edition

POS deserves a mention

Shifting from consumers to big business

On to 2016…

Blog Archives

Categories

Recent Posts

Follow @Flagshipsg1 on Twitter

RESOURCES

PRODUCT EXPERTISE

RESOURCES

PRODUCT EXPERTISE