Internet Organised Crime Threat Assessment (Iocta) 2017
Total Page：16
File Type：pdf, Size：1020Kb
INTERNET IOCTA ORGANISED CRIME 2017 THREAT ASSESSMENT INTERNET ORGANISED CRIME THREAT ASSESSMENT (IOCTA) 2017 This publication and more information on Europol are available online: www.europol.europa.eu Twitter: @Europol and @EC3Europol PHOTO CREDITS All images © Shutterstock except pages 6, 20, 26, 33, 35, 36, 44 and 59 © Europol. ISBN 978-92-95200-80-7 ISSN 2363-1627 DOI 10.2813/55735 QL-AL-17-001-EN-N © European Union Agency for Law Enforcement Cooperation (Europol), 2017 Reproduction is authorised provided the source is acknowledged. For any use or reproduction of individual photos, permission must be sought directly from the copyright holders. IOCTA 2017 4 IOCTA 2017 INTERNET ORGANISED CRIME THREAT ASSESSMENT CONTENTS IOCTA 2017 5 FOREWORD 7 ABBREVIATIONS 8 EXECUTIVE SUMMARY 10 KEY FINDINGS 12 RECOMMENDATIONS 14 INTRODUCTION 17 AIM 17 SCOPE 17 METHODOLOGY 17 ACKNOWLEDGEMENTS 17 CRIME PRIORITY: CYBER-DEPENDENT CRIME 18 KEY FINDINGS 19 KEY THREAT – MALWARE 19 KEY THREAT – ATTACKS ON CRITICAL INFRASTRUCTURE 25 KEY THREAT – DATA BREACHES AND NETWORK ATTACKS 27 FUTURE THREATS AND DEVELOPMENTS 30 RECOMMENDATIONS 32 CRIME PRIORITY: CHILD SEXUAL EXPLOITATION ONLINE 34 KEY FINDINGS 35 KEY THREAT – SEXUAL COERCION AND EXTORTION (SCE) OF MINORS 35 KEY THREAT – THE AVAILABILITY OF CSEM 36 KEY THREAT – COMMERCIAL SEXUAL EXPLOITATION OF CHILDREN 38 KEY THREAT – BEHAVIOUR OF OFFENDERS 39 FUTURE THREATS AND DEVELOPMENTS 39 RECOMMENDATIONS 41 CRIME PRIORITY: PAYMENT FRAUD 42 KEY FINDINGS 43 KEY THREAT – CARD-NOT-PRESENT FRAUD 43 KEY THREAT – CARD-PRESENT FRAUD 44 FUTURE THREATS AND DEVELOPMENTS 46 RECOMMENDATIONS 46 CRIME PRIORITY: ONLINE CRIMINAL MARKETS 48 KEY FINDINGS 49 KEY THREAT – DARKNET MARKETS 49 FUTURE THREATS AND DEVELOPMENTS 51 RECOMMENDATIONS 51 THE CONVERGENCE OF CYBER AND TERRORISM 52 KEY FINDINGS 53 FUTURE THREATS AND DEVELOPMENTS 54 RECOMMENDATIONS 54 CROSS-CUTTING CRIME FACTORS 55 KEY FINDINGS 56 SOCIAL ENGINEERING 56 CRIMINAL COMMUNITIES AND CRIME-AS-A-SERVICE 58 CRIMINAL FINANCES 60 COMMON CHALLENGES FOR LAW ENFORCEMENT 62 RECOMMENDATIONS 64 THE GEOGRAPHIC DISTRIBUTION OF CYBERCRIME 66 AFRICA 67 THE AMERICAS 68 ASIA 68 EUROPE 69 OCEANIA 69 APPENDIX 72 CYBER ATTACKS IN THE CONTEXT OF/AGAINST ELECTIONS 72 REFERENCES 76 6 IOCTA 2017 INTERNET ORGANISED CRIME THREAT ASSESSMENT IOCTA 2017 7 FOREWORD am pleased to present the 2017 Internet Organised Crime topics to inform the definition of operational actions for EU law Threat Assessment (IOCTA), the fourth annual presentation enforcement in the framework of the EU Policy Cycle. These of the cybercrime threat landscape by Europol’s European include concrete actions under EC3’s three main mandated areas Cybercrime Centre (EC3). – child sexual exploitation online, cyber-dependent crime, and I payment fraud, as well as cross-cutting crime enablers. The report provides a predominantly law enforcement focused as- sessment of the key developments, changes and emerging threats As in previous years, the 2017 IOCTA will inform the setting in the field of cybercrime over the last year. It relies on the invalu- of priorities and help streamline resources within the EU and able contributions of the EU Member States, and our partners in internationally to respond to cybercrime in an effective and private industry, the financial sector and academia, as well as the concerted manner. Law enforcement continues to demon- expert input of Europol staff. strate that a coordinated, intelligence-led and adaptive ap- proach by competent authorities, involving multiple sectors This year’s report highlights how cybercrime continues to grow and partners can result in significant success in preventing and evolve, taking new forms and directions, as demonstrated cybercrime and mitigating its impact. in some of the attacks of unprecedented scale of late 2016 and mid-2017.It further highlights the progressive convergence of cyber and serious and organised crime, supported by a professional underground service economy. The report also describes some of the key challenges faced by law enforcement in terms of investigation and prosecution of cybercrime, highlighting many cross-cutting issues such as e-evidence challenges, and the need for adequate and harmonised legislation to address the specificities of cybercrime. The report goes on to list a number of key recommendations to address Rob Wainwright the phenomenon of cybercrime and identifies several priority Executive Director of Europol 8 IOCTA 2017 INTERNET ORGANISED CRIME THREAT ASSESSMENT ABBREVIATIONS ACS Automated Card Shop IPv4 Internet Protocol version 4 ADSL Asymmetric Digital Subscriber Line IRC Internet Relay Chat AIOTI Alliance for Internet of Things Innovation IRU EU Internet Referral Unit APT Advanced Persistent Threat IS Islamic State APWG Anti-Phishing Working Group ISDN Integrated Services Digital Network AQ al-Qaeda ISP Internet service provider ATM automated teller machine IT information technology AV anti-virus IWF Internet Watch Foundation AVC Automated Vending Card J-CAT Joint Cybercrime Action Taskforce BEC Business Email Compromise KYC Know Your Customer CaaS Crime-as-a-Service LDCA Live-Distant Child Abuse CAM child abuse material LEA law enforcement agency CEO chief executive officer MBR Master Boot Record CERT computer emergency response team MO modus operandi CGN Carrier-Grade Network Address Translation MOTO Mail Order/Telephone Order CI critical infrastructure mTAN Mobile Transaction Authentication Number CJEU European Court of Justice NAT Network Address Translation CNP card-not-present NCMEC National Center for Missing and Exploited Children CSE child sexual exploitation NFC Near Field Communication CSEM child sexual exploitation material NGO non-governmental organisation CSIRT Computer Security Incident Response Team NIS network and information systems CVV Card Verification Value NPS new psychoactive substances DDoS Distributed Denial of Service OCG organised crime group DEA United States Drug Enforcement Agency OPSEC operations security DNS Domain Name System OSINT open-source intelligence DRD Data Retention Directive OTP one-time pad EAST European Association for Secure Transactions P2P peer to peer, or people to people EBF European Banking Federation PBX Private Branch Exchange ECTEG European Cybercrime Training and Education Group PIN personal identification number EC3 European Cybercrime Centre PoS point-of-sale EIO European Investigation Order QKD Quantum Key Distribution EMAS Europol Malware Analysis System RAT Remote Access Trojan EMMA European Money Mule Actions EMPACT European Multidisciplinary Platform Against SCADA supervisory control and data acquisition systems Criminal Threats SCE sexual coercion and extortion EMV Europay, MasterCard and Visa SEPA Single Euro Payments Area ENISA European Union Agency for Network and SGIM self-generated indecent material Information Security SGSEM self-generated sexually explicit material EUCTF European Cybercrime Task Force SIENA Secure Information Exchange Network Application EUIPO European Union Intellectual Property Office SOCTA Serious and Organised Crime Threat Assessment FBI United States Federal Bureau of Investigation SWIFT Society for Worldwide Interbank Financial GAAD Global Airport Action Day Telecommunications GDPR General Data Protection Regulation TAN Transaction Authentication Number GSM Global System for Mobile Communications THB trafficking in human beings HDFS Hadoop Distributed File System Tor The Onion Router I2P Invisible Internet Project UCC United Cyber Caliphate IAP Internet Access Provider URL uniform resource locator ICS Industrial Control Systems VIDTF Victim Identification Task Force ICSE Interpol International Child Sexual Exploitation database VoIP Voice-over-Internet Protocol ICT information & communications technology VPN virtual private network IOCTA Internet Organised Crime Threat Assessment IoT Internet of Things IP Internet Protocol IPC3 Intellectual Property Crime Coordinated Coalition IPR intellectual property rights IOCTA 2017 9 10 IOCTA 2017 INTERNET ORGANISED CRIME THREAT ASSESSMENT EXECUTIVE SUMMARY he 2017 Internet Organised Crime Threat Assessment tems in power plants and heavy industry. However, it is clear (IOCTA) reports how cybercrime continues to grow and that a greater variety of critical infrastructures are more vul- evolve. While many aspects of cybercrime are firmly nerable to ‘every-day’ cyber-attacks, highlighting the need for established, other areas of cybercrime have witnessed a coordinated EU law enforcement and cross-sector response Ta striking upsurge in activity, including attacks on an unprece- to major cyber-attacks on critical infrastructure. dented scale, as cybercrime continues to take new forms and new directions. A handful of cyber-attacks have caused wide- Law enforcement and industry action has led to a decline in spread public concern but only represented a small sample of the use of exploit kits. This has resulted in a shift towards al- the wide array of cyber threats now faced. ternative malware delivery methods, including spam botnets and social engineering. Along with technical attacks, social en- Because of the similar tools and techniques used, it is some- gineering techniques have become an essential tactic for the times difficult to attribute cyber-attacks to particular groups, commission of many, often complex, cyber-dependent and cy- for example, financially motivated cybercriminals and Ad- ber-facilitated crimes, including payment fraud and online child vanced Persistent Threat (APT) groups.