Attacks/Breaches

6/5/2018
05:54 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Financial Services Organizations Face More Sophisticated Threats Than Others

With companies in the financial sector getting better at blocking ordinary threats, attackers have begun going after them with more sophisticated malware, Lastline says.

The better than average defenses that financial companies have been able to mount against modern cyber threats has become a bit of a double-edged sword for organizations in the sector.

While financial companies are able to detect and block a lot more malware than others, they face considerably more sophisticated threats as a result as well.

A new report this week from Lastline based on an extensive malware analysis shows that threat actors typically elevate their attacks when going after financial companies.

For the report, Lastline analyzed 30 days worth of threat data targeted specifically at financial service companies and finance departments at enterprises. Lastline then compared those results with data on more generalized threats that the security vendor had reported on previously.

The exercise showed that the proportion of malware displaying advanced behavior was 20% higher in the financial sector than elsewhere. For the report, Lastline defined malware as displaying advanced behavior if it is packed to avoid detection by static signature-based tools,  evade dynamic analysis, steal credentials, and remain stealthy.

One in 10 of the financial sector malware that Lastline analyzed integrated all four behaviors, compared to the 1 in 12 global average for advanced threats in other industry verticals. Overall, the percentage of total files that Lastline found to be malicious was 47% higher than the global data.

One reason could be that the financial sector's more effective security measures require a more sophisticated effort on the part of malware writers, says Andy Norton, author of the report and Lastline's director of threat intelligence.

"The finance industry is facing a more sophisticated threat than is encountered by a wider audience," Norton says. "They need to understand that more stringent security doesn’t make the threat go away; it only changes the nature of the threat."

To remain ahead of emergent threats financial organizations and finance groups at enterprise need to incorporate controls for inspecting the behavior of objects entering the internal environment rather than relying simply on existing controls and user awareness, he says.

The Lastline report comes just weeks after an Accenture study showing that cybersecurity has become a major issue for financial services organizations. The Accenture study, done in collaboration with the Ponemon Institute, found that the average number of breaches at financial services companies has more than tripled, from 40 in 2012 to 125 breaches in 2017.

The average annual costs of cybercrime for financial services companies has also increased sharply, rising from $12.97 million per firm in 2014 to $18.28 million last year, compared to an average of $11.7 million for organizations across other industries. Between 2016 and 2017 alone, spending on security breaches increased 10% among financial organizations.

But at the same time, the report found that organizations in the financial sector have gotten better than counterparts in other industries at dealing with more common forms of cyberattacks, especially those involving malware. Lastline's analysis too showed that financial companies are able to repel 30% more of the most common threats that they encounter compared to other organizations.

Lastline also found that a vast majority of the top malware tools targeted at financial companies are being delivered via Microsoft-office based documents and rich text format files. The security vendor's analysis of the 100 most recent malware samples showed that currently one of the most common threats targeted at financial companies is iSpy, a variant of the HawkEye keylogger. The malware is designed to capture and exfiltrate website, email and FTP credentials, and also license key information for the software on a compromised system.

Lastline also uncovered a high prevalance of Emotet and URSNIF two other keyloggers that are being delivered via Microsoft Office documents to financial companies. The two strains of malware contain features for evading dynamic analysis and are equipped among other things to highjack automated transfer payments, Lastline said. Like other advanced malware, Emotet and URSNIF have over the years integrated features that support lateral movement, additional credential theft and spamming.

"The email vector for delivering threats is higher in finance than other industries where web based compromise was also a major factor," Norton says. "[But] advancements in AI based anti virus have translated to better protection from email-based attacks," generally he says.

Related Content:

 

 

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for more information

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
6/6/2018 | 8:49:41 AM
True
I work for a financial services firm with a dedicated Malware forensics department that has STOPPED invasive threats and is actively threat hunting for whatever is OUT THERE.  This is unique.  Every firm, large to small, should have some knowledge of threats inside and outside and remediate them asap.  Carbon Black is a great utility for monitory.  We have cloud malwarebytes and scan scan asap.  
New Cold Boot Attack Gives Hackers the Keys to PCs, Macs
Kelly Sheridan, Staff Editor, Dark Reading,  9/13/2018
Yahoo Class-Action Suits Set for Settlement
Dark Reading Staff 9/17/2018
RDP Ports Prove Hot Commodities on the Dark Web
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17208
PUBLISHED: 2018-09-19
Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via cgi-bin/zbtest.cgi or cgi-bin/zbtest2.cgi (scripts that can be discovered with binwalk on the firmware, but are not visible in the web interface). This occurs because shell me...
CVE-2018-17205
PUBLISHED: 2018-09-19
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6, affecting ofproto_rule_insert__ in ofproto/ofproto.c. During bundle commit, flows that are added in a bundle are applied to ofproto in order. If a flow cannot be added (e.g., the flow action is a go-to for a group id that does not ex...
CVE-2018-17206
PUBLISHED: 2018-09-19
An issue was discovered in Open vSwitch (OvS) 2.7.x through 2.7.6. The decode_bundle function inside lib/ofp-actions.c is affected by a buffer over-read issue during BUNDLE action decoding.
CVE-2018-17207
PUBLISHED: 2018-09-19
An issue was discovered in Snap Creek Duplicator before 1.2.42. By accessing leftover installer files (installer.php and installer-backup.php), an attacker can inject PHP code into wp-config.php during the database setup step, achieving arbitrary code execution.
CVE-2017-2855
PUBLISHED: 2018-09-19
An exploitable buffer overflow vulnerability exists in the DDNS client used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. On devices with DDNS enabled, an attacker who is able to intercept HTTP connections will be able to fully compromise the device by creating a rogue HT...