Attacks/Breaches

6/5/2018
05:54 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Financial Services Organizations Face More Sophisticated Threats Than Others

With companies in the financial sector getting better at blocking ordinary threats, attackers have begun going after them with more sophisticated malware, Lastline says.

The better than average defenses that financial companies have been able to mount against modern cyber threats has become a bit of a double-edged sword for organizations in the sector.

While financial companies are able to detect and block a lot more malware than others, they face considerably more sophisticated threats as a result as well.

A new report this week from Lastline based on an extensive malware analysis shows that threat actors typically elevate their attacks when going after financial companies.

For the report, Lastline analyzed 30 days worth of threat data targeted specifically at financial service companies and finance departments at enterprises. Lastline then compared those results with data on more generalized threats that the security vendor had reported on previously.

The exercise showed that the proportion of malware displaying advanced behavior was 20% higher in the financial sector than elsewhere. For the report, Lastline defined malware as displaying advanced behavior if it is packed to avoid detection by static signature-based tools,  evade dynamic analysis, steal credentials, and remain stealthy.

One in 10 of the financial sector malware that Lastline analyzed integrated all four behaviors, compared to the 1 in 12 global average for advanced threats in other industry verticals. Overall, the percentage of total files that Lastline found to be malicious was 47% higher than the global data.

One reason could be that the financial sector's more effective security measures require a more sophisticated effort on the part of malware writers, says Andy Norton, author of the report and Lastline's director of threat intelligence.

"The finance industry is facing a more sophisticated threat than is encountered by a wider audience," Norton says. "They need to understand that more stringent security doesn’t make the threat go away; it only changes the nature of the threat."

To remain ahead of emergent threats financial organizations and finance groups at enterprise need to incorporate controls for inspecting the behavior of objects entering the internal environment rather than relying simply on existing controls and user awareness, he says.

The Lastline report comes just weeks after an Accenture study showing that cybersecurity has become a major issue for financial services organizations. The Accenture study, done in collaboration with the Ponemon Institute, found that the average number of breaches at financial services companies has more than tripled, from 40 in 2012 to 125 breaches in 2017.

The average annual costs of cybercrime for financial services companies has also increased sharply, rising from $12.97 million per firm in 2014 to $18.28 million last year, compared to an average of $11.7 million for organizations across other industries. Between 2016 and 2017 alone, spending on security breaches increased 10% among financial organizations.

But at the same time, the report found that organizations in the financial sector have gotten better than counterparts in other industries at dealing with more common forms of cyberattacks, especially those involving malware. Lastline's analysis too showed that financial companies are able to repel 30% more of the most common threats that they encounter compared to other organizations.

Lastline also found that a vast majority of the top malware tools targeted at financial companies are being delivered via Microsoft-office based documents and rich text format files. The security vendor's analysis of the 100 most recent malware samples showed that currently one of the most common threats targeted at financial companies is iSpy, a variant of the HawkEye keylogger. The malware is designed to capture and exfiltrate website, email and FTP credentials, and also license key information for the software on a compromised system.

Lastline also uncovered a high prevalance of Emotet and URSNIF two other keyloggers that are being delivered via Microsoft Office documents to financial companies. The two strains of malware contain features for evading dynamic analysis and are equipped among other things to highjack automated transfer payments, Lastline said. Like other advanced malware, Emotet and URSNIF have over the years integrated features that support lateral movement, additional credential theft and spamming.

"The email vector for delivering threats is higher in finance than other industries where web based compromise was also a major factor," Norton says. "[But] advancements in AI based anti virus have translated to better protection from email-based attacks," generally he says.

Related Content:

 

 

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for more information

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
6/6/2018 | 8:49:41 AM
True
I work for a financial services firm with a dedicated Malware forensics department that has STOPPED invasive threats and is actively threat hunting for whatever is OUT THERE.  This is unique.  Every firm, large to small, should have some knowledge of threats inside and outside and remediate them asap.  Carbon Black is a great utility for monitory.  We have cloud malwarebytes and scan scan asap.  
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Lessons from My Strange Journey into InfoSec
Lysa Myers, Security Researcher, ESET,  7/12/2018
What's Cooking With Caleb Sima
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-9574
PUBLISHED: 2018-07-19
nss before version 3.30 is vulnerable to a remote denial of service during the session handshake when using SessionTicket extension and ECDHE-ECDSA.
CVE-2017-2673
PUBLISHED: 2018-07-19
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles.
CVE-2017-7481
PUBLISHED: 2018-07-19
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templati...
CVE-2018-12911
PUBLISHED: 2018-07-19
WebKitGTK+ 2.20.3 has an off-by-one error, with a resultant out-of-bounds write, in the get_simple_globs functions in ThirdParty/xdgmime/src/xdgmimecache.c and ThirdParty/xdgmime/src/xdgmimeglob.c.
CVE-2018-14404
PUBLISHED: 2018-07-19
A NULL pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the XPATH_OP_AND or XPATH_OP_OR case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulne...