Retail News CRM

Tag: Cybercriminals

  • Cybercriminals building an “army of things”: Fortinet

    Cybercriminals building an “army of things”: Fortinet

    Cybercriminals are building an  “army of things” that is powered by the digital underground, according to Fortinet.

    The security company’s latest Global Threat Landscape Report covering Q4 2016 reveals the methods and strategies cybercriminals employed during the quarter in detail.

    The report confirms that Internet of Things (IoT) devices are sought-after commodities for cybercriminals around the world. Adversaries are building their own armies of “things” and the ability to cheaply replicate attacks at incredible speed and scale is a core pillar of the modern cybercrime ecosystem.

    In Q4 2016, the industry was reeling from the Yahoo data breach and Dyn DDoS attack. Before the quarter was halfway done, the records set by both events were not only broken, but doubled.

    Meanwhile, IoT devices compromised by the Mirai botnet initiated multiple record-setting DDoS attacks. The release of Mirai’s source code increased botnet activity by 25 times within a week, with activity increasing by 125 times by year’s end.

    IoT-related exploit activity for several device categories showed scans for vulnerable home routers and printers topped the list, but DVRs/NVRs briefly eclipsed routers as the thing of choice with a massive jump spanning 6+ orders of magnitude.

    Unlike other parts of the world, vulnerabilities in home routers formed the majority of IoT-based attacks in Asia Pacific. Many home routers are manufactured and deployed in this region, resulting in attacks on them being centered here.

    Mobile malware become a larger problem than before. Though it accounted for only 1.7% of the total malware volume, one in five organizations reporting malware encountered a mobile variant, nearly all was on Android.

    Substantial regional differences were found in mobile malware attacks, with 36% coming from African organizations, 23% from Asia, 16% from North America, compared to only 8% in Europe. This data has implications for the trusted devices on corporate networks today.

    Lees ook:

  • Cybercriminals use insiders to attack telcos

    Cybercriminals use insiders to attack telcos

    Cybercriminals are using insiders to gain access to telecommunications networks and subscriber data, recruiting disaffected employees through underground channels or blackmailing staff using compromising information gathered from open sources.

    This is among the findings of a Kaspersky Lab intelligence report into security threats facing the telecommunications industry.

    Telecommunications providers are a top target for cyber-attacks. They operate and manage the world’s networks, voice and data transmissions and store vast amounts of sensitive data. This makes them highly attractive to cybercriminals in search of financial gain, as well as nation-state sponsored actors launching targeted attacks, and even competitors.

    To achieve their goals, cybercriminals often use insiders as part of their malicious ‘toolset’ to help them breach the perimeter of a telecommunications company and perpetrate their crimes.

    New research by Kaspersky Lab and B2B International reveals that 28% of all cyber-attacks and 38% of targeted attacks now involve malicious activity by insiders. The intelligence report examines popular ways of involving insiders in telecoms-related criminal schemes and gives examples of the things insiders are used for.

    Compromising employees

    According to the Kaspersky Lab researchers, attackers engage or entrap telecoms employees in the following ways:

    • Using publicly available or previously stolen data sources to find compromising information on employees of the company who they intend to hack. They then blackmail targeted individuals – forcing them to hand over their corporate credentials, provide information on internal systems or distribute spear-phishing attacks on their behalf.
    • Recruiting willing insiders through underground message boards or through the services of “black recruiters”. These insiders are paid for their services and can also be asked to identify co-workers who could be engaged through blackmail.

    The blackmailing approach has grown in popularity following online data breaches such as the Ashley Madison leak, as these provide attackers with material they can use to threaten or embarrass individuals. In fact, data-leak related extortion has now become so widespread that the FBI issued a Public Service Announcement on June 1, warning consumers of the risk and its potential impact.

    The insiders most in demand

    According to the Kaspersky Lab researchers, if an attack on a cellular service provider is planned, criminals will seek out employees who can provide fast track access to subscriber and company data or SIM card duplication/illegal reissuing. If the target is an internet service provider, the attackers will try to identify those who can enable network mapping and man-in-the-middle attacks.

    However, insider threats can take all forms. The Kaspersky Lab researchers noted two non-typical examples, one of which involved a rogue telecoms employee leaking 70 million prison inmate calls, many of which breached client-attorney privilege. In another example, an SMS center support engineer was spotted on a popular DarkNet forum advertising their ability to intercept messages containing OTP (One-Time Passwords) for the two-step authentication required to login to customer accounts at a popular fintech company.

    “The human factor is often the weakest link in corporate IT security,” Kaspersky Lab security expert Denis Gorchakov said.

    “Technology alone is rarely enough to completely protect the organization in world where attackers don’t hesitate to exploit insider vulnerability. Companies can start by looking at themselves the way an attacker would. If vacancies carrying your company name or some of your data start appearing on underground message boards, then somebody somewhere has you in their sights. And the sooner you know about it, the better you can prepare.”

    Lees ook:

  • Singapore Targeted By Cybercriminals with Banking Trojans

    Singapore Targeted By Cybercriminals with Banking Trojans

    IT Threat Evolution report of Kaspersky for the third quarter of 2015 reveals that Singapore suffered maximum attacks from banking Trojans during second quarter of 2015 with 496 individuals reporting attacks.

    It is not a coincidence that Singapore is one of the ASEAN countries with the highest rates of digital banking.

    According to an A.T.Kearney and EFMA global retail banking study, Singapore has the highest inclination for digital banking in the global arena.

    Computerweekly.com published news during the last week of October, 2015, quoting Jimmy Fong, Channel Sales Director Southeast Asia, at Kaspersky Lab, as saying “The nation was also placed among the top three in banking capabilities which included technological developments, a strong financial environment and digital infrastructure”.

    Computerweekly.com published news during last week of October 2015 quoting Michael Yeo, Senior Market Analyst at market research firm IDC, as saying “Singapore is a magnet for such banking Trojans because of combination of the country’s general wealth levels and growing use of associated services like e-commerce and mobile commerce”.

    Yeo added that Singapore is one of the nations which use maximum online banking services with 74% of the population using it.

    The statistics also reveal that patrons in Austria were targeted by banking Trojans excessively than in any other region: Around 5% of all Kaspersky Lab patrons in Austria faced this malware during the quarter. Turkey (3%) was placed at number three.

    Geographically most of countries in the top ten lists of information-stealing malware attacks during Q3 have a large number of users of online banking. Trojan-Downloader.Win32.Update was the most rampant malware used to target users of online banking, as it is being employed in 63.1% of attempted assaults to embezzle payment credentials of users.

    In third quarter, the Kaspersky Lab Global Research and Analysis Team (GReAT) identified a number of advanced cyber-espionage operations. Amongst others, comprising of the infamous Turla gang that employs satellite communications to administer traffic of its command-and-control server for subsequent operations known as Darkhotel APT, which penetrates Wi-Fi networks of hotel to put backdoors on target systems and fresh activity of the Blue Termite APT focusing on embezzling information from establishments in Japan.

    Lees ook:

    Lees ook:

    Lees ook: