From Bozkurt to Buhtrap

From Bozkurt to Buhtrap Cyber threats affecting financial institutions in 1H 2016 1 Table of Contents Executive Summary ............................................................... ...............................3 Hacktivism........................................................................................................... ..4 OpIcarus............................................................................................................... ..4 OpAfrica................................................................................................................ ..5 Phineas Fisher........................................................................................................5 Cybercrime ............................................................................................................6 DDoS-based extortion activity................................................................................6 Data breaches...................................................................................................... ..8 Business email compromise .............................................................................. ..9 Malware campaigns............................................................................................. 10 Targeted attacks..................................................................................................12 Mossack Fonseca..................................................................................................12 Attacks on the SWIFT network in 2016................................................................12 Buhtrap / Ratopak................................................................................................14 Forecasting the threat in Q3 2016......................................................................16 End notes..............................................................................................................19 2 Executive summary Despite recent activity surrounding the healthcare industry, organizations in the financial services industry continue to be faced with a wide variety of cyber threats. In order to stay ahead of these threats, organizations can develop situational awareness of them. The first half of 2016 (1H) saw plenty of cyber threats targeted at, and relevant to, the financial services industry. This paper will look at activity we have detected across hacktivism, cybercrime and targeted attacks, between January and the end of June 2016. Looking back at what we observed during the first half of 2016 (1H), allows us to better understand the motivations and tactics, techniques and procedures (TTPs) of the threat actors targeting the financial services sector. Armed with this intelligence of current trends, we are able to provide projections for activity we might see against the financial service industry in Q3 2016. 3 Hacktivism The majority of hacktivism against financial institutions we have detected in 1H 2016 has occurred as part of the hacktivist operation known as OpIcarus. This has had a demonstrably low impact, despite the three claims of data leakage outlined in the following section. Additionally, we have detected further attacks conducted by the threat actor Phineas Fisher, who we assessed to be a hacktivist threat actor whose previous attacks have had a high impact to targeted organizations. Given this threat actor claimed to have stolen funds from an unnamed bank, their activity was included in this report. The most prominent hacktivist activity detected has been outlined in this section. OpIcarus OpIcarus was launched by affiliates of the Anonymous collective on February 8, 2016, and initially started as a planned protest outside of the New York Stock Exchange in the United States and the Bank of England in the United Kingdom. At the time of writing, OpIcarus activity had continued and was in the so-called “third phase” for which the stated objective was the targeting of stock exchanges around the world. However, we have detected at least one instance where an insurance company was targeted. Although we have detected some claims of data leakage as part of the hacktivist operation OpIcarus, none of them were confirmed and should they have been genuine the number of impacted individuals was assessed to be low. We had not detected any acknowledgement of the claimed data leakages by the implicated companies at the time of writing, therefore have not assessed the impact of the claims made in relation to their data. Overall, hacktivist activity as part of OpIcarus was largely in relation to denial of service attacks at the time of writing and the threat level posed by the operation was assessed as low. Graph showing number of claimed OpIcarus attacks by continent Africa Asia Europe North America South America Oceania 4 Figure 1: Number of claimed OpIcarus attacks by continent OpAfrica On February 24, 2016 a Twitter user claiming affiliation to the Anonymous hacktivist collective claimed that threat actors had compromised the website of the Central Bank of Nigeria (cbn[.] gov[.]ng) and that they had leaked the data online both freely and publicly as part of the hacktivist operation OpAfrica. The compromise was claimed to have been conducted as part of the hacktivist operation OpAfrica and motivated by anti-corruption and anti-human rights abuses. This operation was focused on the targeting of African government domains as well as companies and organizations which were perceived as perpetuating corruption within Africa, as well as organizations that were perceived as supporting or facilitating the use of child labor within Africa. The operation was initially established in early 2011 and its focus has shifted several times since then. A resurgence in OpAfrica activity was detected in late January and early February 2016, prior to the targeting of the Central Bank of Nigeria domain. It was assessed that the targeting of the Central Bank of Nigeria was consistent with the geographical focus of the operation, but the exact motives for it’s targeting were not known. Included in the data were over 100 email addresses. The addresses were randomly sampled by Digital Shadows and those sampled were found to be genuine and publicly available. Within the data, there was reference to the target domain being vulnerable to a “Blind SQL injection”. Additionally, there was some indication that the threat actors had used the “DNSRecon” tool available for Kali Linux. The tool can allow users to enumerate general domain name system (DNS) Records for a given domain as well as other information. This evidence was through the statement “Performing General Enumeration of Domain: cbn[.]gov[.]ng” – consistent with a statement made by DNSRecon when one of its enumeration functions is executed. Phineas Fisher Phineas Fisher is a threat actor who claimed responsibility for widely reported intrusions and subsequent data leaks affecting both the Italian technical surveillance company Hacking Team in July 2015, and Anglo-German spyware company Gamma International UK Ltd in August 2014. The actor is assessed to be ideologically motivated, largely by anti-surveillance sentiment and has conducted at least one attack in response to perceived human rights abuses. However, it was considered possible the actor would target any company, including in the financial sector, perceived as acting unethically. The actor has demonstrated a medium level of capability and their narrow targeting has led us to assess they present a medium threat level. Although the actor is considered a hacktivist, the use of more sophisticated TTPs and the significant impacts they have had against their targets leads us to assess they are a higher threat than most known hacktivist threat actors. Phineas Fisher claimed to have conducted network intrusions against both Hacking Team in July 2015 and Gamma Group UK Ltd. in August 2014. In addition to this, the threat actor leaked data relating to police officers at the Catalan Police Union in response to alleged human rights abuses. In this instance, the threat actor uploaded a video demonstrating the use of an SQL Injection in 5 order to acquire the data. Furthermore, the threat actor claimed to have donated funds allegedly stolen from an unnamed financial institution to Kurdish anticapitalists in Rojava, Northern Syria. Phineas Fisher’s activity has suggested that the threat actor will target companies perceived as acting unethically, as well as on the basis of perceived human rights abuses and for pro-privacy reasons. The actor has provided significant details regarding tools used, tactics, techniques and procedures.1 Phineas Fisher has claimed some high profile victims since August 2014 and continues to be active into 2016. The impact of these incidents has been high for the affected organizations. The capability associated with this actor is assessed as medium, as the tools and techniques used are often freely available tools. Despite a claim to have used a zero-day exploit, this was not confirmed. The actor has also claimed to have written some of their own scripts. The intent of the actor, however, is assessed as high, given the prolonged activity and the targeting of specific entities rather than opportunistic attacks. Overall, however, given the very narrow targeting of the actor, the assessed threat level has been assessed as medium. Cybercrime Cybercriminal activity affecting financial institutions in 2016 has included distributed denial of service extortion, data breaches, business email compromise

Load more