| | July - 2019ENTERPRISE SECURITY8ybercriminals, both organized criminal groups and Nation State Advanced Persistent Threat actor groups have been raising the stakeswithbanking Trojans. This malware primarily aims to steal the banking credentials of an organization or individual, usually moving silently in the background, waiting until victims go to access their personal or corporate financial accounts. At that point, credentials are captured through a variety of means and ultimately funds are drained, paychecks are diverted, fraudulent transactions occur, etc.In recent months, however, banking Trojan variants such as emotet, Trickbot, ICE-ID, Qakbot, and others have been crippling companies, schools and government networks around the world. The newest strains don't stop at bank-related fraud; somejoin with other malware as secondary and tertiary payload drops into infected networks to saturate victims with unauthorized remote access looking for additional information to steal and can severely disrupt business. Some infected victims become part of a larger botnet and in recent months, Kroll has observed actor groups maturing their tactics and moving to deploy ransomware post network saturation as both a means to cover their tracks and to further monetize their intrusion through ransomware payments.Organizations should be prepared with a diversified defense that blends "back to the basics" security with advanced threat monitoring and response capabilities. Employee education and awareness still key for defenseFor the most part, banking Trojans are unwittingly and unknowingly welcomed into networks by users at all levels of the organization. Many of the strategies used by fraudsters are not new and include:· Social engineering attacks, including phishing (email), vishing (voicemail) and smishing (mobile messaging), where victims most often click on infected links· Email attachments that contain macro viruses (i.e., maldocs)· Compromised Internet ad campaigns· "Drive-by" attacks: users visit a website infected by malware that in turn infects users' computersWhile many organizations are getting better at educating employees about social engineering attacks, other enterprise priorities ­ such as delivering responsive client service ­ can work against caution. For example, Kroll recently worked an investigation where a supervisor at a financial services company received an email request from a business associate at another financial institution. Despite recognizing the request was somewhat out of character, the supervisor--who routinely works with financial information--opened the attachment expecting an invoice. The document was in fact a maliciously crafted document which triggered a chain of events on the endpoint that were invisible to the user.As fraudsters become more sophisticated in crafting decoy messages, we recommend that organizations conduct more frequent training with staff at all levels, including executive leadership and boards of directors. Issuing regular Evolving world of Cybercrime: Banking Trojans and Ransomware DeploymentBy Devon Ackerman, Managing Director, Kroll Cyber RiskDevon AckermanIn My OpinionC
< Page 7 | Page 9 >