Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

6/5/2018
05:54 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Financial Services Organizations Face More Sophisticated Threats Than Others

With companies in the financial sector getting better at blocking ordinary threats, attackers have begun going after them with more sophisticated malware, Lastline says.

The better than average defenses that financial companies have been able to mount against modern cyber threats has become a bit of a double-edged sword for organizations in the sector.

While financial companies are able to detect and block a lot more malware than others, they face considerably more sophisticated threats as a result as well.

A new report this week from Lastline based on an extensive malware analysis shows that threat actors typically elevate their attacks when going after financial companies.

For the report, Lastline analyzed 30 days worth of threat data targeted specifically at financial service companies and finance departments at enterprises. Lastline then compared those results with data on more generalized threats that the security vendor had reported on previously.

The exercise showed that the proportion of malware displaying advanced behavior was 20% higher in the financial sector than elsewhere. For the report, Lastline defined malware as displaying advanced behavior if it is packed to avoid detection by static signature-based tools,  evade dynamic analysis, steal credentials, and remain stealthy.

One in 10 of the financial sector malware that Lastline analyzed integrated all four behaviors, compared to the 1 in 12 global average for advanced threats in other industry verticals. Overall, the percentage of total files that Lastline found to be malicious was 47% higher than the global data.

One reason could be that the financial sector's more effective security measures require a more sophisticated effort on the part of malware writers, says Andy Norton, author of the report and Lastline's director of threat intelligence.

"The finance industry is facing a more sophisticated threat than is encountered by a wider audience," Norton says. "They need to understand that more stringent security doesn’t make the threat go away; it only changes the nature of the threat."

To remain ahead of emergent threats financial organizations and finance groups at enterprise need to incorporate controls for inspecting the behavior of objects entering the internal environment rather than relying simply on existing controls and user awareness, he says.

The Lastline report comes just weeks after an Accenture study showing that cybersecurity has become a major issue for financial services organizations. The Accenture study, done in collaboration with the Ponemon Institute, found that the average number of breaches at financial services companies has more than tripled, from 40 in 2012 to 125 breaches in 2017.

The average annual costs of cybercrime for financial services companies has also increased sharply, rising from $12.97 million per firm in 2014 to $18.28 million last year, compared to an average of $11.7 million for organizations across other industries. Between 2016 and 2017 alone, spending on security breaches increased 10% among financial organizations.

But at the same time, the report found that organizations in the financial sector have gotten better than counterparts in other industries at dealing with more common forms of cyberattacks, especially those involving malware. Lastline's analysis too showed that financial companies are able to repel 30% more of the most common threats that they encounter compared to other organizations.

Lastline also found that a vast majority of the top malware tools targeted at financial companies are being delivered via Microsoft-office based documents and rich text format files. The security vendor's analysis of the 100 most recent malware samples showed that currently one of the most common threats targeted at financial companies is iSpy, a variant of the HawkEye keylogger. The malware is designed to capture and exfiltrate website, email and FTP credentials, and also license key information for the software on a compromised system.

Lastline also uncovered a high prevalance of Emotet and URSNIF two other keyloggers that are being delivered via Microsoft Office documents to financial companies. The two strains of malware contain features for evading dynamic analysis and are equipped among other things to highjack automated transfer payments, Lastline said. Like other advanced malware, Emotet and URSNIF have over the years integrated features that support lateral movement, additional credential theft and spamming.

"The email vector for delivering threats is higher in finance than other industries where web based compromise was also a major factor," Norton says. "[But] advancements in AI based anti virus have translated to better protection from email-based attacks," generally he says.

Related Content:

 

 

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for more information

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
6/6/2018 | 8:49:41 AM
True
I work for a financial services firm with a dedicated Malware forensics department that has STOPPED invasive threats and is actively threat hunting for whatever is OUT THERE.  This is unique.  Every firm, large to small, should have some knowledge of threats inside and outside and remediate them asap.  Carbon Black is a great utility for monitory.  We have cloud malwarebytes and scan scan asap.  
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/14/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-14499
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allow an attacker to obtain all user accounts credentials.
CVE-2020-14501
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text. An attacker may also ...
CVE-2020-14503
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an attacker to remotely execute arbitrary code.
CVE-2020-14497
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely execute code.
CVE-2020-14505
PUBLISHED: 2020-07-15
Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection�) vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that create...