Credit Card Compromise Up 212% as Hackers Eye Financial Sector

More than one-quarter of all malware attacks target the financial services sector, which has seen dramatic spikes in credential theft, compromised credit cards, and malicious mobile apps as cybercriminals seek new ways to generate illicit profits.

It's hardly surprising to learn attackers want money; what researchers highlight in IntSights' "Banking & Financial Services Cyber Threat Landscape Report" is what they look for and how they obtain it. The first quarter of 2019 saw a 212% year-over-year spike in compromised credit cards, 129% surge in credential leaks, and 102% growth in malicious financial mobile apps.

Banks and other financial services organizations were targeted in 25.7% of all malware attacks last year – more than any of the other 27 industries tracked. Researchers point to two key events that largely shaped the modern financial services threat landscape: the shutdown of cybercriminal forum Altenen and "Collections #1-5," a major global data leak earlier this year.

In January 2019, roughly 2.2 billion usernames and passwords were leaked on the Dark Web in an incident dubbed "Collections #1-5," named for the relatively bland file names containing the data. Researchers saw a major increase in leaked credentials during this time frame – credential leaks in the first quarter of 2019 nearly doubled those of any of the previous four quarters.

There was also the shutdown of Altenen, a major hub for buying and selling credit card data that was taken down in May 2018 when Israeli authorities arrested its manager. Researchers estimate Altenen facilitated fraud for more than 20,000 credit cards and $31 million in money laundering. Since it was taken down, new sites – including Altenen.nz – emerged in its place, but experts say it's unlikely any of the substitutes will grow to reach the scale of the original.

"That was a huge setback," says Hadar Rosenberg, white hat hacker and IntSights threat intelligence research analyst, of the Altenen shutdown. "That was the biggest black market that was selling credit cards. It was the most well-known, and everybody was using it." When asked whether Altenen.nz has the potential to replace Altenen, she says it "doesn't seem so right now."

Credential theft is a pervasive and dangerous threat in financial services, Accenture researchers note in a new report on industry threats. In 2018, more than 43,000 breaches across industries involved the use of customer credentials stolen from botnet-infected clients. Credential theft is a rapidly growing threat to enterprise networks, especially if cybercriminals gain access to the username and password of a privileged employee. With this level of access, they don't need malware to achieve their goals.

In addition to credential compromise, IntSights researchers saw 9,708 instances of exposed credit card data in the first quarter, marking a 212% increase year-over-year. The number of leaked credit cards continued to rise throughout 2018 and spiked in the first quarter of 2019, which Rosenberg says came as a surprise.

"You do expect that the industry would do more to mitigate this problem, but you still see where hackers are going," she says. "It's the easiest money for them."

Cybercriminals primarily use compromised credit card numbers to make small purchases, a tactic they can use to evade detection while generating nearly 10 times more "free money" than what the card is worth on the Dark Web. Credit card companies usually reimburse people affected by card fraud; as a result, cybercriminals see potentially big gains and little risk.

IntSights also noticed 102% growth in the frequency of malicious mobile applications since early 2018. More than one in three consumers are tricked by fake mobile apps, which include fraudulent banking apps that mimic apps from major companies. Researchers anticipate the risk of these apps will grow as consumers become more comfortable with mobile banking.

Malicious apps aside, cybercriminals are targeting financial firms with a range of tactics, the most common of which are malware (banking Trojans Adload, Atrpas, and Emotet), ransomware, ATM malware and card skimmers, and vulnerabilities in SS7, which attackers exploit to intercept text messages authorizing payments from bank accounts. The first publicly reported SS7 exploitation affected the UK-based Metro Bank in February 2019. While rare now, Rosenberg anticipates we may see more SS7 exploitation as hackers learn to understand it.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.