Stolen Data is Creating Profitable Businesses

It probably is not surprising that publicly disclosed data breaches have increased in 2015. In fact, the Internet Organized Crime Threat Assessment (IOCTA) report confirms this and also reported that spin off crimes are resulting from these leading to extortion, fraud, and identity theft to name a few.

While cybercrime is on the rise, it is no longer subtle and behind the scenes. It has become a business with organized crime taking it under its wing and using it in ways not unlike the organized crime of the days of Al Capone, Bugsy Siegel, and Whitey Bulger. This time, however, its malware, fraud, and identity theft that takes center stage instead of bootlegging, gambling, and racketeering.

At the center of all of that is malware.  While there seems to be a decline in the well-known banking Trojans such as Zeus and Citadel, it has only become new and improved with Dridex and Dyre, Kronos, and Shifu. These are all designed to more stealthily take your money. In addition, there is a rise Remote Access Trojans (RAT) which use user-requested programs (games, apps, attachments in email) to create backdoor administrator access to systems. 

E-commerce is creating a new way to commit payment fraud for cybercriminals. Fraudulent payment card crimes using a copy of a card have decreased over the years. However data breaches into merchant systems has allowed card-not-present crime to increase as criminals use the data gained in those to continue committing payment fraud. 

Phishing, spear-phishing, and vishing remain at the top of the list of ways cybercriminals get malware disseminated. Developing countries are a new and untapped market for those wanted to steal and the tried and true methods of the various phishing are still the way they succeed. All of these are based off social engineering.

People are still the number one vulnerability for thwarting security measures. Social engineering attacks have allowed growth in internet crimes in the developing world and two-thirds of the cyber espionage crimes over the past two years used spear-phishing. This is an attack that uses very specific information about the target to gain access to confidential information. Often times the victims are those in specific organizations such as financial, military, or other government organizations or those who have access to information related to those organizations.

What can the average Joe do?

• Watch payment card charges and report any suspicious activity to the card-issuing organization
• Monitor credit reports annually and report anything that doesn’t belong to the credit bureaus
• Use unique login credentials for each online account
• Create secure and complex passwords and phrases and change them at least quarterly
• Don’t open attachments or click links in email messages unless you are 100% certain they are safe
• Keep computers and all internet-connected devices including smart TVs and game systems updated with the latest patches
• Install and update anti-malware software on all devices used on the internet

Fortunately, law enforcement activities have had some success over the years. The FBI along with several multinational organizations have managed to put at least a temporary kibosh on some of the biggest malware threats, such as GameOver Zeus and CryptoLocker. While these efforts do put a dent in the cybercrime activities, it also pushes the Darknet further into the abyss and encourages more use of anonymization techniques such as using the Tor network and other means to cover their tracks.

If everyone takes steps to protect themselves, it may help keep the new age crime bosses from becoming the next Lucky Lucianos.