The Internet Organised Crime Threat Assessment (IOCTA) 2015 2 THE INTERNET ORGANISED CRIME THREAT ASSESSMENT (IOCTA) 2015 THE INTERNET ORGANISED CRIME THREAT ASSESSMENT (IOCTA) 2015 3 TABLE OF FOREWORD 5 CONTENTS ABBREVIATIONS 6 EXECUTIVE SUMMARY 7 KEY FINDINGS 10 KEY RECOMMENDATIONS 12 SUGGESTED OPERATIONAL PRIORITIES 15 INTRODUCTION 16 MALWARE 18 ONLINE CHILD SEXUAL EXPLOITATION 29 PAYMENT FRAUD 33 SOCIAL ENGINEERING 37 DATA BREACHES AND NETWORK ATTACKS 40 ATTACKS ON CRITICAL INFRASTRUCTURE 44 CRIMINAL FINANCES ONLINE 46 CRIMINAL COMMUNICATIONS ONLINE 50 DARKNETS 52 BIG DATA, IOT AND THE CLOUD 54 THE GEOGRAPHICAL DISTRIBUTION OF CYBERCRIME 57 GENERAL OBSERVATIONS 62 APPENDICES 67 A1. THE ENCRYPTION DEBATE 67 A2. AN UPDATE ON CYBER LEGISLATION 70 A3. COMPUTER CRIME, FOLLOWED BY CYBERCRIME FOLLOWED BY …. ROBOT AND AI CRIME? 72 4 THE INTERNET ORGANISED CRIME THREAT ASSESSMENT (IOCTA) 2015 FOREWORD These include concrete actions under the three main mandated Threat Assessment (IOCTA), the annual presentation of the areas – child sexual exploitation, cyber attacks, and payment I am pleased to present the 2015 Internet Organised Crime fraud – such as targeting certain key services and products Centre (EC3). offered as part of the Crime-as-a-Service model, addressing the cybercrime threat landscape by Europol’s European Cybercrime growing phenomenon of live-streaming of on-demand abuse of children, or targeted actions with relevant private sector partners ofUsing cybercrime the 2014 for report the asperiod a baseline, under this consideration. assessment Itcovers offers the a cross-cutting crime enablers such as bulletproof hosting, illegal viewkey developments, predominantly changes from a lawand enforcement emerging threats perspective in the based field tradingagainst onlinesites on payment Darknets fraud. and The money report muling also identifies and laundering several on contributions by EU Member States and the expert input of services that require concerted and coordinated international Europol staff, which has been further enhanced and combined law enforcement action. academia. with input from private industry, the financial sector and in supporting the implementation of the proposed The assessment highlights the increasing professionalisation recommendationsI am confident that and operationalthe 2015 IOCTA,actions, willand helpEuropol’s set priorities work of cybercriminals in terms of how attacks are planned and for an international law enforcement response to cybercrime. orchestrated using both new methods and techniques in addition The last 12 months have shown some remarkable successes by to employing well-known attack vectors, and with an increased risk appetite and willingness to confront victims. forward to celebrating further successes as we move towards EU law enforcement in the fight against cybercrime, and I look The report lists a number of key recommendations to address of traditional policing with our partners in the EU and beyond. 2016 with law enforcement continuing to push the boundaries the growing phenomenon of cybercrime and identifies several for EU law enforcement in the framework of the EMPACT Rob Wainwright priority topics to inform the definition of operational actions Policy Cycle. Director of Europol 6 THE INTERNET ORGANISED CRIME THREAT ASSESSMENT (IOCTA) 2015 ABBREVIATIONS IoT Internet of Things AV anti-virus IOCTA Internet Organised Crime AI artificial intelligence APT Advanced Persistent Threat Threat Assessment ATM automated teller machine IP Internet protocol CaaS Crime-as-a-Service ISP Internet service provider CAM child abuse material J-CAT Joint Cybercrime Action Taskforce C&C command and control JIT joint investigation team ccTLD country code top-level domain LE law enforcement CERT computer emergency response team MLAT mutual legal CI critical infrastructure assistance treaty CNP card-not-present MS Member State(s) CP card-present OCG organised crime group CSE child sexual exploitation OSINT open-source intelligence CSECO commercial sexual exploitation P2P peer to peer, or people to people of children online PGP Pretty Good Privacy DDoS Distributed Denial of Service EC3 European Cybercrime Centre PoS point-of-sale EMPACT European Multidisciplinary Platform Against PIN personal identification number Criminal Threats RAT Remote Access Tool EMV Europay, MasterCard and Visa SEPA Single Euro Payments Area EU European Union SGIM self-generated indecent material FP Focal Point SMS short message service I2P Invisible Internet Project SSDP Simple Service Discovery Protocol ICANN Internet Corporation for Assigned Names TLD top-level domain and Numbers Tor The Onion Router ICT information & communications technology UPnP Universal Plug and Play IaaS Infrastructure-as-a-Service URL uniform resource locator IETF Internet Engineering Task Force VoIP Voice-over-Internet Protocol IoE Internet of Everything VPN virtual private network THE INTERNET ORGANISED CRIME THREAT ASSESSMENT (IOCTA) 2015 7 EXECUTIVE SUMMARY shows that cybercrime is becoming more aggressive and confrontational.The 2015 Internet While Organised certain Crime elements Threat of Assessmentcybercrime (IOCTA)such as social engineering have always had an element of interaction between victim and attacker, such contact would typically be of a passive, persuasive nature; otherwise cybercriminals were content to stealthily steal what they wanted with confrontation actively avoided. Today, however, cybercrime is becoming increasingly hostile. Instead of subterfuge and covertness, there is a growing trend of aggression in many cyber-attacks, and in particular the use of extortion, whether it is through sexual extortion, ransomware or by Distributed Denial of Service (DDoS) attacks. This boosts the psychological impact of fear and uncertainty it has on its victims. Whilst the cautious, stealthy approach goes with the stereotype of the uncertain, geeky hacker, the aggressive, confrontational necessitate better sharing of banking malware samples and approach of putting blunt pressure on individuals and businesses criminal intelligence, particularly relating to enabling factors bears the signature of organised crime. such as money mules. Cybercrime remains a growth industry. The Crime-as-a-Service (CaaS) business model, which grants easy access to criminal breach”, with record numbers of network attacks recorded. products and services, enables a broad base of unskilled, entry- AlthoughThe media thiscommonly undoubtedly referred representsto 2014 as thean “Yearactual of increasethe data level cybercriminals to launch attacks of a scale and scope disproportionate to their technical capability and asymmetric in organisations. The perception of how an organisation handles a breachin attacks, – which it also today signifies is considered a change inevitable in attitude – is crucial. by victim This has led to greater publicity and more frequent involvement of Theterms sphere of risks, of costscybercrime and profits. encompasses an extremely diverse law enforcement in such attacks. Nonetheless, is it is evident that data has become a key target and commodity for cybercrime. IOCTA,range of ransomware criminality. In attacks, the context particularly of ‘pure’ cybercrime,those incorporating malware Notably, there is blurring of the lines between Advanced encryption,predictably havepersists grown as ain key terms threat. of scale As andprojected impact in and the almost 2014 unanimously represent one of the primary threats encountered with both camps borrowing tools, techniques and methodologies by EU businesses and citizens as reported by law enforcement Persistent Threat (APT) groups and profit-driven cybercriminals (LE). Information stealing malware, such as banking Trojans, and the criminal use of Remote Access Tools (RATs) also feature Whilefrom each it is possible other’s forportfolios. organisations to invest in technological means heavily in law enforcement investigations. to protect themselves, the human element will always remain as an unpredictable variable and a potential vulnerability. As such social Banking malware remains a common threat for citizens and engineering is a common and effective tool used for anything from complex multi-stage attacks to fraud. Indeed, CEO fraud – where the cybercriminals. A coordinated effort between law enforcement, attackers conduct detailed research on selected victims and their the financial sector alike, whilst generating sizeable profits for behaviour before initiating the scam – presents itself as a prominent required in order to effectively tackle this problem. This will emerging threat which can result in large losses for those affected. the financial sector and the Internet security industry will be 8 THE INTERNET ORGANISED CRIME THREAT ASSESSMENT (IOCTA) 2015 Child sexual exploitation (CSE) online poses major concerns in It is a common axiom that several respects. Hidden services within the Darknet are used technology, and cybercrime as a platform for the distribution of child abuse material (CAM). with it, develops so fast that law The nature of these services drives the abuse of new victims enforcement cannot keep up. because the production of fresh material is demanded for Whilst this may be true in some membership on child abuse forums and it reinforces the status respects, the vast majority of of the contributors. These offences will require more intensive cybercrimes consist of using cooperation and capacity building in jurisdictions where vulnerabilities that were well- they occur.