Threat Actors in Cyber Crime

Whilst we always imagine that hackers are pimply faced nerds sitting in their parent's basement knocking back energy drinks whilst embarking on hacking marathons this, however, is far removed from the truth.

Cybercrime is far more systematic, advanced and organised than ever before and last year overtook drugs to become the most profitable illicit industry. In 2015 U.S. victims paid over 24 million alone to ransomware groups who utilised the Cryptolocker trojan. These groups are well funded, well resourced and have the knowledge to get the job done. The core motive for cybercrime is purely financial either through the use of ransomware to extort or the theft of data which can be on-sold through the Dark Web.

Cybercriminals predominantly use phishing operations as they are cheap, effective and generate a significant profit. Admittedly a targeted email attacked called a spear phishing campaign is trickier to protect against however a mass phishing campaign generates the best returns. As a rule, these campaigns distribute malware (ransomware) via email containing convincing social engineering factors encouraging the reader to follow the instructions. In Australia, recently there have been numerous campaigns associated with banks, Australia Post, Office of State Revenue and the ATO. These emails usually ask the receiver to forward or open an attachment which activates the malware.

Hacktivists, on the other hand, are not motivated by greed but have an axe to grind and for whatever reason that it is against you. Hackers fall into two categories, white or black hat (good or bad) and most are employed in some element of the cyber security industry such as network administration. Hackers tend to work alone, however recently we have seen the rise of hacktivist groups such as Anonymous. Hacktivist attacks are random and hard to predict and react to however they aren't interested in financial gain but cyber sabotage. If they steal data it is either to create embarrassment or find incriminating evidence. DDoS (distributed denial of service) attacks are their tools of trade in which the hacktivist creates a 'botnet' to control a large number (thousand or tens of thousands) of computers and repeatedly sends simple requests to the targeted website.

State-sponsored attackers traditionally play a long game and work multiple attacks simultaneously even if they already have access to your network. Utilising this method they can collect data over a prolonged period rather than a 'hit and run' operation. This multi-pronged approach inhibits defence mechanisms and requires that organisations must have a robust, up to date security program and implement threat intelligence strategies.

Finally, not all attacks are technical, they could be simply employees who may have unwittingly given information out when trying to be helpful. On the other hand, an aggrieved employee such as Edward Snowden may as part of their revenge steal secrets for resale or vandalise assets and these insider threats are the most dangerous and extremely hard to detect.

The continued emergence and increasing sophistication of threats to cyber security require continuous improvement to stay at the on the front foot. Cyber security is most definitely not a sprint but a marathon.

1.           Blackwood, F, 2015, Cryptolocker virus: Australians forced to pay as latest encryption virus is 'unbreakable', security expert says, 10 August accessed April 2017, www.abc.net.au

2.     Police issue warning about fake delivery emails over Christmas, 12 December 2016 accessed April 2017, www.news.com.au

 

3.     Swan, D, 2016, NAB users warned of new phishing scam, 13 September accessed April 2017, www.theaustralian.com.au

4.     Turkel, D, 2016, Victims paid more than $24 million to ransomware criminals in 2015 -- and that's just the beginning, 8 April accessed April 2017, www.businessinsider.com.au