Pierluigi Paganini
February 19, 2019
Group-IB, an international company that specializes in preventing
The total number of Group-IB incident responses has more than doubled compared to 2017. Topping the list of the main threats faced by the compromised companies are targeted attacks, competitive espionage, ransomware attacks, and cryptomining. The main conclusion of Group-IB’s digital forensic lab is that the vast majority of Russian companies affected by hacker attacks last year did not have incident response plan and therefore were not ready to quickly mobilize its information security departments, the personnel of which are in turn often unable to resist the attackers. Group-IB experts highlight the high probability of repeated incidents in such companies.
An unfortunate fact: banks aren’t ready to defend against threat actors
According to the incident response study, banks were the targets of about 70% of hacker activity last year.Hackers still use the same cashing-out schemes as they used to: the stolen funds are withdrawn using payment cards pre-opened in a targeted bank, dummy law firm accounts, payment systems, ATMs and SIM cards. At the same time, the volume of cashing out in Russia has increased several times: a cash-out of 3 million USD took on average about 25-30 hours 3 years ago, but in 2018 there were incidents in which the same amount was successfully cashed out in less than 15 minutes at a time in different Russian cities.
Analysis of data obtained by Group-IB during incident responses revealed that 74 percent of Russian banks attacked in 2018 were not ready for cyberattacks. At the same time, more than 60 percent of them turned out to be unable to centrally manage their networks (especially in the case of geographically distributed infrastructure). In more than 80 percent of financial organizations affected by the hacking activity, no sufficient level of event logging over a longer period (more than a month) was observed. Insufficient cooperation between internal departments is an additional factor that plays into the hands of attackers: more than 65 percent of the financial organizations, where the Group-IB IR team worked, spent more than 4 hours for coordination of work between departments. Meanwhile, an average of 12 hours were spent on meetings, granting access and routine work as part of one incident response.
From Russia with love. How cyber attacks in Russia impact banks in Europe?
Group-IB research revealed not only
“A bank with compromised infrastructure can not only lose money, but also become a threat to other players in the financial market,” comments Valery Baulin, Head of Group-IB Digital Forensics Lab. “A financially motivated hacker group always seeks to maximize the gains: by taking control over a bank’s systems it aims not only to withdraw money from a compromised bank but also to infect as many new victims as possible. For this purpose, hackers use “a domino effect”: they send out malicious phishing emails from the compromised infrastructure using the database of the bank’s partner companies. This attack vector dangerous, first of all, because these emails are sent from a legitimate bank, and the sender is not faked, which increases the probability of opening the malicious attachment. Thus, a chain reaction is started, and this can lead to multiple infections of financial institutions. In 2018, we detected the use of this vector both in Russia and Eastern Europe.”
Hidden agenda
According to Group-IB, at least 17 percent of companies, where incident response was carried out, have been targeted through previously unaddressed vulnerabilities within a year after the last infection. In the vast majority of cases, this was a consequence of a failure to comply with recommendations, as well as negligence of bank employees. In addition, during 2018, Group-IB experts detected active infections in 29 percent of financial sector organizations, unknown to the internal information security service. In 52 percent of cases, traces of past attacks were found.
In 2018, the Group-IB Incident Response team recorded cases in which cyberattacks were organized in order to create a negative image around a bank, leading to reputational damage and in some cases bank’s departure from the market. “A sharply negative image is created around the bank: estimates of potential damage may appear, along with negative information about bank’s level of protection. The media throw in the possible revocation of its banking license. There is an outflow of clients and partners, and the bank faces insufficient capitalization. Using cyberattack as a tool to damage bank’s reputation and even to squeeze a competitor out of the market is another dangerous vector, which can become even more popular, as the level of cyber security of smaller banks is still extremely low,” – says Valery Baulin.
About Group-IB Incident Response Team
Group-IB has been conducting cyber security Incident Response since 2003. Its main competencies and expertise in this area are accumulated in the largest forensic laboratory in Eastern Europe which for the past 16 years conducted many successful responses in various organizations around the world. The goal of an incident response is to identify all infected hosts, compromised data and tools used by the attackers in order to establish the IoC (Indicators of Compromise). In addition, Group-IB specialists develop recommendations for the victim organization until the incident is completely contained and resolved and the effects of the attack are eliminated. Group-IB Lab-based services have also been deployed to prepare for effective response to information security incidents (Pre-IR Assessment), as well as to detect upcoming attacks and traces of compromise of individual network nodes (Compromise Assessment). More information can be found here.
About the author Group-IB:
Group-IB is a leading provider of solutions aimed at detection and prevention of
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(
[adrotate banner=”5″]
[adrotate banner=”13″]
