Inside The Mind Of Cyber Criminals

There are some common misperceptions that security professionals have about cybercrime and the people who do it.

Information sharing amongst security specialists is crucial; in the eyes of a criminal, no company is unique. As a rule of thumb, perpetrators will initially cast a wide net and move downstream toward the easiest prey. It’s more likely to become a victim via common attack vector, rather than to experience a highly sophisticated and tailored attack.

On the other hand, security specialists should never underestimate the determination of an attacker. Highly valuable and quickly sold on underground information such as payment, healthcare, and personally identifiable records, as well as sensitive M&A information, must be identified as a targeted asset, quarantined, and stored encrypted. 

The actionable contingency plan must be rehearsed and quickly activated in the case of a breach including a clear response strategy if extortion is attempted. Security professionals must be aware of upcoming threats and successful mitigation practices when establishing a robust and secure network, making sure the proper data backups are in place.

What are some common misperceptions that security pros have about cyber-crime and the people who do it?

The common misperception about cyber criminals we often observe is that it is assumed that illicit actors have diverse skills and experience, allowing them to initiate a wide range of attacks, subsequently earning a hefty amount of money as a result. In reality, the current underground has shifted toward mass plug-and-play automated services, offering the opportunity to participate in illicit activities to a broad number of novice members. Recorded Future has recently identified a survey, conducted among members of a closed underground community, revealing that the majority of cyber criminals are earning a mere $1,000 to $3,000 a month, while only 20% are earning significantly larger amounts of $20,000 a month or more.

Who are these criminals? Are they part of established criminal groups or one-man shows?

For the most part, the largest demographic of members participating in underground communities are lone actors with a clean criminal record and without any ties to organised syndicates. These criminals tend to maintain a stable day job while partaking in illegal activities mostly on an occasional basis. Often these actors are introduced to the life of cyber-crime during their early college years and remain active many years to follow.

A separate and significantly more sophisticated cohort are cyber-criminal syndicates which maintain a strict hierarchy, comprised of highly skilled members, each with a very narrow set of responsibilities.

A typical group is controlled by a single mastermind “boss”, a very intelligent and highly educated person, and includes bankers with extensive connections in the financial industry to arrange money laundering and cash out of stolen funds. 

Additionally, forgers are responsible for fake documents and supporting paperwork and professional project managers oversee the technical aspects of operations, software engineers, and skilled hackers. 

Some groups include ex-law enforcement agents responsible for information gathering as well as counter-intelligence operations.

Team members tend to have strong ties in real life and often are respected members of their communities, viewed by many as successful businessmen and entrepreneurs. The group will often have a diversified investment portfolio and maintain a presence in real estate, hospitality, and auto-related businesses.

Cyber-criminal syndicates don’t regard themselves as ordinary street criminals and rarely cross paths with everyday gangsters, preferring to remain in the shadows and avoid unnecessary attention from both law enforcement and local mafia branches.

However, on certain occasions, requiring the involvement of a vast number of “troopers,” often, related to a large cash-out operations, a one-time project can be launched through a chain of intermediaries.

What types of research do you feel are most beneficial for an enterprise security team?

We have to understand no silver bullet will solve every security problem. An effective security perimeter has to include the combination of:

  • Automated tools responsible for identification of unusual behavior.
  • Alerts on known IOCs and TTPs.
  • Intelligence obtained from underground communities.
  • Response procedures and guidelines.

Direct access to deep and dark web is crucial, but for a variety of safety reasons, might not be a viable option. Hidden criminal communities are not very fond of researchers, and in certain situations, an inexperienced researcher can draw unnecessary attention to the company and put it in danger.

In one of the recent cases, a poorly trained researcher has openly inquired about penetration solutions in newly adopted infrastructure which was tested at a limited number of corporate locations, immediately observing a sudden surge of malicious activity.

To avoid this, we would recommend utilising the help of professional threat intelligence providers that operate undercover on a day-to-day basis and are familiar with all of the complex politics of these communities.

Several providers allow users to research deep and dark web sources in a safe and secure manner, without risking the integrity of the organisation.

Companies also must foster internal security teams, ensuring they are capable of discovering relevant and actionable data as well as stimulating the unrestricted environment, providing the opportunity to initiate counter-measures quickly, and minimising the red-tape procedures.

RecorderdFuture:              Cybercrime Inc. Hackers Model Themselves On Big Business:

 

« Irish Law Firms Experience 50% Increase In Cyberattacks
Snowden Loses In Norway »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Cyber Security Experts Association of Nigeria (CSEAN)

Cyber Security Experts Association of Nigeria (CSEAN)

Cyber Security Experts Association of Nigeria (CSEAN) is a not for profit group of professionals in the field of Information Security in Nigeria and Diaspora.

Raz-Lee Security

Raz-Lee Security

Raz-Lee Security is the leading security solution provider for IBM Power i, otherwise known as iSeries or AS/400 servers.

Garrison Technology

Garrison Technology

Garrison SAVI® is a unique technology for secure remote browsing that can dramatically change the risk profile for enterprise cyber security.

SafeLogic

SafeLogic

SafeLogic provides strong encryption products for solutions in mobile, server, Cloud, appliance, wearable, and IoT environments that are pursuing compliance to strict regulatory requirements.

Pipeline Security

Pipeline Security

Pipeline Security protects businesses with real-time threat data, threat detection & prevention, continuous cyber security monitoring and security analytics.

Zymbit

Zymbit

Zymbit provides hardware security modules (HSM) for IoT devices, including Raspberry Pi and other single board computers.

Octo

Octo

Octo, an IBM company, is a technology firm dedicated to solving the Federal Government’s most complex challenges, enabling agencies to jump the technology curve.

e-Careers

e-Careers

e-Careers is an edtech institution that provides industry recognised courses and up-skilling solutions to individuals and organisations.

ProLion

ProLion

ProLion provides Data Integrity solutions that ensure organisations’ data remains secure, compliant, manageable and accessible.

LogicBoost Labs

LogicBoost Labs

LogicBoost Labs has the expertise, experience, funding and connections to make your startup succeed. We are always interested in new ways to change the world for the better.

Apollo Information Systems

Apollo Information Systems

Apollo is a value-added reseller that provides our clients with the complete set of cybersecurity and networking services and solutions.

CyberconIQ

CyberconIQ

CyberconIQ provide an integrated Human Defense Platform that reduces the probability and/or the cost of a cybersecurity breach by measurably improving our clients risk posture and compliance culture.

Alethea

Alethea

Alethea is a technology company helping companies, nonprofits, and democracies protect themselves from harms stemming from disinformation and social media manipulation.

Buguard

Buguard

Buguard is a multi-award-winning supplier of Application Security Assessments and GRC services.

Cambridge International Systems

Cambridge International Systems

For more than 25 years, Cambridge has been fighting bad actors in both the cyber and physical worlds.

CERT.ar

CERT.ar

CERT.ar is the national Computer Emergency Response Team for the technical-administrative management of computer security incidents in the National Public Sector of Argentina.