Cyber criminals are banding together to share their areas of expertise and steal from and/or wreak havoc upon as many people and organizations as they can, either without regard for their victims or to intentionally inflict the maximum amount of damage possible. In a recent example, Microsoft uncovered a massive criminal organization providing what security researchers called “phishing as a service” (PHaaS) to its criminal clientele. Many groups like this one are operating openly, advertising their services online and offering incentives such as free stolen credit card or PII data to convince others to join their ranks or subscribe to their services. Their use of wire transfers and cryptocurrencies as their preferred method of payment makes it difficult to track them down. And, because many of those running these crime syndicates operate from foreign countries that may or may not be willing to cooperate with U.S. officials, it can be extremely difficult, if not impossible, to bring them to justice if they are found.
Some examples
In the aforementioned PHaaS example, the criminal organization provides malicious website hosting services, creates and sends phishing emails, provides tutorials on how to use the available resources, and offers multiple email templates to choose from. They make it easy for their clients to run massive phishing campaigns.
In May of 2021, a major health insurance provider announced that a hacking syndicate had stolen hundreds of thousands of patient records that included their login credentials, sensitive personal data, and financial account information. Health care providers have made the list of favorite targets of these groups.
The ongoing pandemic and labor shortage have interrupted the supply chains in several industries and some organized cyber crime operations are doing what they can to exacerbate the problem. For example, farming operations and the food supply chain have become increasingly dependent on technology. As a result, cyber attacks against them have increased dramatically. By compromising automated agricultural systems such as those that analyze soil and apply chemicals and fertilizers, criminals can destroy crops or cause potentially dangerous levels of pesticides to be applied.
 | Customer Case Study: Learn how Difenda Shield MDR for OT helped our customer increase visibility and unify protection of business critical production systems. |
Who are these people?
Some claim to be “hactivists” and assert that they are engaging in their illicit activities for the greater good. They do what they do to make the world a better place by forcing others to conform to their societal or political agendas. “Anonymous” is one of the better known hactivist organizations. Because these criminal enterprises aren’t in it for the money, their attacks usually involve disrupting their targets’ operations or bringing to light some negative information about them.
Many of these crime syndicates are only concerned with generating big profits regardless of any negative consequences that may result from their actions. During the first half of 2021, companies paid, on average, $1.85 million to recover from a successful ransomware attack. In some of the worst attacks making the news in 2021, including one targeting an agricultural cooperative, organizations paid ransoms in excess of $10 million. Cyber crime syndicates are now identifying company insiders and offering them six, perhaps even seven-figure payoffs for installing ransomware packages on their employers’ systems, thereby making it easier to pull off a successful attack.
Some of these criminal organizations are state-sponsored or are affiliated with terrorist groups seeking to do damage to critical infrastructure. Health care organizations, agricultural entities, supply chains, and government agencies are often targeted by these syndicates.
What can be done?
Many of these attacks rely on social engineering tactics, primarily phishing, to achieve success. Since technical controls cannot block every malicious email, nor can they stop bad actors from taking advantage of human vulnerabilities and tendencies, an effective cybersecurity training program is essential. Organizations must involve their employees in interactive and continuous training to teach them to recognize phishing messages and other threats. The program should be regularly evaluated and continuously improved.
Since insiders are being enlisted to help perpetrate attacks against their employers and being promised large financial payoffs in return, employers should train managers and HR personnel to identify disgruntled employees in their ranks and address any issues they are having. Additionally, companies may also wish to offer counseling and assistance to employees who are having financial issues as they might be tempted by an attacker’s offer,
Companies often publish too much information on their public websites, including names, job titles, and direct contact information of key employees. Sometimes sites reveal information about a company’s vendors or customers. Information like this is valuable to criminals gathering the data necessary to perpetrate social engineering attacks. Avoid oversharing on company sites and social media.
A system of technical controls should be deployed in accordance with current best practices and should comply with any and all applicable regulatory or industry standards. Role-based access control (RBAC) or perhaps even a zero-trust model should be implemented to ensure employees only have access to resources they require to perform their duties. Special consideration should be given to ensuring that remote employees are working securely.
Backup systems that encrypt and store critical data in an air-gapped storage location can help an organization to rapidly recover from a successful ransomware attack and other attacks that involve destruction of, or denial of access to, essential data.
If an organization is not in a position to develop and implement its own comprehensive cybersecurity training program or needs help with evaluating and deploying technical security controls and access policies, third-party providers of training and Sec-Ops-As-A-Service, suchas Difenda are available to meet those needs.
In closing…
This problem is not going away. These criminal organizations pose a real and growing threat to governmental entities including law enforcement and other first responder agencies. Banks and other financial institutions, the health care industry, agricultural organizations, and the supply chain in general are at risk as well, as are any other targets they may choose to attack. The recommendations included herein are general. Every organization should tailor its cybersecurity infrastructure and training programs to fit its specific needs. There are quality third-party providers of security training and Sec-Ops-As-A-Service readily available to help if assistance is needed.