And the industry sector most vulnerable to cyber attacks goes to... Finance

guest · Aug 7, 2020

Pepperstone data leak: Kudos for handling it correctly!
Pepperstone does the right thing and holds its hand up to a data leak, reassuring customers
August 7, 2020
https://financefeeds.com/pepperstone-data-leak-kudos-handling-correctly/

Putting your hand up and admitting important matters in a transparent fashion is the number one tenet of running a business properly.
On this basis, absolute kudos must go to Australian retail FX and CFD company Pepperstone this week, notably around the way in which the company dealt with a data leak that temporarily plagued its systems.
Click to expand...

As client and transaction data privacy and security is so critical in financial services, most companies hide any mishaps until it is too late, resulting in mass complaints, uncertainty and eventually a poor reputation, but in the case of Pepperstone, clients and partners should hold the company in high esteem for its self-prompted reaction.

In a notice to customers yesterday at 13.07 UK time, Pepperstone explained that it had been the subject of a data leak, and detailed exactly what had happened, reassuring clients that absolutely no potential harm could come to their trading account or funds held with the company.
The company referred to it as a “data security incident which impacted people who had registered for a Pepperstone live or demo trading account.”

Pepperstone confirmed categorically that trading accounts, passwords and bank account information had NOT been compromised and are safe.
This is a very courageous and transparent move from Pepperstone, and is one which will instil confidence in its client base and Pepperstone should be commended for it.
Click to expand...

Clients of Data Breach as Fraudsters Impersonate Broker (July 27, 2020)

Fraudsters are reaching out to Pepperstone clients, asking them to transfer their client funds
Click to expand...

guest · Sep 12, 2020

Phishing attack targeted top financial pro at large company
September 11, 2020
https://www.scmagazine.com/home/sec...-targeted-top-financial-pro-at-large-company/

Attackers using a novel credential phishing attack that leverages Active Directory to verify a victim’s password and gain access to an Office 365 account targeted a top financial person in a division of a large American corporation.

Once inside a victim’s account, bad actors could access sensitive financial documents, emails, calendar items and contact lists, according to an Armorblox blog post that detailed the attack.

“This was a targeted attack, specifically financial in nature,” Arun said. “While enabling MFA would have made the attack harder, the attackers could still have beat MFA by intercepting an OTP or authentication code and completing the transaction.”
When the victim clicked on the email, the attachment launched a browser that displayed a lookalike Office 365 page. If the wrong words were typed in, the attacker would have victim try again until he entered the right password.
Click to expand...

Other significant aspects of this attack: By sending the email from Amazon’s Simple Email Service, the attackers could bypass DKIM and SPF checks so the email did not wind up in the victim’s spam email inbox.

In addition, once they discovered that the domain used in the victim’s public address email (acmecorp.com) was different from the domain name (acmecompany.com) used for the victim’s Active Directory login, they could leverage Office 365 APIs to authenticate in real-time.

“In this scenario, attackers can ascertain real-time Active Directory authentication instead of manually checking every submitted credential,” said Kacey Clark, a threat researcher at Digital Shadows.
The real- time check against AD is a new technique that attackers have added to their arsenal, said Vinay Pidathala, director of security research at Menlo Security. “
Click to expand...

Armorblox: Blox Tales #15: Credential Phishing Attack Performs Real-Time Active Directory (AD) Authentication

We’re breaking from tradition in this Blox Tale and taking a deeper dive into an advanced credential phishing attack with the Armorblox Threat Research Team. They will pry their eyes away from 6 computer screens each (we counted) to walk us through an Office 365 credential phishing attack that uses real-time validation against the target organization’s active directory. Take it away, team!
Click to expand...

guest · Sep 14, 2020

FBI says credential stuffing attacks are behind some recent bank hacks
The FBI is raising a sign of alarm about the rising number of credential stuffing attacks targeting financial institutions
September 14, 2020
https://www.zdnet.com/article/fbi-s...ng-attacks-are-behind-some-recent-bank-hacks/

The FBI has sent a private security alert to the US financial sector last week warning organizations about the increasing number of credential stuffing attacks that have targeted their networks and have led to breaches and considerable financial losses.

At first, they targeted online gaming and food-ordering accounts, but as the tactic proved to be more and more successful, more professional hacking groups switched to targeting accounts at online banking services and cryptocurrency exchanges, aiming to steal financial assets.
CREDENTIAL STUFFING IS NOW A MAJOR PROBLEM FOR BANKS
According to an FBI security advisory obtained by ZDNet today, credential stuffing attacks have increased in recent years and have now become a major problem for financial organizations.

"Since 2017, the FBI has received numerous reports on credential stuffing attacks against US financial institutions, collectively detailing nearly 50,000 account compromises," the FBI said.
"The victims included banks, financial services providers, insurance companies, and investment firms."
Click to expand...

The FBI security advisory, which you can read in full here, warns financial institutions to take protective measures about the ever-growing threat of credential stuffing.
Click to expand...

guest · Sep 17, 2020

The Financial Industry Needs to Get Real About Cybersecurity
A sector constantly under attack
September 17, 2020
https://www.missioncriticalmagazine...ndustry-needs-to-get-real-about-cybersecurity

Within the global sector of cybersecurity, the two major areas that are constantly under attack are finance and government.

Financial organizations that hold consumer data, in particular those that provide financial services to retail and commercial customers like banks, investment companies, real estate firms, retail banking, and insurance companies, are an obvious target for the simple fact that this is where the money is.
At the end of the day, unless an attack is of a personal nature, in which the reputation of an individual or business is targeted, monetary assets are always the goal.
Click to expand...

If there is a vulnerability, it will be the first target. In response, banks and financial institutions require tailored and sophisticated security to support their systems and people and to defend against an onslaught of complex and aggressive cyberattacks.

Cyberthreats will continue to grow into 2021. That much is clear.
Effective security comes down to three key elements: processes, people, and technology. In times like these, security measures are more crucial than ever — especially for those within finance.
Click to expand...

guest · Nov 5, 2020

Two-Thirds of Financial Services Firms Suffered Cyber-Attack in the Past Year
November 5, 2020
https://www.infosecurity-magazine.com/news/two-thirds-financial-services/

Almost two-thirds (65%) of large financial services companies have suffered a cyber-attack in the past year, while 45% have experienced a rise in attack attempts since the start of the COVID-19 pandemic.
This is according to new research from HelpSystems, which surveyed 250 CISOs and CIOs in global financial services firms about the impact of the pandemic on their cybersecurity.

It highlighted that these organizations are taking cybersecurity increasingly seriously, with 92% stating that they have increased investment in this area over the past 12 months, with 26% doing so by a significant amount. The main targets of this investment have included secure file transfer (64%), protecting the remote workforce (63%) and cloud/office365 (56%).
Click to expand...

Kate Bolseth, CEO, HelpSystems, commented: “It’s a highly challenging cybersecurity landscape for the financial services sector, with many CISOs focused in battling day-to-day threats alongside trying to achieve broader strategic objectives.

“Technology is a key part of cybersecurity of course, and no organization will ever be secure without the right security solutions to protect the organization here and now. However, of equal importance, especially for longer-term strategic goals, is ensuring the right processes are in place and educating and training employees.”
Click to expand...

guest · Nov 18, 2020

Financial system not keeping up with cyberthreats, new report says
November 18, 2020
https://www.cyberscoop.com/financial-cybersecurity-carnegie-endowment-report/

Four years after the biggest bank hack ever, the global financial system remains vulnerable to cyberattacks that could cause severe disruptions, according to a report Wednesday that draws advice from government officials, the financial industry and other experts.

“Our big concern is that if you look at what’s happened during the pandemic, but even before with the escalating threat that’s targeting the financial system from the Bangladesh incident to the Chile outage back in September, we’re clearly not keeping up with the threat and how quickly it’s evolving,” said Tim Maurer, director of Carnegie’s Cyber Policy Initiative.
“The government and industry need to organize themselves better if they want to have a chance of keeping this at bay.”
Click to expand...

Core principles of the strategy include the need for financial systems to withstand attacks, for nations to develop international standards on what constitutes inappropriate cyberspace behavior, for countries to work together to deter disruptive attacks and for the cyber workforce to be strengthened.
Nations should forgo a broader new treaty on cybercrime in favor of more direct cooperation with one another, the strategy suggests.

The think tank will hold a discussion of the strategy Wednesday morning.
Click to expand...

An International Strategy to Better Protect the Global Financial System from Cyber Threats
https://carnegieendowment.org/2020/11/18/international-strategy-to-better-protect-global-financial-system-from-cyber-threats-event-7469

The global financial system is going through an unprecedented digital transformation, which is being accelerated by the coronavirus pandemic. Malicious actors are taking advantage of this transformation and pose a growing threat to financial stability and consumers worldwide.

On November 18, the Carnegie Endowment, in collaboration with the World Economic Forum, will release a first-of-its-kind, comprehensive blueprint to better protect the global financial system against cyber threats. Join us for a discussion with leading voices on this report's crucial recommendations.
Click to expand...

guest · Dec 31, 2020

Financial services industry hit with tens of millions of attacks per day
December 31, 2020
https://www.scmagazine.com/home/sec...hit-with-tens-of-millions-of-attacks-per-day/

In an update of its State of the Internet report, Akamai found that in the past year the financial services industry was hit with millions or tens of millions of attacks per day.

In September 2020 alone, Akamai tracked 33 million web application attacks against the financial services industry. The report found that the bad threat actors primarily used common attack paths, such as SQL injection, local file inclusion and cross-site scripting.
The report Akamai released Wednesday summarizes its main reports from October 2019 to October 2020.
Click to expand...

guest · Jul 22, 2021

Financial services accounting for nearly 40% of all phishing URLs
July 22, 2021
https://www.helpnetsecurity.com/2021/07/22/financial-services-phishing/

Vade released its Phishers’ Favorites report for H1 2021, which revealed that there has been a major jump in phishing attacks since the start of the year with a 281 percent spike in May and another 284 percent increase in June, for a total of 4.2 billion phishing emails detected by Vade for June alone.

For this 6-month window researchers identified Crédit Agricole as the most impersonated brand, with 17,555 unique phishing URLs, followed by Facebook, with 17,338, and Microsoft, with 12,777.
Click to expand...

Crédit Agricole is one of eight financial institutions on the top 25 list
H1 marks the first time Crédit Agricole has found itself in the top spot, but its position comes as no surprise in a year dominated by economic headlines.

However, in Q2 2021, Crédit Agricole phishing URLs increased 296 percent, while La Banque Postale URLs increased 831 percent, pushing them up 18 spots to #5 on the list. Other financial services brands in the top 25 include PayPal, Chase, and Wells Fargo. In total financial institutions made up for 36 percent of all URLs detected.
Click to expand...

Phishers’ Favorites Top 25 H1 2021, Worldwide Edition

guest · Aug 11, 2021

Financial Services Brace Themselves for Increase in Email-Borne Cyberattacks
August 11, 2021
https://www.infosecurity-magazine.com/news/financial-services-email-borne/

Financial Services (FS) companies expect to see an influx of email-borne attacks during 2021 due to increased volumes in email (81%), according to research.

Accordion to a report from cybersecurity firm Mimecast, 62% of FS organizations believe that it’s likely, extremely likely or inevitable that their company will experience negative business impact from attacks originating from emails. The research also found that 60% of its respondents saw increases in phishing with malicious links or attachments over the past year.
Click to expand...

Johan Dreyer, cybersecurity expert at Mimecast, comments, “The use of digital and mobile in the financial services industry is only set to increase further, so we are definitely going to witness an increase in the rate and sophistication of cyberattacks on finance firms and their customers.

“As email remains the most common threat vector and its volume and sophistication of attacks is expected to increase, financial firms need to layer multiple security technologies to protect their email systems,” he continues. “This will ensure any active threat can be dealt with as quickly and efficiently as possible. Such multi-layered defences complement and backstop one another—if a given attack sidesteps one defence, there are others in place that can stop the threat.”
Click to expand...

Mimecast: Email Security In Finance: Money, Investments & PII Make For A Hacker’s Dream Target

Financial services – including companies, investment firms, and fintech – have recently seen a major rise in digital transactions, mobile banking and overall email volume, driving them to add more scalable cloud-based systems to their core legacy systems, especially for email. As a result, the potential for cybersecurity breaches has risen. Every new email might be a phishing or malware mule, or a tunnel for ransomware.

Download this research report to take a closer look at how financial services organizations are impacted by cyberthreats, their ability to layer additional security software, and five key takeaways for a more secure future.
Click to expand...

guest · Aug 16, 2021

FFIEC Issues Guidance on Authentication and Access to Financial Institution Services and Systems
August 16, 2021
https://www.jdsupra.com/legalnews/ffiec-issues-guidance-on-authentication-8441356/

On August 11, the Federal Financial Institutions Examination Council (FFIEC) issued guidance, titled “Authentication and Access to Financial Institution Services and Systems,” which provides financial institutions with examples of effective authentication and access risk management principles and practices for customers (both business and consumer), employees, and third parties accessing digital banking services and information systems.

The FFIEC — whose voting members include representatives from the FDIC, the NCUA, the OCC, the CFPB, the Federal Reserve Board, and the State Liaison Committee — issued the guidance as an update to prior submissions from 2005 and 2011 that provided financial institutions with risk management practices related to offering internet-based products and services.
Click to expand...

guest · Aug 20, 2021

An Overview Of FinTech Threat Landscape
Analyzing Cyber Threats Targeting the Financial Sector
August 20, 2021
https://blog.cyble.com/2021/08/20/an-overview-of-fintech-threat-landscape/

Research shows that there has been a considerable increase in digital threats targeting financial firms since the onset of the pandemic. The statistical reports released between 2020-2021 show that cyber-attacks on financial firms and services have increased by 238%. Out of these attacks, nearly 75% of the victims were banks and insurance companies.

Attackers have been widely targeting financial institutions such as banks and insurance companies, which we observed more frequently since the onset of the pandemic. Attackers benefit monetarily by misusing and selling sensitive Personally Identifiable Information (PII) such as customer details, Social Security Numbers (SSN), driver’s licenses, bank account details, and transactional records. Attackers gain access to the system by exploiting any security vulnerabilities that they can identify.
Click to expand...

Conclusion:
Based on these findings, cybercrime, in general, has seen an increase with a focus on attacks targeting financial firms. Attackers use various social engineering tools to spread malware and use multiple techniques to evade detection mechanisms.

Along with enhancing the security methods used by financial organizations, the attackers simultaneously develop malware with customized techniques, such as automatically performing the malicious activity instead of relying on the manual commands pushed from the attacker’s Command-and-Control Server.
Click to expand...

guest · Aug 21, 2021

World Bank Launches Global Cybersecurity Fund
Will Help Lower-Income Nations Enhance Their Security Efforts
August 20, 2021
https://www.databreachtoday.com/world-bank-launches-global-cybersecurity-fund-a-17341

The World Bank has launched a cybersecurity fund for low- and middle-income nations to support public sector efforts to conduct cybersecurity maturity assessments, offer technical assistance and support training and staff development.

The international financial institution, which provides a wide variety of loans and grants to governments for capital projects, launched its Cybersecurity Multi-Donor Trust Fund under its broader Digital Development Partnership program, described as a platform for digital innovation and development funding.
Click to expand...

The new cybersecurity initiative aims to accelerate digital transformation by improving governments' technical capabilities and their efforts to increase security awareness. A spokesperson for the World Bank tells Information Security Media Group that associated funds will be disbursed "using diverse implementation models" to catalyze specific cybersecurity investments. The amount of funding to be provided was not revealed.

The bank calls particular attention to security investments that improve critical infrastructure - including the energy, transportation, finance and healthcare sectors.

"These systems [designed prior to, or during the early years of the digital revolution] … are today highly vulnerable to cybersecurity attacks with possibly serious outcomes," the bank says on the fund's dedicated webpage.
Click to expand...

World Bank and Partners Announce New Global Fund for Cybersecurity

Embracing technological transformation has increased cyber risks and threats to digital infrastructure, services, and data, which rely on increasingly connected systems.

The new fund aims to better define and systematically roll out the cybersecurity development agenda, helping to ensure a more substantial reflection of cybersecurity considerations across World Bank programs and financing. The work program will support the development of global knowledge on cybersecurity solutions for low- and middle-income countries.

“Cyberattacks are becoming more complex and sophisticated across the world,” said the representatives of Japan’s Ministries of Foreign Affairs and Internal Affairs and Communication, Narichika Konno and Atsushi Umino.
“Cybersecurity must become an integral part of the digital agenda. Synergies are crucial, and the activities to be carried out should be taken up broadly through development financing programs,” said Michael Thijssen of the Task Force Cyber Policies of the Ministry of Foreign Affairs of the Netherlands.
Click to expand...

guest · Oct 1, 2021

MoneyLion locks customer accounts after credential stuffing attacks
October 1, 2021
https://www.bleepingcomputer.com/ne...r-accounts-after-credential-stuffing-attacks/

The banking and investing platform MoneyLion had to lock customer accounts that were breached in credential stuffing attacks over the summer, in June and July.

The fintech company has provided mobile banking services for borrowing, saving, and investing money to more than 8.5 million Americans since its launch in 2013.
MoneyLion's systems were not breached
"MoneyLion promptly started an investigation and determined that a very limited number of accounts were potentially impacted. Similar activity occurred again between July 13 – 16, and once again between July 27 – 30," the company said in a data breach notice.
The digital financial platform found no evidence that the credentials used in the attacks were obtained from MoneyLion's servers.
Click to expand...

In response to the attacks, MoneyLion locked the impacted customers' accounts to force them to reset their credentials and notified them of the incident.

"Additionally, as you may be aware, we also have implemented additional multi-factor authentication for all accounts," MoneyLion added.
Click to expand...

guest · Oct 13, 2021

The Fight against Financial Cyber Crime
October 11, 2021
https://www.hackread.com/the-fight-against-financial-cyber-crime/

Financial cyber crime is an act in which financial gains or profits are made through criminal activities such as identity fraud, ransomware attacks, e-mail, and Internet fraud. Attempts to steal financial accounts, credit cards, and other payment card information also comes under cyber crime.

Financial cyber crime affects companies of all sizes and sectors, as well as individuals, and can have devastating consequences. To avoid falling victim to financial cyber crime, one needs to understand how the technology responds to the decisions someone makes, says Adrian Constantin Stanila, Head of the Visma Cyber Security Incident Response Team.
Click to expand...

At the same time, it is a fact that financial institutions will always suffer from cyber attacks – sometimes because of vulnerabilities and some due to insider greed. But, the victim will remain unsuspecting customers.
The financial services industry is a lucrative target and is disproportionately affected by the rise of cyber crime.
Click to expand...

How Banks are detecting and preventing it from happening
Given the complexity of financial services, detecting and preventing fraud in the financial sector is an insurmountable challenge. Many facets of financial cyberattacks have been revealed over the years. Most banks have started their journey towards a single operating model for financial crime, fraud, and cybersecurity by integrating [PDF] their cybersecurity and fraud units.
Fraud detection is a top priority for financial service institutions
To identify bad actors, financial services institutions (FSIs) must use access to more comprehensive information and data to detect and prevent cyber crime.

Financial institutions should also consider the obligation to report any suspicion of money laundering, including successful fraud. The basis of a successful fight against fraud is the culture of the institution.
Click to expand...

guest · Nov 19, 2021

US regulators order banks to report cyberattacks within 3 days
November 19, 2021
https://www.bleepingcomputer.com/ne...r-banks-to-report-cyberattacks-within-3-days/

US federal bank regulatory agencies have approved a new rule ordering banks to notify their primary federal regulators of significant computer-security incidents within 36 hours.

Banks are only required to report major cyberattacks if they have or will likely impact their operations, the ability to deliver banking products and services, or the US financial sector's stability.
Bank service providers will also have to notify customers "as soon as possible" if a cyberattack has materially affected or will likely affect the customers for four or more hours.
Click to expand...

"Computer-security incidents can result from destructive malware or malicious software (cyberattacks), as well as non-malicious failure of hardware and software, personnel errors, and other causes," the Computer-Security Incident Notification Final Rule explains (PDF).

"Cyberattacks targeting the financial services industry have increased in frequency and severity in recent years. These cyberattacks can adversely affect banking organizations' networks, data, and systems, and ultimately their ability to resume normal operations."
Click to expand...

Compliance required by May 2022
The final rule issued by the Federal Deposit Insurance Corporation (FDIC), the Board of Governors of the Federal Reserve System (Board), and the Office of the Comptroller of the Currency (OCC) will take effect on April 1, 2022, with full compliance extended to May 1, 2022.

The new cyberattack reporting rule is designed to boost banking supervisors' awareness of emerging threats to banking orgs and the broader US financial system.
Click to expand...

guest · Jan 5, 2022

Researchers Uncover Hacker Group Behind Organized Financial-Theft Operation
January 5, 2022

Cybersecurity researchers have taken the wraps of an organized financial-theft operation undertaken by a discreet actor to target transaction processing systems and siphon funds from entities primarily located in Latin America for at least four years.

The malicious hacking group has been codenamed Elephant Beetle by Israeli incident response firm Sygnia, with the intrusions aimed at banks and retail companies by injecting fraudulent transactions among benign activity to slip under the radar after an extensive study of the targets' financial structures.

"The attack is relentless in its ingenious simplicity serving as an ideal tactic to hide in plain sight, without any need to develop exploits," the researchers said in a report shared with The Hacker News, calling out the group's overlaps with another tracked by Mandiant as FIN13, an "industrious" threat actor linked to data theft and ransomware attacks in Mexico stretching back as early as 2016.
Click to expand...

"The unique modus operandi associated with the Elephant Beetle is their deep research and knowledge of victim's financial systems and operations and their persistent search for vulnerable methods to technically inject financial transactions, ultimately leading to major financial theft," Arie Zilberstein, vice president of incident response at Sygnia, told The Hacker News.
Click to expand...

Sygnia: Elephant Beetle: Uncovering an Organized Financial-Theft Operation

For the past two years, Sygnia’s Incident Response (IR) team has been methodically tracking the Elephant Beetle threat group, an organized, significant financial-theft operation threatening global enterprises.
Click to expand...

KEY POINTS

The Sygnia Incident Response team identified an organized and experienced threat group siphoning off funds from businesses in the financial sector in Latin America. Sygnia refers to this threat actor as 'Elephant Beetle' or TG2003.

This group operates undetected for long periods of time, patiently studying target financial systems, creating fraudulent transactions hidden among regular activity, and ultimately stealing millions of dollars.

Elephant Beetle is highly proficient with Java based attacks and, in many cases, targets legacy Java applications running on Linux-based machines as a means of initial entry to the environment.

While primarily focused in the Latin American market, Elephant Beetle can expand its attacks to organizations worldwide, with our IR team already discovering a breach in the Latin American operations of a U.S. company.

The full report includes the threat actor’s modus operandi, in-depth analysis of its capabilities, and provides actionable insights, IOCs and guidelines for defending against the attacks.

Click to expand...

guest · Jul 19, 2022

LendingTree denies connection to data breach affecting 200,000, but confirms a different one
July 15, 2022

The financial services giant LendingTree has denied any connection to a reported data breach involving 200,000 loan applications found on the dark web, although the company did confirm that the information of tens of thousands of customers was exposed in a separate breach in February.

Reports emerged in recent weeks of cybercriminals selling sensitive information purporting to be from applications originating from LendingTree, which connects customers to lenders.
The company began sending out breach notification letters on June 29, leading many to believe that the 200,000 loan applications on on the dark web were legitimate.
Click to expand...

But LendingTree director of communications Megan Greuling told The Record that the notifications the company sent out were in response to a “code vulnerability” in LendingTree’s platform that exposed the sensitive information of more than 70,000 customers in February.

The 200,000 loan applications for sale were first discovered by researchers with RestorePrivacy and were from October and November of last year. The information included addresses, phone numbers, IP addresses, loan form submissions, loan type, credit score and more.
Click to expand...

guest · Jul 21, 2022

Authentication weakness responsible for 80% of financial breaches
July 20, 2022

Despite the ongoing move to multi-factor authentication (MFA), the financial sector still faces a significant problem when it comes to breaches related to identification compromise, according to one recent research report.

Released July 13, the authentication in financial services study discovered that U.S. and European financial institutions experienced an average of 3.4 significant breaches within the past year, costing these banks, credit unions and investment firms on average $2.19 million annually in losses and remediation (which does not even account for so-called “intangible and hidden costs”).

“Findings uncover the burden that current authentication practices are leaving on financial organizations globally, specifically the high-risk cracks in security, strain on budgets and overall operational disruption,” according to a press release announcing the report.
Click to expand...

An “alarming” (if not shocking — given recent headlines) 85% of the financial organization respondents faced a cyber breach in the past 12 months, according to findings. However, perhaps more astonishing, more than 7 out of 10 (72%) experienced multiple breaches within the same timeframe. And yet, 9 out of 10 of these breached enterprises still insist that their existing authentication approach is secure, “despite data proving otherwise.”
Click to expand...

Hypr: Report: Financial Institutions Overly Complacent About Current Authentication Methods

New research report finds most financial organizations have experienced a breach due to an authentication weakness, yet only a third took action
Click to expand...

guest · Jul 21, 2022

Threat-landscape of Financial attacks
July 21, 2022

Financial institutions have been a traditional target for all kinds of attacks. We wanted to understand what kind of malware families have been used against them in recent cases and track their evolution. It is not easy, though, having details on artifacts used in such attacks.

Our approach was cross-checking OSINT data related to attacks targeting financial institutions with VirusTotal intelligence to shed some light on how these threats are evolving during 2022. We want to share some of the most interesting findings as well as providing some ideas on how you can use VirusTotal to track these attacks by yourself.
Click to expand...

Conclusions
Defining financial threats is a complicated task, especially when many targeted attacks and actors consistently share TTPs and toolsets. The use of OSINT is a starting point to identify some malware families uniquely being used in these attacks, as well as double checking which additional generic tools are commonly seen for lateral movement.

The good news is that we can monitor all of the above to understand how attackers’ toolsets evolve and be ready for them. The fact that many attackers repeat and reuse the same malware families should also be an advantage in readiness. Finally, keeping an eye both on exploits being used and infrastructure for malware distribution is definitely something useful to avoid infection and malware distribution.
Click to expand...

guest · Jul 26, 2022

4 Steps Financial Industry Can Take to Cope With Their Growing Attack Surface
July 26, 2022

The financial services industry has always been at the forefront of technology adoption, but the 2020 pandemic accelerated the widespread of mobile banking apps, chat-based customer service, and other digital tools. Adobe's 2022 FIS Trends Report, for instance, found that more than half of the financial services and insurance firms surveyed experienced a notable increase in digital/mobile visitors in the first half of 2020. The same report found that four out of ten financial executives say that digital and mobile channels account for more than half of their sales – a trend that's only expected to continue in the next few years.

As financial institutions expand their digital footprint, they have more opportunities to better serve their customers – but are also more exposed to security threats. Every new tool increases the attack surface. A higher number of potential security gaps, may potentially lead to a higher number of security breaches.
Click to expand...

Many are investing in automated security validation tools that show them their true security risk at any given time, then using those insights to create a roadmap for remediation. Here's the roadmap that financial institutions like Sander Capital Management are following: [...]
Click to expand...

guest · Jul 27, 2022

Phishers Targeted Financial Services Most During H1 2022
July 26, 2022

Banks received the lion’s share of phishing attacks during the first half of 2022, according to figures published by cybersecurity company Vade today.

The analysis also found that attackers were most likely to send their phishing emails on weekdays, with most arriving between Monday and Wednesday. Attacks tapered off towards the end of the week, Vade said.
Click to expand...

Crédit Agricole, one of the largest banks in Europe, is a significant name in the top five because of its sector’s prevalence in phishing attacks. Financial services topped the list of the most impersonated industries in phishing during the first half of this year. Other financial services companies MTB and PayPal joined the company in the top 10. The report found that a third of the unique phishing URLs detected during the first six months of this year were related to financial services.
Click to expand...

Phishers’ Favorites Top 25, H1 2022

guest · Aug 4, 2022

Thousands of sophisticated fake sites targeting investors in Europe
August 3, 2022

Go big, or go home. That is clearly the thinking of bad actors who have created thousands of fraudulent investment sites throughout Europe — and whose actions could bode a view of things to come in the U.S.

Researchers recently discovered a network of more than 11,000 fake investment sites, aimed at luring in fraud victims throughout Europe. Perhaps not surprisingly, these sites often appeared more sophisticated and realistic than many previous fake sites, including “fabricated evidence of enrichment and falsified celebrity endorsements to create an image of legitimacy and lure in a larger number of victims,” according to Bleeping Computer’s report.
Click to expand...

Through these sites, European investment customers have been tricked into sinking their money in purportedly “high-return investments,” for which they were often required to deposit a minimum of $255 (or €250). Despite efforts to contain or demolish these false financial pretenders, more than 5,000 of these fake investment sites were still active as of late July, according to Group-IB. The research firm uncovered and mapped a huge thriving network of related phishing sites and content hosts.
Click to expand...

Group-IB: Fake investment scams in Europe

Nevertheless, no matter how old the scheme is, it keeps bringing money to fraudsters.

The Group-IB Computer Emergency Response Team (CERT-GIB) has been investigating several fake investment schemes which are targeting European citizens. In the course of the research, a gigantic network infrastructure was uncovered and analyzed, which contained over 10,000 rogue resources, including similar fraudulent ones aimed at the inhabitants of the entire Eurasian continent and North America.
Click to expand...

The main goal of these fake investment schemes is to convince the victims to repeatedly transfer funds to the fake investment portal. The victims are usually promised huge returns on their investments and are shown “how I got rich” stories featuring celebrities.
Click to expand...

guest · Sep 5, 2022

New cyber rules for New York financial firms signal nationwide changes
By Karen Hoffman - September 5, 2022

The New York Department of Financial Services (NYDFS) presented new amendments last month to help “ratchet up” its cybersecurity requirements for financial institutions headquartered in the state, signaling potential heightened regulations for all U.S. banks.

New York has long been a pacesetter in terms of “codifying” cybersecurity and other regulatory rules for financial institutions. Even going back to 2015, New York state has taken a leading role in setting cybersecurity regulations and guidance for financial institutions. In 2017, the NYDFS took a "catalytic” role in settling cybersecurity rules and guidance.

“The cybersecurity landscape has evolved in the past five years, and the Draft Amendments demonstrate that DFS continues to take a forward-leaning role in strengthening cybersecurity practices,” according to a blog post on the Gibson Dunn website.
Click to expand...

The recent NYDFS proposals increased expectations for senior leaders, heightened technology requirements, an expanded set of events covered under the mandatory 72-hour notification requirements, a new 24-hour reporting requirement for ransom payments and a 30-day submission of defenses, significant new requirements for business continuity and disaster recovery, and heightened annual certification and assessment requirements.

Here are some key provisions of the NYDFS amendments: [...]
Click to expand...

guest · Sep 7, 2022

'DangerousSavanna' Hackers Targeted Financial Institutions in Africa For Two Years
By Alessandro Mascellino @a_mascellino - September 7, 2022

A persistent cyber–attack campaign has emerged targeting major financial institutions in French–speaking African countries and has been active over the last two years.

The campaign was discovered by Check Point Research (CPR) and dubbed 'DangerousSavanna.' It relied on spear phishing techniques to initiate infection chains.
Click to expand...

The threat actors reportedly sent malicious attachment emails in French to employees in Ivory Coast, Morocco, Cameroon, Senegal and Togo utilizing diverse file types, including PDF, Word, ZIP and ISO files, to lure victims.

Further, DangerousSavanna hackers used lookalike domains, impersonating other financial institutions in Africa, such as the Tunisian Foreign Bank and Nedbank.

"Our suspicion is that this is a financially motivated cyber–criminal, but we don't have conclusive evidence yet," explained Sergey Shykevich, threat intelligence group manager at CPR.
Click to expand...

More generally, the Check Point executive said cyber–criminals believe that fragile economies in some African countries may be linked to a lack of investment in cybersecurity.

"But the finance and banking sector is actually one of the most impacted industries worldwide, experiencing 1144 weekly cyber–attacks on average," Shykevich explained.
In the advisory detailing some of DangerousSavanna's recent attacks, CPR provided companies with advice on preventing spear phishing attacks. These techniques include keeping systems up to date, implementing multi-factor authentication (MFA), confirming suspicious email activity before interacting, educating employees and regularly testing their cybersecurity knowledge.
Click to expand...

The DangerousSavanna advisory comes weeks after cybersecurity company Vade revealed banks worldwide received the majority of phishing attacks during the first half of 2022.
Click to expand...

Check Point: In the mighty Savanna: Check Point Research reveals a 2-year campaign targeting large financial institutions in French-Speaking African countries

Highlights:

Dubbed ‘DangerousSavanna’- Check Point Research (CPR) uncovers a malicious campaign, targeting multiple major financial groups in French-speaking Africa, for the past two years

Attackers used Spear-phishing as initial infection, sending malicious attachment emails to employees in Ivory Coast, Morocco, Cameroon, Senegal, and Togo

The research provides overview of the infections chain and malicious infrastructure, urging organization to adopt email and endpoint security technologies to prevent sophisticated spear phishing attacks and malware infections.

Click to expand...

full technical research:
Check Point Research: DangerousSavanna: Two-year long campaign targets financial institutions in French-speaking Africa

Recent studies show that more than 85% of financial institutions in Central and Western Africa have repeatedly been victimized in multiple, damaging cyberattacks. In a quarter of these cases, intrusions into network systems resulted in the worst possible outcomes for the financial and banking sector: information leaks, identity theft, money transfer fraud, and bank withdrawals on false checks.

In this article, we analyze a malicious campaign called DangerousSavanna which has been targeting multiple major financial service groups in French-speaking Africa for the last two years. The threat actors behind this campaign use spear-phishing as a means of initial infection, sending emails with malicious attachments to the employees of financial institutions in at least five different French-speaking countries: Ivory Coast, Morocco, Cameroon, Senegal, and Togo.
[/quote9
Click to expand...

guest · Nov 11, 2022

Warning: New Massive Malicious Campaigns Targeting Top Indian Banks' Customers
By Ravie Lakshmanan - November 10, 2022

Cybersecurity researchers are warning of "massive phishing campaigns" that distribute five different malware targeting banking users in India.

"The bank customers targeted include account subscribers of seven banks, including some of the most well-known banks located in the country and potentially affecting millions of customers," Trend Micro said in a report published this week.
Some of the targeted banks include Axis Bank, ICICI Bank, and the State Bank of India (SBI), among others.
Click to expand...

The infection chains all have a common entry point in that they rely on SMS messages containing a phishing link that urge potential victims to enter their personal details and credit card information to supposedly get a tax refund or gain credit card reward points.

The apps themselves are delivered through phishing websites with domain names similar to that of their legitimate counterparts, in addition to reusing the brand logos to increase the likelihood of a successful attack and trick the user into downloading the malicious app to get "instant reward points."
Click to expand...

The similarity in stolen data and phishing themes notwithstanding, Trend Micro said there is no concrete evidence tying all these malware families to a single threat actor.

"While no other customers outside India have been targeted by these malware families, phishing campaigns in the country have significantly increased and are increasingly becoming adept at detection evasion," Trend Micro noted.
Click to expand...

Trend Micro: Massive Phishing Campaigns Target India Banks’ Clients

By Trend Micro - November 7, 2022
We found five banking malware families targeting customers of seven banks in India to steal personal and credit card information via phishing campaigns.
Click to expand...

Palo Alto Networks - Unit42: Banking Trojan Techniques: How Financially Motivated Malware Became Infrastructure

By Or Chechik - October 31, 2022
While advanced persistent threats get the most breathless coverage in the news, many threat actors have money on their mind rather than espionage. You can learn a lot about the innovations used by these financially motivated groups by watching banking Trojans.

Because attackers constantly create new techniques to evade detection and perform malicious acts, studying monetarily motivated malware can help defenders understand threat actor tactics and protect organizations more effectively.
Click to expand...

Log in or Sign up

And the industry sector most vulnerable to cyber attacks goes to... Finance

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

And the industry sector most vulnerable to cyber attacks goes to... Finance

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches