Group-IB, an international company that specializes in preventing cyberattacks, has conducted high-tech cybercrimes research based on an analysis of responses to information security incidents carried out by Group-IB Incident Response team in 2018. According to the new research, hackers traditionally target the financial sector. Even so, 74 percent of banks were not ready for cyberattacks, 29 percent were found to be actively infected with malware, and in 52 percent of cases traces of past attacks were detected. According to experts, one of the most dangerous trends of the past year is cross-border domino-effect cyberattacks, in which the infected infrastructure of a compromised bank is used to spread the infection further to other banks. In 2018, Group-IB Incident Response team has detected the use of such vector in Russia and Eastern Europe.
The total number of Group-IB incident responses has more than doubled compared to 2017. Topping the list of the main threats faced by the compromised companies are targeted attacks, competitive espionage, ransomware attacks, and cryptomining. The main conclusion of Group-IB’s digital forensic lab is that the vast majority of Russian companies affected by hacker attacks last year did not have incident response plan and therefore were not ready to quickly mobilize its information security departments, the personnel of which are in turn often unable to resist the attackers. Group-IB experts highlight the high probability of repeated incidents in such companies.
An unfortunate fact: banks aren’t ready to defend against threat actors
According to the incident response study, banks were the targets of about 70% of hacker activity last year. Hackers still use the same cashing-out schemes as they used to: the stolen funds are withdrawn using payment cards pre-opened in a targeted bank, dummy law firm accounts, payment systems, ATMs and SIM cards. At the same time, the volume of cashing out in Russia has increased several times: a cash-out of 3 million USD took on average about 25-30 hours 3 years ago, but in 2018 there were incidents in which the same amount was successfully cashed out in less than 15 minutes at a time in different Russian cities.
Analysis of data obtained by Group-IB during incident responses revealed that 74 percent of banks attacked in 2018 were not ready for cyberattacks. At the same time, more than 60 percent of them turned out to be unable to centrally manage their networks (especially in the case of geographically distributed infrastructure). In more than 80 percent of financial organizations affected by the hacking activity, no sufficient level of event logging over a longer period (more than a month) was observed. Insufficient cooperation between internal departments is an additional factor that plays into the hands of attackers: more than 65 percent of the financial organizations, where the Group-IB IR team worked, spent more than 4 hours for coordination of work between departments. Meanwhile, an average of 12 hours were spent on meetings, granting access and routine work as part of one incident response.
Group-IB research revealed not only low level of elaboration of organizational procedures for establishing the source of an infection, determining the extent of compromise, and localization of the incident, but also insufficient technical skills of banks personnel. According to Group-IB researchers, 70 percent of the organizations have insufficient or no specialized skills to detect infection traces and unauthorized network activity. The same percentage lacks well-defined procedures for self-detection of hardware and software compromises. High risks result from technical specialists’ lack of readiness to react quickly to cyber incidents: according to Group-IB, more than 60 percent of banks are unable to carry out a centralized one-time change of all passwords in a short time, which allows hackers to attack new targets from within the compromised infrastructure of the bank.
Head of Group-IB Digital Forensics Lab
Hidden agenda
According to Group-IB, at least 17 percent of companies, where incident response was carried out, have been targeted through previously unaddressed vulnerabilities within a year after the last infection. In the vast majority of cases, this was a consequence of a failure to comply with recommendations, as well as negligence of bank employees. In addition, during 2018, Group-IB experts detected active infections in 29 percent of financial sector organizations, unknown to the internal information security service. In 52 percent of cases, traces of past attacks were found.
In 2018, the Group-IB Incident Response team recorded cases in which cyberattacks were organized in order to create a negative image around a bank, leading to reputational damage and in some cases bank’s departure from the market.
Head of Group-IB Digital Forensics Lab
