Cybercrooks Expand Sights To Market Manipulation

A new FireEye report shows attacks with simple technical roots but sophisticated knowledge of the investment world are stealing information that could be used for insider trading.

Big box retail hacks against likely targets like Target and Home Depot might still dominate the headlines, but for many cybercriminals, those kind of rudimentary credit card number heists are so passé. Instead, todays business-savvy crooks have set their sights on something way juicier. Theyre perfecting the art of intruding networks to steal confidential information about publicly traded companies -- information that could give them the jump on the market to conduct insider trading and other unknown market manipulation shenanigans.
The way that these crooks are profiting from the information still needs investigation, but a
report out today by researchers from FireEye
shows how one particular group mines its information. Dubbed FIN4 by researchers, this particular group is on the hunt for what FireEye calls impending market catalysts, the types of events like mergers and acquisitions that could drastically affect stock prices for a short period of time.
Interestingly, as sophisticated as the targeting is by this group, the technical tactics being used are quite simple.
Attackers in the group dont actually exploit any vulnerabilities or deliver malware payloads on to their targets systems. Instead, one of their favorite techniques is to embed VBA macros into stolen Office documents to display phony authentication prompts in order to steal user credentials. Similarly, theyll use reconnaissance about pending deals to develop extremely well-tailored emails and trick targets into logging into fake webmail login pages. What sets these attackers apart from the average spearphisher, though, is the understanding they bring to the table of the investment industry and its lingo.
Their spearphishing themes appear to be written by native English speakers familiar with both investment terminology and the inner workings of public companies, the report stated. FIN4s phishing emails frequently play up shareholder and public disclosure concerns.
According to John Hultquist, cyber espionage practice lead for iSIGHT Partners, his team has also been following the activity of this group, and they can corroborate the findings. He agrees that the criminals have a superb command of the English language, and he states that the attackers make up for their lack of technical sophistication with advanced operational tactics.
There are plenty of actors who can carry out an exploitation of your system without you ever knowing it -- these are not those guys, he says. That being said, theyve made up for these limitations with excellent social engineering.
He says that the group tends to set its sights on outside law firms and other less-secure third parties dealing with targeted companies. He related one incident where his team saw that the attackers had stolen a legitimate Excel file from an auditor, weaponized that document, and then sent it to the target with the file name Q2 2014 Filing Timeline.
So you see these types of things where they use a real, legitimate document spoofed to look like it came from a real, legitimate person, he says.
According to Steve Hultquist, chief evangelist for RedSeal, this report should send shivers down the backs of all who hold their corporate data as competitive assets. As he explains, it is a proofpoint of how cyber espionage is evolving beyond the smash-and-grab theft of credit card numbers that are usually reported. He believes that it should be a wakeup call alerting the industry to the need for better architectural solutions to security problems that have often been laid at the feet of clueless users.
Organizations must move beyond the traditional simple username and password access to broad swaths of information, and use both application design and data access strategies to slow the gathering of critical data for reconnaissance, he says.
Anup Ghosh, CEO of Invincea, agrees, pointing out that FireEyes research shows that the machines of the targeted companies were not compromised. It was simply an attack on email credentials.
Companies should enable two-factor authentication for all business-critical services, including email for all employees and corporate social media, he says. Until then, these types of attacks will continue to succeed as the bar is fairly low to get users to open attachments and click on links.

Last News
▸ Feds probe cyber breaches at JPMorgan, other banks. ◂ Discovered: 23/12/2024 Category: security	▸ Security Problem Growing for Dairy Queen, UPS & Retailers, Back off ◂ Discovered: 23/12/2024 Category: security	▸ Veritabile Defecte de Proiectare a Securitatii in Software -> Top 10 Software Security Design Flaws ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Cybercrooks Expand Sights To Market Manipulation