Story image

Interview: The SecureWorks detectives uncovering the 'who and why' of cybercrime

23 May 2017

What is it about financial organisations that makes them attractive targets for cybercriminals? Barry Hensley, SecureWorks' chief threat intelligence officer and Alex Tilley, SecureWorks Counter Threat Unit's E-crime intelligence lead, talked exclusively to SecurityBrief.

Tilley focuses on what he calls the 'who and why' part of cybercrime, working out who they are, how they're evolving and what they're trying to steal while other teams focus on the network analysis.

Hensley is responsible for SecureWorks' Counter Threat Unit, the security analysts and the response team. Together, all three teams work to investigate threats for client protection.

"If we look at the types of malware and various bank customers that it's targeting, often it hits Australia first. When we looked back at previous campaigns it suggested that, but we never had enough evidence. The last two information stealing malware, SecLoader and TrickBot, both started out hitting Australian banks first," Tilley says.

According to SecureWorks, TrickBot targeted 46% of all Australian banks. Tilley says that those banks are good at fraud detection, so perhaps attacks see it as a testbed.

"It's a well-regulated and fairly static banking community here to you can test things. If it works here then it will probably work in most places around the world," he says.

He states that attackers are mostly after banking credentials - individual logins, business banking credentials and wealth management credentials. They then use those credentials to steal funds.

"They're going after where there's a lot of money, rather than consumer accounts. They're after six-figures in a transaction, shifting that off to an intermediary and then off to wherever it goes," he says.

While there are some groups that use credentials for espionage, the main focus is the money. He says that if attackers get a lot of stolen data, it makes sense that they'd use it for other things but by and large, it's definitely financially-motivated.

The Gold Evergreen Group was behind the TrickBot malware, an Eastern European group that has been on the scene in various forms for a long time. Tilley explains that it has evolved from basic phishing to advanced techniques, and they're getting better all the time.

"They're using the latest and greatest way to make their money as they come online. Eventually they were writing their own malware."

The group is widespread in different countries, but Tilley says that the sheer size and dynamic nature of the group is what has kept them alive. It's about what works in the most profitable way.

Moving the focus back to financial services, Tilley says that wealth management platforms should be subject to the same level of scrunity as banks, otherwise attackers will look to wider pastures for their money.

Hensley says that there was a day when organisations could just buy threat intelligence like signature-based counter measures and firewall protection from various vendors and apply them to their own business, but those days have long gone. This is the new world of adversaries.

"Somehow these adversaries have become a SysAd on a network. How do you detect an adversary that has legitimate credentials and is moving laterally undetected based on the security controls? The more sophisticated the threats are, the more opportunities for nation states and adversaries," Hensley says.

On the topic of business email compromise scams, Hensley adds that from a financial perspective, it's interesting to observe that credit unions have relationships with companies to the point of automatic purchase execution. If a CEO is travelling, it opens up opportunities for malicious intent.

"That relationship might be a benefit but in this case it's a risk. Everyone assumes that the email that looked like it was from the CEO wasn't actually the real one," Hensley says.

But no matter who or what the group is, defending against these adversaries is the bottom line. Hensley comments that there have been some knee-jerk reactions to get adversaries out of the network. They then miss other potential points of entry.

With data privacy and data breach notification laws becoming more popular, organisations won't be able to afford knee-jerk reactions and will have to instead focus on better all-round security. They'll also be forced to talk about security, Tilley says.

"People start looking at other countries and asking 'how did they do it, what did they do wrong and how do we get ready for that here," Tilley says.

Hensley adds that it's important for their own company that they need to understand and be the threat experts for their customers. And understanding the tactics that those adversaries use is crucial to SecureWorks' success.

Singapore firm to launch borderless open data sharing platform
Singapore-based Ocean Protocol, a decentralised data exchange that promotes data sharing, has revealed details of what could be the kickstart to a global and borderless data economy.
Huawei picks up accolades for software-defined camera ecosystem
"The company's software defined capabilities enable it to future-proof its camera ecosystem and greatly lower the total cost of ownership (TCO), as its single camera system is applicable to a variety of application use cases."
Aussies too lax about IoT security - McAfee
Aussie consumers are at a loss when it comes to securing the increasing number of connected devices in their homes and are often opting to take no action at all.
Barracuda expands MSP security offerings with RMM acquisition
Managed Workplace delivers an RMM platform with security tools and services, such as site security assessments, Office 365 account management, and integrated third-party antivirus.
Flashpoint: APAC companies must factor geopolitics in cyber strategies
The diverse geopolitical and economic interests of the states in the region play a significant role in driving and shaping cyber threat activity against entities operating in APAC.
Expert offers password tips to aid a stress-free sleep
For many cybersecurity professionals, the worries of the day often crawl into night-time routines - LogMeIn says better password practices can help.
SolarWinds extends database anomaly detection
As organisations continue their transition from purely on-premises operations into both private and public cloud infrastructures, adapting their IT monitoring and management capabilities can pose a significant challenge.
NATO picks BlackBerry's encrypted voice technology to secure calls
The NCI Agency acquires, deploys and defends communication systems for NATO's political decision-makers and command centres