Today, there is a Silicon Savannah in Nairobi and a computer village in Lagos. They are infrastructure that were unthinkable just a decade ago. And as a result, the continent is brimming with chaotic and innovative energy.

The GDP growth of Africa is expected to reach around 4.1% by 2025. It is easily one of the fastest-growing regions on the planet. It might sound astounding, but if you take into consideration digital architecture, which includes 570 million users along with 855 million mobile data subscriptions, and if you also notice that the mobile money sector in the region accounts for an astonishing 74% of all global mobile money transactions, the maths adds up.

Of course, where there is growth, there are parasites. The hackers and cyber criminals are outpacing the defensive capabilities of the continent. These nefarious individuals and organisations are weaponising the same APIs, mobile payment gateways, cloud platforms, and other technological advancements that are facilitating the financial inclusion of the region.

There are several malicious groups to worry about, such as the local Yahoo Boys and international groups with state sponsorship, like the hacking group Anonymous Sudan.

This is what happens when you have high digital adoption and low cybersecurity maturity. There’s a gap that is perfect for criminals who want to siphon the continent’s economic gains. Nobody really knows how much of the economy is at risk, but there are even studies that claim that cybercrime causes Africa almost 10% of its GDP. There are conservative estimates that are also alarming, which tell us the number is in the billions. And more than money, reputation and structure are at risk.

The stakes can’t get any higher. Africa is trying to emulate the European Union (EU) through the African Continental Free Trade Area. This organisation, like the EU, is trying to bind the continent into a single market where people can move and trade freely. But this ambitious goal is under threat by cybercriminals.

The financial institutions in Nigeria lost over ₦52 billion to fraud in 2024 alone. And South Africa was dog-piled by ransomware attacks, which were striking with precision at its critical infrastructure. This is a theoretical and operational threat that affects everything about the economies of these nations. The breadth of the issue is so wide that it can affect the issuance of Kenyan visas and the stability of the Central Bank of Uganda.

The anatomy of digital boom

If you have to understand the magnitude of the cyber threat to Africa, you have to understand Africa’s digital story, which is unique in the history of economics. The West had to go through industrialisation over centuries, having to go through so many different types of technologies and slowly evolve into the economy it is today. For example, there were copper wires and land lines, desktop computing, and then mobile connectivity in Europe.

But Africa was colonial and far behind the times. When globalisation hit and technology was being transferred to every nook and corner of the world, Africans skipped telegrams, landline telephones, and desktop computers and jumped directly to the age of mobile connectivity. It is called the “leapfrog effect” and is most visible in the financial sector, which happens to be the bedrock of Africa’s identity. Look no further, in today’s sub-Saharan Africa, there are about 1.1 billion homes with registered mobile money accounts. That’s almost half the global total. And in 2024 alone, these platforms processed about 81 billion transactions, which can be valued at a staggering $1.1 trillion.

The mobile-centric architecture democratised finance, and millions of unbanked individuals are now in the formal economy, sending money to relatives in rural villages and paying for solar power or accessing microloans by pressing a few buttons.

Small and medium enterprises benefited greatly from this. Currently, they contribute about 50% of total GDP and constitute 95% of all registered businesses. Unfortunately, these SMEs are most vulnerable to these cyber attacks as they don’t have the resources to defend themselves and aren’t informed enough to take precautions.

The integration of technology into the daily life of common Africans essentially means that a cyber attack on Africa doesn’t just affect corporations and can also disrupt the subsistence of its citizens.

The infrastructure of vulnerability

The nations of Africa have prioritised speed over security when building digital infrastructures. And this is what industry experts call a maturity gap, where technology is built too fast to be secured. The continent’s digital growth is mostly driven by artificial intelligence, application programming interfaces (APIs), and cloud adoption. These technologies facilitate the connection of disparate financial services. However, they do come with systemic risks. For example, a third-party payment processor can be compromised, which would cascade into banks, telecom operators, government portals, and so on. It is a domino effect where all this interconnectivity creates a risk to the economy as a whole.

And the physical infrastructure supporting this massive boom is expanding at an astounding pace. There are investments in undersea cables, such as Google’s Equiano and Meta’s 2 Africa, and there is also a proliferation of local data centres, thus reducing latency and, of course, data costs too.

Security engineers believe that the modernisation of infrastructure, including shared digital infrastructure (SDI), where governments and companies pool resources, broadens the attack surface. The larger the system, the easier it is for it to fall.

The economic calculus of cybercrime

Determining the exact cost of cybercrime in Africa is difficult, as we discussed earlier. The UN Economic Commission for Africa has a disturbing statistic, pinning the losses at 10% of GDP. One must note that Africa’s GDP is around $2.8 trillion, which should imply that almost $300 billion is lost annually. Many economists are skeptical about this data, but if it’s true, it would mean that cybercrime is actually taking away more money than what is required to combat malaria and HIV combined.

INTERPOL doesn’t truly agree with the UN estimates and believes the direct losses must be in the range of $4 billion to $10 billion annually. While this isn’t the jaw-dropping 10% of GDP, it is still 0.15% to 2.13% of total GDP. To put things into perspective, Sierra Leone has a GDP of $4 billion, and this figure is an exact equivalent.

No matter the precise data, it’s an undeniably alarming trajectory. In Nigeria alone, financial institutions lost ₦52.26 billion to fraud in 2024. There was around a 7.63% increase in fraud cases. The attacks are becoming more precise, targeting high-value, high-net-worth individuals or organisations.

They are no longer casting a wide net, but spearing specific whales. The cost of data breaches in South Africa reached $2.95 million in 2034 (one of the highest in the world) before slightly coming down to $2.45 million in 2035, due to better detection technologies.

The spectrum of threats

There is a wide array of attacks ranging from crude, volume-based to highly sophisticated and targeted campaigns. The spectrum can range from a lone hacker in a cafe to a state-sponsored operative from a distant capital.

Ransomware was just a nuisance once upon a time, but it’s one of the most dominant threats in the economy right now, with South Africa and Egypt bearing most of the brunt of the assault.

In 2024, South Africa reported approximately 18,000 ransomware detections, closely followed by Egypt with around 12,000. Both Nigeria and Kenya also experienced significant threats, with thousands of incidents occurring.

Most of the targets are strategic and high-value. Hackers usually target critical infrastructure, government databases, or major financial institutions. And they also encrypt data to paralyse operations of an organisation or individual and demand a ransom for not blackmailing victims with threats to leak their private data to the public. Organisations like Kenya’s Urban Roads Authority (KURA) and Nigeria’s National Bureau of Statistics (NBS) are prime examples of organisations that had to pay due to ransomware attacks.

And then there is business email compromise (BEC) and phishing. Phishing is still the primary vector for initial access. Phishing victims in Africa rose from 26% to 32% in 2024. In BEC attacks, which usually follow phishing, fraudsters compromise legitimate email accounts of executives or finance officers and authorise fraudulent wire transfers. It’s most prevalent in West Africa, where there are criminals who have honed their skills over decades.

Digital sextortion is one of the worst forms of cyberattacks. Criminals often use explicit images generated with AI to blackmail victims. With the rise of AI, criminals no longer need real photos; they can use deepfake technologies to blackmail anyone sensitive about their public image. This can disproportionately affect women and public figures.

And finally, there is DDoS. DDoS, or distributed denial of service attacks, has moved beyond vandalism to become a real tool of geopolitical coercion. The high-profile attack by Anonymous Sudan against Kenya’s digital infrastructure in 2023 and 2024 exemplified this shift. Although they claim those attacks were political and for the benefit of the nation of Sudan, security researchers believe Anonymous Sudan may have ties to Russian cybercrime ecosystems like KillNet. This connection was observed when they targeted Kenya’s eCitizen platform, M-PESA services, and power utilities. The attack was so humiliating for Kenya because they were issuing digital visas, which no longer worked, and they had to roll back to issuing visas on arrival. It caused so much chaos in Nairobi without even firing a shot.

Of course, things are at their worst when there is a spy or a colluder in your organisation. For example, Access Bank in Nigeria lost over 800 million Naira because of an employee who was colluding with cybercriminals. If you have underpaid or disgruntled employees, criminals might recruit them to work as insiders.

The insider threat is very difficult to detect because no amount of sophisticated monitoring of the digital infrastructure is going to prevent internal sabotage. Employees might be tempted to sell their credentials if they are going to be paid much more by a criminal than by their employer, especially in poor regions like Africa.

The future of defence

The future of cybersecurity is defined by the sovereignty of data. We are going to see a lot of data nationalism rise, where nations demand that their data be stored locally. This might complicate the operations of global tech giants, but it will spur the growth of local cloud infrastructure.

Rwanda’s Data Governance Policy is a good example of this. However, we are playing a game of catch-up as quantum computing is moving too fast; any current encryption standard is easily overcome by hackers in a matter of weeks or months. Even if Africans use the current technology available in Europe, by the time they implement it, they will be left behind by all the technological advancements happening in the world and adopted by malicious actors. If they want to be ahead of the game, they have to prepare for post-quantum cryptography.

Experts like Dr. Bright Gameli Mawudor predict that attacks will be fully automated, meaning the hacker will be an AI in the near future rather than a human being. He also warns that automated scripts could theoretically compromise national central banks if there are vulnerabilities, suggesting that the future of war is going to be machine against machine, where humans are either spectators or victims.

The post The cyber threat to Africa’s digital boom appeared first on International Finance.

“Project Infinity” is made up of several task forces that make sure the billions of Galaxy smartphone users around the world are safe from the ever-increasing threat of cybercrime.

A Cyber Threat Intelligence (CTI) taskforce and three separate teams—Red, Blue, and Purple—are at the centre of Project Infinity. These organisations work in secret to stop and lessen cyberattacks, operating throughout the world in nations like Brazil, Poland, and Vietnam.

From proactive threat detection to developing and implementing defensive measures, each team has a distinct role. The public is largely unaware of their work; it only becomes apparent when the user’s device receives a security patch.

By spotting possible cyber threats, the CTI task force makes sure that hackers can’t take advantage of weaknesses in Galaxy devices. In search of evidence of illegal activity, such as malware or stolen data, the team searches the Deep Web and Dark Web.

The team can detect and eliminate threats while working with other departments to implement security updates by examining system behaviours, such as odd data requests or suspicious network traffic.

“Occasionally, we engage in security research by simulating real-world transactions. We closely monitor forums and marketplaces for mentions of zero-day or N-day exploits targeting Galaxy devices, as well as any leaked intelligence that could potentially serve as an entry point for system infiltration,” Justin Choi, Vice President and Head of the Security Team, Mobile eXperience Business at Samsung Electronics said, as reported by TechRadar.

The Red and Blue teams at Samsung’s security operation mimic attacks and defences, respectively, to emulate military-style strategies. Through techniques like “fuzzing,” which involves throwing random data at software, these professionals can find hidden vulnerabilities that might otherwise go unnoticed. The Blue team, on the other hand, works tirelessly to develop and implement patches that protect against these vulnerabilities.

The Purple team combines the expertise of both Red and Blue teams, focusing on critical areas of Galaxy’s security infrastructure. They also work with external security researchers to ensure no potential weak spot goes unnoticed.

The post Project Infinity: All you need to know about Samsung’s classified security operation appeared first on International Finance.

Not to be confused with the deep web (the part of the Internet not indexed by search engines), the dark web is a part of the deep web and is used for many reasons: maintaining privacy, circumventing censorship, or providing an enabling space for criminal activity (cybercrime tools, trading data or illicit materials).

Dark web: A threat to financial sector

Businesses

Increased ‘cyberization’ has been integral to the financial sector over recent decades and cyberthreats have increased in step, directly impacting the operational risks faced by the financial industry. The dark web provides an enabling facilitator for these cyberthreats.

For example, hacker forums on the dark web can share expertise or coordinate attacks in relative anonymity, syphoning funds or stealing data. Ransomware attacks can be executed on the dark web preventing lawful access until a ransom is paid. In fact, ‘Ransomware-as-a-Service’ is readily available on the dark web.

The dark web can also facilitate DDoS (Distributed Denial of Service) attacks; denial of access to financial services in such a time-sensitive sector has a significant negative impact, operationally and financially.

Consumers

Consumers hold and transact multiple financial assets online and use their identities to access these assets. The identity of a consumer online is often simply a collection of data points others don’t know. Such data points include password credentials, card details, dates, addresses, relationships, history etc. With enough of these data points, a person’s identity can be reconstructed online to gain access to the assets illegally. Obtaining these pieces of data is made much easier when there is a market where missing bits can be bought and sold in anonymity. This is, once again, where the dark web comes in.

The financial sector holds a wealth of such data for its consumers, since it collects the data to enable its service offerings while also maintaining regulatory obligations. Financial institutions are therefore valuable targets of cybercriminals who use the dark web to plan and execute data theft. At the same time, the dark web enables them to monetise the stolen data.

Malware that directly infects users’ computers and steals banking credentials is also sold on the dark web. It captures keystrokes or creates backdoors for later exploitation, leading to the loss of assets and consumer trust.

Consumer trust is crucial in the financial sector. Illegal activities on the dark web can erode trust and damage reputation, significantly impacting the financial industry.

Capital markets

Exploiting inside information, commonly referred to as UPSI (Unpublished Price Sensitive Information), undermines trust and investment in capital markets. The dark web enables buying and selling inside information in secrecy which also hurts the regulatory ability to curtail insider information. In response to such challenges, regulators have required the maintenance of Structured Digital Databases to track the flow of all UPSI from the source.

Impact on risk capital

The higher the risk, the more capital the financial sector must set aside to manage it. The impact of operational risks in the financial industry cannot be considered complete without considering the contribution of the dark web in increasing the cyberthreat quotient. Cybercriminals who are yet to achieve the required levels of sophistication can also avail of ‘cybercrime-as-a-service’ on the dark web, increasing the number of ‘threat actors’ and the resultant risks. With the increase in risks comes an increase in the need to hold regulatory capital in reserve, reducing the capital otherwise available for use and ultimately hurting the financial sector.

Threat quotient in financial sector

The threat from the dark web to the financial sector as the primary but anonymous facilitator of tools, resources, expertise, and services continues to increase. In addition, attacks on other sectors can also impact the financial industry. For example, sensitive information belonging to 815 million Indians recently emerged on the dark web, brought by a hacker described as ‘pwn0001’, advertising the stolen information on the dark web. While the financial sector is not believed to be the source, misuse of such data can nonetheless compromise its consumers.

In the future, the influence of the dark web is expected to grow. A marketplace called STYX was introduced on the dark web in early 2023, offering services primarily related to financial fraud. These services include the sale of identities, money laundering, DDoS attacks, bypass mechanisms for 2FA, and distribution of malware, among others. The increasing threat quotient of the dark web to the financial sector rightly deserves greater attention. Simply put, there is little alternative.

The post Erosion of trust: Dark web’s financial fallout appeared first on International Finance.

This treaty will be the first global legally binding instrument on cybercrime and is expected to be implemented by the UN General Assembly later in 2024.

The primary purpose of the treaty is to address the new methods and opportunities that technology has provided to criminals, including activities such as terrorism, drug trafficking, migrant smuggling, and firearms trafficking.

The draft cybercrime convention was formulated by a collaboration of civil, academic, and private organisations across UN member states, with the United Nations Office on Drugs and Crime (UNODC) providing substantive secretariat support.

UNODC Executive Director Ghada Waly said, “The finalisation of this Convention is a landmark step as the first multilateral anti-crime treaty in over 20 years and the first UN Convention against Cybercrime at a time when threats in cyberspace are growing rapidly.”

“I congratulate Member States and the Ad Hoc Committee, under the leadership of Ambassador Faouzia Boumaiza-Mebarki as Chair and a strong representative of women diplomats, for guiding negotiations and reaching consensus on the final text. UNODC is immensely proud to have supported the negotiation process and to serve as the Secretariat of the Convention,” she added.

“We will continue to play a central role in assisting in the implementation and ratification of the Convention, once adopted by the General Assembly, as well as providing technical assistance to Member States, as we work with all countries and partners to safeguard digital spaces,” Ghada Waly concluded.

The post United Nations drafts new treaty to combat cybercrime appeared first on International Finance.

“LockBit ransomware is malicious software designed to block user access to computer systems in exchange for a ransom payment. LockBit will automatically vet for valuable targets, spread the infection, and encrypt all accessible computer systems on a network. This ransomware is used for highly targeted attacks against enterprises and other organisations,” States Kaspersky.

LockBit attackers have been on the news frequently for threatening global organisations, disrupting their operations, extorting the victims financially, stealing data and illegally publishing them on the dark web.

LockBit has transformed itself into a subclass of ransomware known as a ‘crypto virus’ due to its ability to form its ransom requests around financial payment in exchange for decryption. The element focuses mostly on enterprises and government organisations rather than individuals.

“Attacks using LockBit originally began in September 2019, when it was dubbed the “.abcd virus.” The moniker was in reference to the file extension name used when encrypting a victim’s files. Notable past targets include organisations in the United States, China, India, Indonesia, and Ukraine. Additionally, various countries throughout Europe (France, UK, Germany) have seen attacks,” Kaspersky commented.

“Viable targets are ones that will feel hindered enough by the disruption to pay a heavy sum — and have the funds to do so. As such, this can result in sprawling attacks against large enterprises from healthcare to financial institutions. In its automated vetting process, it seems to also intentionally avoid attacking systems local to Russia or any other countries within the Commonwealth of Independent States. Presumably, this is to avoid prosecution in those areas,” the cybersecurity firm added further.

LockBit functions as ransomware-as-a-service (RaaS). Willing parties put a deposit down for the use of custom for-hire attacks, and profit under an affiliate framework. Ransom payments are divided between the LockBit developer team and the attacking affiliates, who receive up to three-fourths of the ransom funds.
How LockBit hit the news?

As recent as May 2024, reports emerged about the cybercriminals targeting American aviation giant Boeing using the LockBit ransomware platform in October 2023, during which these threat actors also demanded a $200 million extortion payment.

Boeing reportedly did not pay any ransom to LockBit after roughly 43 gigabytes of company data was posted to LockBit’s website in November 2023, according to BleepingComputer. Boeing, however, confirmed a “cyber incident” and said the incident was impacting elements of its parts and distribution business. The company refrained from commenting publicly in detail about the incident. However, they eventually admitted the episode during a US Justice Department indictment, which identified Dmitry Yuryevich Khoroshev as the main administrator and developer behind the LockBit ransomware operation.

“The reference in the indictment to the unnamed company (read Boeing) was an example of the ‘extremely large’ ransom demands made by Khoroshev and his co-conspirators, as they racked up more than $500 million in ransoms paid by victims since late 2019 or early 2020,” Cyberscoop reported further.
“I believe this may be the second biggest ransom demand to date — or, perhaps more accurately, to have become public knowledge,” said Brett Callow, a ransomware analyst with the cybersecurity firm Emsisoft, while interacting with Cyberscoop.

Callow said that it was “unlikely” that LockBit “had the ability to accurately determine just how sensitive that data was — or how much Boeing may be willing to pay to prevent it being published — and so made a ridiculously high demand simply to see what would happen. They probably had no realistic expectation of actually being paid that amount.”

LockBitSupp, the online persona that communicates with journalists and others online on behalf of LockBit, also confirmed to CyberScoop that Boeing was the unnamed company.

“US and British law enforcement authorities said that Khoroshev is LockBitSupp. A message posted to LockBitSupp’s account on the messaging platform said the authorities identified the wrong person,” Cyberscoop commented further.

Meet Dmitry Yuryevich Khoroshev

Has LockBitSupp played a mind game by stating Khoroshev as the “Wrong Person?” There is no definitive answer to this question, except the fact that the Russian individual we are talking about has been named by the American and British law enforcement authorities behind the LockBit ransomware attacks.
The Wired states, “LockBitSupp has evaded identification and bragged that people wouldn’t be able to reveal their offline identity—even offering a $10 million reward for their real name.”

Law enforcement’s linking of Khoroshev to LockBitSupp comes after the UK police infiltrated the LockBit group’s systems and made several arrests—taking its servers offline, gathering the group’s internal communications, and putting a stop to LockBit’s hacking spree. The law enforcement takedown, dubbed “Operation Cronos” and led by the UK’s National Crime Agency (NCA), has essentially neutralised the hacking group and sent ripples through the wider Russian cybercrime ecosystem. Not only Boeing, LockBitSupp even targeted sandwich chain Subway.

In addition to being named, Khoroshev has also been sanctioned by the US, UK, and Australia. According to the United States Office of Foreign Assets Control, Khoroshev is 31 and lives in Russia, with details of his sanction designation also listing multiple email addresses and cryptocurrency addresses, alongside his Russian passport details. Washington has also filed an indictment against him.

The indictment says Khoroshev has acted as the LockBit group’s “developer and administrator” since around September 2019, designing and developing its “control panel” used within ransomware attacks. The LockBit group managed to extort at least $500 million from victims in 120 countries, including Khoroshev’s home country Russia. The indictment further says that he received around $100 million from this activity.

In early 2024, before the crackdown by Western authorities, LockBit had risen to become one of the most prolific ransomware groups ever, launching hundreds of attacks on a monthly basis and ruthlessly publishing stolen data from companies if they refused to pay.

As per the Wired, investigators are also starting to unpick more details about the scale and scope of LockBit’s operations. An unnamed UK National Crime Agency (NCA) senior investigating officer, who is involved with the probe, says LockBit listed 2,350 victims publicly on its leak site up to the end of December 2023, but that this is just a small fraction of its hacking activity.

Judging gravity of the situation

As per Kaspersky, LockBit attacks are self-spreading in nature, when they target an organisation, meaning they don’t require manual direction from the human threat agents. The attacks don’t happen in a scattershot manner like spam malware, and the acts can be conducted through tools like Windows Powershell and Server Message Block (SMB).

During the attack stage, LockBit can self-propagate itself, meaning the malware spreads on its own. In its programming, LockBit is directed by pre-designed automated processes. This makes it unique from many other ransomware attacks that are driven by manually living in the network, sometimes for weeks, to complete reconnaissance and surveillance tasks.

“After the attacker has manually infected a single host, it can find other accessible hosts, connect them to infected ones, and share the infection using a script. This is completed and repeated entirely without human intervention,” Kaspersky described the nature of LockBit attacks exactly in these words.

“Furthermore, it uses tools in patterns that are native to nearly all Windows computer systems. Endpoint security systems have a hard time flagging malicious activity. It also hides the executable encrypting file by disguising it as the common .PNG image file format, further deceiving system defences,” it added further.

Breaking down the stages of LockBit attacks, the initial breach looks much like other malware attacks. An organisation may be exploited by social engineering tactics like phishing, in which attackers impersonate trusted personnel or authorities to request access credentials. Equally viable is the use of brute force attacks on an organization’s intranet servers and network systems. Without proper network configuration, attack probes may only take a few days to complete. Once LockBit makes its way into the network, the ransomware prepares the system to release its encrypting payload across every device it can.

In stage two, LockBit infiltrates deeper to complete the attack setup if needed. From here onwards, the LockBit programme directs all activity independently.

“It is at this stage that LockBit will take any preparative actions before deploying the encryption portion of the ransomware. This includes disabling security programmes and any other infrastructure that could permit system recovery,” it continued further, while adding, “the goal of infiltration is to make unassisted recovery impossible, or slow enough that succumbing to the attacker’s ransom is the only practical solution. When the victim is desperate to get operations back to normal, this is when they will pay the ransom fee.”

In the third stage, the malware deploys the encryption payload. Once the network has been prepared for LockBit to be fully mobilised, the ransomware will begin its propagation across any machine it can touch. A single system unit with high access can issue commands to other network units to download LockBit and run it.
The encryption portion will place a “lock” on all the system files. Victims will only be able to unlock their systems via a custom key created by LockBit’s proprietary decryption tool. The process also leaves copies of a simple ransom note text file in every system folder. It provides the victim with instructions to restore their system and has even included threatening blackmail in some LockBit versions.

“With all the stages completed, the next steps are left up to the victim. They may decide to contact LockBit’s support desk and pay the ransom. However, following their demands is not advised. Victims have no guarantee that the attackers will follow through on their end of the bargain,” Kaspersky remarked.

Rise of LockBit

The malware first emerged in 2019 as a fledgling “ransomware-as-a-service” (RaaS) platform. Under this setup, a core handful of individuals, organised by the LockBitSupp handle, created the group’s easy-to-use malware and launched its leak website. This particular group is still reportedly licencing LockBit’s code to “affiliate” hackers who launch attacks and negotiate ransom payments, eventually providing LockBit with around 20% of their profits.

Despite launching thousands of attacks, the group, in its starting days, maintained a low-profile, compared to other threat actors. Over time, as the malware started to dominate the cybercrime ecosystem, its members became more brazen and careless. As per an unnamed NCA senior investigator, these individuals pulled data about 194 affiliates from LockBit’s systems and were piecing together their offline identities.

The NCA investigator further pointed out “numerous” examples of the LockBit administrator directly “taking responsibility” for high-profile/high-ransom negotiations after affiliates had initially attacked the companies or organisations.

The US DOJ indictment claims Khoroshev, as LockBitSupp, kept a close track of his affiliates, keeping databases of each affiliate and the victims they had targeted. In some cases, the Russian demanded identification documents from his affiliate co-conspirators, which he also maintained on his infrastructure.
Jon DiMaggio, a researcher at cybersecurity firm Analyst1, who has been aggressively researching LockBit, apart from communicating with the LockBitSupp handle, told Wired, “He (Khoroshev) treated it like a business and often sought out feedback from his affiliate partners on how he could make the criminal operation more effective.”

“The LockBitSupp character would ask affiliates what they needed in order to more effectively do their work. He did not simply take money for himself, but he reinvested it into developing his operation and making it more desirable to criminals,” DiMaggio noted.

DiMaggio says the person he was speaking to privately using the LockBitSupp moniker was “arrogant but all business and very serious,” apart from sending cat stickers as part of chats.

“Publicly, on Russian language cybercrime forums where hackers trade data and discuss hacking politics and news, LockBitSupp was entirely different. The persona he amplified on the Russia hacking forums was a mix of a supervillain and Tony Montana from Scarface. He flaunted his success and money, and it rubbed people the wrong way at times,” DiMaggio continued further.

“In addition to setting a bounty on their own identity, LockBitSupp’s more innovative and erratic side also organised an essay-writing competition on the hacking forums, offered a bug bounty if people found flaws in LockBit’s code, and said they would pay $1,000 to anyone who got the LockBit logo as a tattoo. Around 20 people posted pictures and videos of their tattoos,” Wired continued.

Immediately after law enforcement claimed to reveal LockBitSupp’s identity, DiMaggio published new research about Khoroshev. Using a tip he received, plus open source intelligence and leaked dark web information, DiMaggio found social media profiles and extra personal information allegedly linked to the Russian national.
LockBitSupp was reportedly banned from two prominent Russian-language cybercrime forums in January 2024 after a complaint was made about their behaviour.

And the downfall finally came

In February 2024, an international task force of law-enforcement agencies from 10 countries, dubbed “Operation Cronos,” disrupted LockBit’s operations. LockBit’s technical infrastructure and its public-facing leak site on the dark web were seized after a months-long operation.

On 20 February, the NCA published details of the operation, and replaced content on the LockBit website, with an expose on LockBit’s operations and capabilities, including decryption keys, news of two arrests and a $10 million reward for information on ‘LockBitSupp’.

However, the battle was far from over, as it took LockBitSupp only five days to create replica versions of the group’s leak site. The website then started to be filled with apparent victims and it seemed like the LockBit group hadn’t been impacted by having all of its internal secrets accessed by Law enforcement agencies.
The NCA says the number of LockBit affiliates has dropped to 69 since its February takedown, while the DOJ indictment says LockBit’s victim count has “greatly diminished” since then.

What to expect now?

As per the DOJ indictment, post “Operation Cronos,” Khoroshev got in touch with law enforcement, in an attempt to “stifle his competition.”

“He offered his services in exchange for information regarding the identity of his RaaS competitors. Specifically, Khoroshev asked law enforcement during that exchange to, in sum and substance, give me the names of my enemies,” the indictment mentioned further.

Ahead of law enforcement naming Khoroshev, a countdown appeared on the website, and LockBitSupp responded by publishing scores of victims.

“LockBitSupp has a lot of enemies and people waiting to take his place,” said DiMaggio, the Analyst1 researcher, while adding that the group would unlikely stop their actions.

As per the NCA, the task force has seized LockBit’s bespoke data exfiltration tool, Stealbit, which was based in three countries and used to steal data, as well as 28 servers belonging to the group’s affiliates.

Europol, on the other hand, coordinated the arrest of two LockBit members in Poland and Ukraine and froze 200 cryptocurrency accounts linked to the group.
In the United States, indictment charges were brought against Russian nationals Artur Sungatov and Ivan Kondratyev, aka ‘Bassterlord’, for using LockBit against businesses globally.

Operation Cronos has also obtained more than 1,000 decryption keys, which can help victims recover their data. All these coordinated actions from the legal authorities are hitting LockBit hard. How long will the group remain defiant? Let’s wait and watch.

The post LockBit ransomware: The global cyber menace appeared first on International Finance.

One of the cardinal rules of password creation is avoiding the inclusion of information that can be easily guessed. When it comes to social engineering, names of family members, pets, or important events are a gold mine for hackers. They can quickly determine these facts from public information and social media profiles.

The best approach is to employ unrelated words, perhaps from different languages or domains that have personal significance to you but would be impossible for outsiders to deduce. This not only increases the complexity of your password but also gives it a sentimental undertone that helps it stand out in the crowd.

Although the idea of complexity could make you think of a convoluted maze, establishing a strong password can be a skilful endeavour. A routine string of characters becomes a powerful shield when a variety of capital and lowercase letters, digits, and special characters are used.

It’s important to note that one popular tactic used by hackers is replacing letters with similarly-looking numbers or symbols while following recognisable patterns, such as replacing “E” with “3” or “A” with “@”. So, individuality is crucial. You can start with a line from your favourite book or movie and build on it with these variations to create a genuinely original and complex password.

In the realm of password strength, length, which is frequently ignored, is an unsung hero. The longer a password, the harder it is for brute force methods to crack a password. Experts advise using at least 12 characters, but if the platform allows it, it’s wise to use more.

Making a passphrase, which is a string of seemingly unconnected phrases strung together, is a useful strategy. This method makes passwords longer while simultaneously making them easier to remember, so there’s no need to write them down or keep them insecurely.

There are several online accounts and services available in the contemporary digital environment, and each one needs a password. A serious error is making the mistake of using the same password on many platforms. If one gets into the wrong hands, it’s like using the same key for your house, car, and safe deposit box—it invites tragedy.

Consider using a password manager to combat this. The burden of memorising several different passwords is reduced by these programmes, which generate, store, and automatically fill complex passwords for various platforms.

You might find ideas for secure passwords by browsing your bookshelves or music collection. Choose a favourite passage from a book or some song lyrics, then change it using numbers and other unique characters. For instance, the Shakespearean phrase “To be or not to be, that is the question” could be changed to “2B0rN2B*t1stheQ!” This method not only results in a strong password but also adds a little personality to your online security.

The context and usage of a password are just as important as its actual foundation. Simple patterns like “123456” or “qwerty” should be avoided, but many people do so because of convenience. The usage of simple-to-guess sequences like “asdfgh” or “zxcvbn” is equally perilous. Hackers use automated systems that repeatedly cycle through these known combinations to quickly compromise accounts. Use your imagination to come up with a combination that defies convention in order to foil such attempts.

In the age of information sharing, scepticism is your ally. Genuine businesses will never email you or use another kind of communication to ask for your password. Watch out for phishing schemes that pose as reliable organisations and ask for your login information.

Genuine password reset procedures take place on the official website or application. You should be suspicious of any unsolicited communication that requests your password and report it right away.

Regular password updates are one of the proactive methods to protect digital security. By routinely changing your passwords, you thwart any potential unauthorised access and invalidate any stolen passwords. When updating passwords, refrain from merely modifying your existing ones. Instead, create a new password that abides by the rules of originality, difficulty, and length. Despite the fact that this procedure may appear onerous, it is a tiny price to pay for the protection of your internet reputation.

The powerful tool is called two-factor authentication (2FA) in the war against unauthorised access. By using a code often given to your mobile device, it adds an additional degree of security on top of the password.

The requirement for this second piece of information makes it extremely difficult for hackers to access your account, even if your password is hacked. Take advantage of the opportunity to strengthen your defences whenever a platform supports 2FA.

The “diceware” method of creating passwords is a less popular but very powerful technique. It entails choosing words from a predetermined list using a dice roll, and then combining those words to create a passphrase. As a result, a seemingly random yet memorable string of words that goes above and beyond standard password norms is created. This strategy perfectly balances personalisation and unpredictability.

Cybercrime overview

Threats to cyber security have grown in recent years on a global scale. Cybercriminals benefited from misaligned networks during the pandemic as businesses shifted to remote working environments. Malware attacks rose 358% in 2020 compared to 2019. From 2020, cyberattacks climbed by 125% globally through 2021, and in 2022, rising cyberattack volumes continued to endanger both enterprises and individuals.

The landscape of cyber threats has been significantly impacted by the Ukraine war. Russian-based phishing assaults against email addresses of companies with headquarters in Europe and the US have multiplied eight-fold since the war’s beginning. In the 2022 first quarter, there were breaches affecting about 3.6 million Russian internet users, an 11% rise from the previous quarter.

The UK started the ‘Ukraine Cyber Programme’ in 2022 to aid in defending Ukrainian critical infrastructure against Russian threats. As the war started, the UK promptly activated a £6.35 million package to combat the Russian cyber operations. This programme offers an incident response to defend Ukrainian government institutions from assaults, DDoS protection so that people in Ukraine can still access vital information, and firewalls to stop assaults.

The most frequent type of internet crime is still phishing. Around 323,972 online users reportedly fell for phishing scams in 2021. This indicates that 50% of the users whose data was compromised, fell victim to a phishing scam. During the pandemic’s peak, phishing incidents increased by 220%.

Phishing has the lowest loss to victims despite being common. Phishing assaults cost victims an average of $136 each. This is considerably less than the $12,124 average cost of a data breach. For the most recent details on international phishing trends, visit our page on phishing statistics. Investment fraud was the most expensive type of cybercrime in 2022, with an average loss of $70,811 per victim. There is little doubt that data breaches are becoming more frequent and expensive. The victim count has climbed from six victims per hour to 97 victims per hour since 2001, a 1517% increase in 20 years.

It is evident that COVID-19 had an impact on the daily victims. According to statistics on cybercrime from 2019, 53 victims were reported every hour. The hourly victims soared to 90 in 2020, the pandemic’s first full year, a 69% rise.

Additionally, the average cost of data breaches per hour has gone up globally. The average hourly cost to individuals in 2001 was $2054. The hourly loss rate has since risen, reaching $787,671 in 2021.

As workplace changes and increasingly sophisticated infiltration techniques give cybercriminals more confidence, the cost of data breaches to enterprises has been rising significantly. Businesses spent $4.35 million on average in 2022 as a result of data breaches, up from $4.24 million in 2021.

More companies are taking cybersecurity seriously as a result of the rising threat to enterprises around the world. Around 73% of Small and Medium-Sized Businesses (SMBs) concur that there is an urgent need for action on cybersecurity issues, and 78% plan to raise their spending on cybersecurity over the next 12 months.

The fact that 67% of SMBs believe they lack the internal expertise to handle data breaches is a worrying number. The fact that more SMBs are collaborating with managed service providers for cybersecurity—89% as of 2022, up from 74% in 2020—helps to reduce this problem.

Supply-Chain attacks

As technology advances, supply networks are getting more integrated and complex. However, security flaws in one company can make connected partners vulnerable. Up to 40% of cyber threats now arise indirectly through the supply chain, and cybercriminals are taking advantage of these vulnerabilities.

Research shows that because of the rising time demands of greater digital connections, cybersecurity leaders are burnt out and in an ‘always on’ state.

This tiredness is being exploited by cybercriminals. According to research, only 23% of security leaders continuously check for cybersecurity vulnerabilities among their partners and vendors.

Additionally, many firms only allow their direct suppliers and vendors to be covered by third parties. This leaves out their larger network of clients, collaborators, investors, and other stakeholders.

Awareness of third-party risk is increasing. According to estimates, 60% of firms will consider cyber security risk when making decisions about transactions and business activities with third parties by 2025. The concern of C-Suite executives regarding supply chain risks is also shown by recent studies.

Around 60% of the 900 businesses surveyed said supply chain attacks were the most likely forms of cyberattacks to target their company. This is comparable to DDoS attacks, higher than APT and cyber espionage but lower than ransomware and data theft.

At last, the digital era demands a diligent approach to cybersecurity. A key component of this defence is the creation of strong passwords, which act as a virtual lock to protect the wealth of our online lives.

We can build impenetrable defences against malice by embracing complexity, length, variety, and creativity. Being aware of changing security procedures like two-factor authentication and diceware passphrases allows us to stay one step ahead of those looking to take advantage of our weaknesses.

The post Mastering password security like a pro appeared first on International Finance.

Ella Irwin, the vice president of trust and safety at Twitter, left the organization. A.J. Brown, the organization’s head of brand safety and ad quality, and Maie Aiyed, a program manager who handled brand-safety relationships, reportedly resigned after Irwin left.

It has been close to a year since Elon Musk completed the $44 billion acquisition of Twitter, an investment which has so far proven to be a colossal loss for the maverick tech billionaire. He has significantly downsized the company’s employees and reversed content distribution-related restrictions. As a result, several companies stopped or reduced their advertising expenditures.

According to the 2023 Axios Harris reputation rankings, Twitter under Elon Musk is the fourth-most-despised brand in the United States. And the scepticism around his ownership of Twitter keeps growing.

Since Elon Musk took control, phishing attempts against Twitter (now rebranded as X) have increased. The changes to the ‘Twitter Blue Premium Verification’ service have given threat actors a pretext to steal users’ login information.

Researchers at cybersecurity vendor Proofpoint have noticed an upsurge in Twitter-related phishing attacks. According to the Proofpoint team, numerous advertisements have employed enticements relating to Twitter verification or the new Twitter Blue offering, such as “Twitter Blue Badge Billing Statement Available.”

After taking over the company, Elon Musk added an $8 monthly fee for the ‘Twitter Blue’ service. He has guaranteed that tweets from verified users will be prioritized on Twitter feeds. Users who paid were verified with the website’s well-known blue tick. The plan has been suspended, nevertheless, due to several spoof account issues.

Twitter and phishing attempts

Twitter phishing attempts use URLs that redirect to criminal infrastructure in addition to Google Forms for data harvesting. Vice President of threat research and Detection Sherrod DeGrippo stated, “These initiatives typically target members of the media and the entertainment industry, including journalists and Twitter users who have the appearance of being verified. Frequently, the email address is the same as the Twitter handle used, or it may be found in the user’s Twitter bio.”

“While we have occasionally seen Twitter credential phishing employing lures linked to verification from cybercrime threat actors in the past, the activity has picked up recently,” the official added further.

In the past, TA482, a hacker gang, has frequently used Twitter-related phishing to target media users. But research published in July 2023 by Check Point Research claimed that delivery service DHL is the most impersonated company for phishing scams, followed by Microsoft and LinkedIn. When it comes to the most-targeted brands for these kinds of attacks, Twitter (rebranded as X) does not even make the top ten.

DeGrippo stated further, “To maximize the possibility that a user would interact with social engineering content, cybercriminal threat actors frequently exploit themes connected to important news stories and relevant to people’s interests.”

Even if Twitter and the social media platform are currently quite active, acquiring access to accounts is still profitable. Twitter accounts that are legitimately verified typically have larger audiences than the average user, and compromised accounts can be used to spread false information, persuade users to interact with additional malicious content like fraudulent cryptocurrency scams and expand phishing campaigns to other users.

De Grippo warned that “pig butchering” fraud, or attacks that start on social media networks before moving on to other services with the ultimate goal of obtaining cryptocurrency, might be launched via Twitter phishing. This kind of activity has increased lately, according to Proofpoint.

Cybercrime on Twitter post takeover

Impersonation of well-known firms has plagued the new authentication system Elon Musk created. Following fake tweets sent by spoof accounts using the names of their respective companies, Eli Lilly and Lockheed Martin suffered a decline in their share prices.

With the ransomware gang Yanluowang joining X in July 2023 to sell their wares, concerns have been raised that the network will be used by hackers to sell stolen data due to the billionaire Tesla’s devotion to free speech.

He cut down the number of employees responsible for X’s safety and content moderation before the most recent high-profile departures from the concerned department took place. He fired the whole artificial intelligence ethics team, which was in charge of making sure that consumers weren’t pushed harmful information by algorithms.

The billionaire recently downplayed worries about the prevalence of hate speech on Twitter. During a Wall Street Journal event, he asserted that hate speech on the site has decreased since he took over the firm in October 2022 and that Twitter has reduced “spam, frauds, and bots” by “at least 90%.”

There is no data to back up those assertions, experts, and ad industry insiders told CNBC. Some even claim that Twitter is purposefully obstructing independent researchers from tracking these numbers.

Ponzi schemes

X is among the most well-known social networks in the world. Naturally, it is also a sanctuary for scammers of all stripes and cybercriminals.

It’s important to familiarize yourself with common Twitter scams and how they operate, the risk quotient and how to successfully defend yourself against them.

There are many Ponzi schemes out there such as phishing, account hacking scams, conversation frauds, bitcoin scams, and bot scams.

Phishing, a sort of cyberattack in which a threat actor impersonates someone or something they are not, can affect any social media network. With Twitter (rebranded as X), a con artist has virtually endless opportunities to phish users. To provoke the target into entering their credentials, they can use email phishing, by sending false messages.

In November 2022, not long after seizing control of Twitter, Elon Musk unveiled ‘Twitter Blue’, a monthly subscription service that costs money and adds a blue checkmark to a user’s account.

According to a study by Bleeping Computer, con artists promptly took note of this attempt and launched a sophisticated phishing assault to steal the usernames and passwords of users who wanted to confirm their accounts.

Since Twitter’s creation, similar phishing campaigns have plagued the social media platform, with fraudsters coming up with ever-creative ways to steal user credentials. The best thing a user can do is to set up two-factor verification and carefully examine each email that purports to be from Twitter because this won’t change regardless of who is in charge of the social network.

X’s security and user experience have deteriorated under Elon Musk’s ownership, becoming increasingly perilous for users. In a recent story published by Wired.com, Tim Utzig, a visually impaired individual was deceived by scammers on the micro-blogging platform. Tim, relying on a screen reader, couldn’t detect the scam indicators when responding to a tweet from a compromised account. He lost $1,000 in the process.

The author, concerned by the social media portal’s lack of responsiveness, teamed up with a social engineering expert named Steve to track down the scammers. The efforts revealed a network of fraudsters using elaborate methods, exploiting vulnerabilities, and leveraging blockchain transactions to deceive victims. Multiple individuals were identified through their payment accounts, linked to real-world addresses, underscoring the scope of the scam.

This story illuminates several critical issues with X. The rise in fraudulent activities on the platform, exemplified by Tim’s case, indicates a worrisome lack of effective security measures. The decline in accessibility support for visually impaired users further compounds the problem, leaving vulnerable individuals like Tim susceptible to exploitation.

The narrative also raises concerns about Twitter’s changing priorities, as evidenced by its rebranding to “X” and ambitious plans to become an “everything app.” This pivot, while aiming to expand the platform’s capabilities, poses significant security risks given the existing vulnerabilities that scammers exploit. The story serves as a cautionary tale, emphasizing the need for users to be vigilant and the urgent necessity for Twitter to prioritize both accessibility and security to prevent further harm to its user base.

Then there are account hacking scams. The blue checkmark on Twitter has always been reserved for the most eminent people, including celebrities, politicians, and influencers. On the other hand, cybercriminals have always coveted the social evidence that comes with obtaining a blue check. They routinely hack verified accounts to get one.

For instance, a 17-year-old teenager hacked the Twitter accounts of Joe Biden, the then-presidential contender, and Bill Gates, the co-founder of Microsoft, in 2020 using a straightforward social engineering technique. The adolescent received a three-year prison sentence after his actions, but they demonstrate how simple it is for cybercriminals to hack verified Twitter accounts, according to The Guardian.

It’s easy to suppose that many people fell for the young boy’s con after he hacked into Biden and Gates’ accounts to demand a Bitcoin payment. However, this was not an isolated incident; breaches occur much too regularly, and most often, regular users are the ones who suffer. This is why it’s crucial to keep in mind that you shouldn’t ever blindly believe what you see on Twitter. Even if it seems like your favourite celebrity is truly tweeting, make sure to confirm that their message is authentic before taking any action.

Conversion frauds are also tricky. Cybercriminals are developing more inventive ways to con consumers because everyone wants a blue checkmark. Whether you use Facebook, Twitter, or Instagram, you’ve received a message from someone promising to quickly verify your account.

There are only two ways to have a verified Twitter account in practice. One is a holdover from the first approach, namely making a formal verification request through the platform. There were several requirements you had to meet to receive the blue badge. Most importantly, you had to demonstrate that you are a “notable” person involved in politics, the media, or other fields. This is no longer functional, although those who previously had verified accounts may still appreciate the blue tick icon.

There is currently just one method to get the tiny blue checkmark, which is to join up for ‘Twitter Blue’ if you still want one.

Additionally, be sure to report any con artists who offer to verify your account to Twitter. Visit X’s support page and complete the necessary form there to accomplish this.

In the cryptocurrency industry, scams are all too rampant, and many of them take place on Twitter. You have probably encountered one if you follow cryptocurrency-related accounts or occasionally post about cryptocurrencies.

Twitter cryptocurrency scams come in a variety of forms, some of which are glaringly evident while others are more subtle. One way con artists do this is by pretending to be a well-known digital currency influencer or analyst, posting false tweets, or even sending direct messages to their intended victims. Their tweets may promote worthless cryptocurrencies that will eventually lose value or advertise phoney airdrops and dubious services.

Another scammer favourite is fake cryptocurrency giveaways. This kind of hoax relies on persuading the victim that they would receive a huge reward in exchange for a tiny cryptocurrency deposit to pay a “fee” or something comparable. Of course, the fraudster will just take your money and move on to the next victim if you make the mistake of depositing it.

Make sure you thoroughly research any information regarding a specific asset and only trade on reputable cryptocurrency exchanges if you want to avoid falling victim to crypto-related scams on Twitter.

Then there are bot scams. As you may already be aware, social media sites are crawling with bots—computer programs that mimic human activity. Twitter is no different. A 2022 study from the online analytics firm Similarweb discovered that 5% of Twitter users are bots and that they produce between 21% and 29% of the network’s content.

Although bots are not inherently evil, con artists frequently use them to disseminate false and misleading information, encourage victims to click on harmful links, install malware, and carry out other harmful activities. On Twitter, networks of bots may work together to retweet and like posts to reach a larger audience.

You should always carefully examine any account that sounds suspicious, especially if it frequently spams links in responses to other tweets or sends direct messages, as some Twitter bots can be challenging to recognize and initially resemble real accounts. Block or mute the account in question, and then report it to the micro-blogging platform if you believe it to be a harmful bot.

The recent developments surrounding Twitter, including the departure of key officials responsible for brand safety and content moderation, have raised concerns about the platform’s susceptibility to hate speech and cybercrime. The abrupt resignation of prominent figures like Ella Irwin, A.J. Brown, and Maie Aiyed has had an impact on the platform’s ability to maintain a safe and controlled online environment.

Since Elon Musk acquired Twitter and his subsequent changes, there have been notable shifts in the platform’s policies and practices. These changes have led to decreased content restrictions and alterations to the premium verification service, which has been exploited by cybercriminals for phishing attempts. These phishing attacks use various tactics, including false email messages and Google Forms, to trick users into revealing their login credentials.

Additionally, Elon Musk’s takeover seems to have made Twitter a more attractive target for hackers, increasing phishing attempts. The compromised accounts, particularly those with the coveted blue checkmark, can be used to spread false information, promote scams, and expand phishing campaigns to other users.

Furthermore, concerns have been raised about the rise of cybercrime on Twitter, such as the selling of stolen data and the potential for pig butchering fraud, which involves using the platform as a stepping stone to other services and ultimately targeting cryptocurrency.

It’s worth noting that while Elon Musk has claimed improvements in reducing hate speech and spam on the platform, these assertions lack concrete data to support them. The prevalence of scams and cybercrime, including Ponzi schemes, phishing, account hacking, and bot scams, remains a significant challenge for Twitter users.

In navigating this landscape, users are advised to exercise caution, practice good online hygiene, and be sceptical of unsolicited messages or offers. Implementing two-factor authentication, carefully scrutinizing emails and messages, and reporting suspicious accounts are crucial steps to protect oneself from falling victim to cybercrime on the platform. As Twitter continues to evolve under Elon Musk’s ownership, vigilance and awareness remains the key to staying safe in this ever-changing digital environment.

The post Twitter’s cybercrime mess appeared first on International Finance.

A new SAS-sponsored study by Economist Impact predicts three potential futures for banking, examining the risks and opportunities ahead. Depending on the sequence of events that take place between now and 2035, any of the scenarios are conceivable. The objective of the study is to shed light on how banks might change their purpose and business strategies to benefit consumers, shareholders, communities, and the environment. The study makes it evident that the banks are at a turning point in dealing with issues like climate change, economic dispersion, and chronic economic and social injustices.

Yuxin Lin, Senior Manager of Policy and Insights at Economist Impact said, “The sector’s rapid evolution amidst prevailing uncertainty begs a fundamental question: What is the purpose of banks?”

How banking leaders answer this question – and the business decisions they make as a result – will redefine the entire industry.

Alex Kwiatkowski, Director of Global Financial Services at SAS said, “Banks have the power to elevate not just our global economy but all of humankind. By embracing technology and innovation with intention, banks can pave a more purpose-driven path, where higher purpose and profitability go hand-in-hand. And if they don’t embrace this fully, a golden opportunity to make a genuine difference will be squandered, potentially with very serious consequences.”

Scenario 1: Can transformed banks regain public trust?
Banks have had issues with their reputations ever since the 2008 financial crisis. According to the 2022 Edelman Trust Barometer, financial services presently inspire confidence in just over half (54%) of the general public, making them one of the least trustworthy industries. Flashing forward to 2035, Scenario 1 envisions a world where banks wield digital transformation to rehabilitate their image. Banks have backed consumer-focused regulation and improved safeguards against cybercrime and data privacy. More open banking and collaborations that spark profitable new offers are fueled by increased transparency and consumer protections, which boost public confidence. Every aspect of clients’ financial lives are seamlessly integrated via digital platforms in personalized, adaptable ways.

Stu Bradley, Senior Vice President of Fraud and Security Intelligence at SAS said, “Consumer trust, built over many years, can be lost in an instant. As digitization accelerates, it is critical that banks create hyper-personalized engagement as they address rising risks. In balancing customer experience and risk, an enterprise decisions approach – where fraud, risk and engagement decisions integrate holistically across the customer journey – can cut costs and streamline banks’ IT infrastructures, while boosting revenue and customer retention.”

Scenario 2: Might banks catalyze cross-industry climate action and power the green transition?
It will take unprecedented levels of global cooperation and teamwork to address the climate crisis. The United Nations claims that states’ present pledges to cut greenhouse gas emissions are far insufficient to keep global warming to 1.5°C over pre-industrial levels. Action that is swift and firm is necessary to prevent the worst effects of climate change. Scenario 2 foresees that in 2035, the world community will be committed to addressing climate change, and decolonization will be a top priority for infrastructure, transportation, and energy. Cities have been redesigned to be more resilient to the effects of the climate. Green technologies and affordable renewable energy sources are becoming the norm.

Troy Haines, Senior Vice President and Head of Risk Research and Quantitative Solutions at SAS said, “Climate leadership in the banking sector will drive greater cross-industry progress toward net-zero emissions by 2050 – and it starts now with better analytics, modelling and management of climate risk. In enhancing their ability to model climate risk scenarios and understand potential impacts to their balance sheets and capital, banks can help propel the green transition and advance worldwide climate resilience”.

Scenario 3: How will banks fare in a geopolitical fragmented world?
Economic and market uncertainty continues even as the world seeks to put the worst of COVID-19 in the rearview mirror. The pandemic’s aftermath has exacerbated rivalries among the world’s economic superpowers while overtaxing developing nations, whose citizens bear disproportionate burdens. Against this backdrop, it isn’t hard to imagine Scenario 3, which depicts a geopolitically contentious world stage in 2035, colored by divergent interests and a retreat of multilateralism among the world’s economic giants. The World Trade Organization has been displaced by bilateral and regional accords. The emergence of digital currencies and rivals’ alternative payment methods has shattered the global financial system.

Theodora Lau, Founder of Unconventional Ventures says, “Deglobalisation, accelerated by recent global events, will likely widen the staggering societal inequalities that plague us today. Indisputably, banking and money are at the heart of it all. Each of us has a role to play in championing a more inclusive and sustainable future with our actions of today”.

How fintech challenges banks
The use of personal finance applications has increased recently. The app game is being played by everyone in the banking industry; app providers range from banks that offer their own services to lone developers that make stand-alone saving, budgeting, or money management apps. It is anticipated that the use of personal finance applications will be at its peak in the coming future. These app providers offer current accounts that can only be handled from a phone or tablet, and staff members give customer support via a live chat service. The option to temporarily block your card from your app in the event of loss or theft is one of the major improvements offered by challenger banks with app-based business models. Instead of phoning customer support for replacements, clients can order a replacement with a few taps on the screen. The services offered by conventional banks might be improved with such straightforward changes. By allowing consumers to just take photos of their checks rather than bringing them into the branch, some traditional banks already assist their clients in this way.

Conventional banks are catching up
There are indications that major banks are adapting to the future of banking by becoming more digitally friendly. For instance, Hello bank! by BNP Paribas Fortis which operates in France, Belgium, and Germany was the first bank to exclusively handle accounts through an app. In keeping with a shifting consumer landscape, Hello Bank! offers assistance and support to its clients via a variety of social media platforms, including an online forum.

Additionally, a lot of these services make international banking simpler than before. The number of apps that assist users in managing their finances on a daily basis has increased in other places. Yolt, for instance, enables users to integrate all of their accounts and monitor them in a single app while also getting advice on their weekly or monthly budget. Standalone savings apps are becoming increasingly common, too. This includes applications that add the difference between the amount a user spends on each transaction and the nearest unit to their savings account. If customers are unable to afford to set aside hundreds of pounds or euros each month, such straightforward developments can give them a new, simple option to save money.

Open banking
Increased awareness of how banks communicate with (and inform) their customers is one of the long-term repercussions of the 2008 financial crisis. The European Union’s Payment Services Directive went into effect in 2018. The order upholds restrictions on how users can access their financial data. This is open banking, which gives banks a plethora of new ways to interact with customers and gives consumers a greater understanding of their money. Open banking basically implies that companies that offer online accounts (such as credit and savings cards) must allow their clients to securely exchange data (such as expenditure) with outside companies (such as budgeting applications), if the client so chooses.

Consumer education regarding the advantages of open banking still needs to be done in great detail. Furthermore, banks must appropriately embrace the various ways in which they might exploit these innovations. This suggests that the coming years could be significant for the banking industry’s future because several governments are now approving operating more open banking.

The post Banking in 2035: What lies ahead? appeared first on International Finance.

While additional rules are appreciated, frequent operational modifications as per these regulations only increase the load on institutions. For example, in response to the increasingly unstable security environment financial institutions are currently confronting, the New York State Department of Financial Services (NYDFS) recently recommended significant revisions to the Part 500 Cybersecurity Regulation. By the proposed changes, anticipated to take effect in 2023, there will be much higher expectations for cyber expertise from businesses. There will also be earlier notifications of cybersecurity events and ransom payments, apart from stricter auditing for large organizations.

As we saw with the initial 23 NYCRR 500, the NYDFS is not afraid to enforce laws harshly, and several fines totalling millions of dollars have already increased the stakes for compliance. However, the advice offered to banks to accomplish this compliance still needs to be clarified. All too frequently, after enforcement measures have been taken, banks and covered entities, such as health insurers and credit unions, are left to rely on hindsight, only considering the lessons learned and fines paid after the fact. Security decision-makers urgently need to rethink their approach to data protection as pressure on banks to comply with regulations grows.

Being pursued by everyone

Since they hold on millions of consumers’ wallet data, banks and credit unions are top targets for cybercriminals. Although this has always been the case, UK-based IT firm Sophos’ yearly analysis of financial services security shows how threats have increased in size, intelligence, and ruthlessness. For instance, ransomware increased by 62% in 2021. Although more than half (52%) of the targeted firms paid the ransom, only 10% had their data returned. These alarming statistics demonstrate how vulnerable banks are becoming in front of these data theft attempts. With the significant increase in double-extortion ransomware tactics, risks abound when hackers first steal copious amounts of confidential data before encrypting the target’s files. Criminals can threaten to publish the stolen data on the dark web after this encryption.

Additionally, zealous regulators can cause severe reputational and financial harm to organizations. The NYDFS collected USD 6.3 million in fines for cybersecurity non-compliance from four separate companies in the state in just three months in 2021. Despite having protections in place, one of these companies, Residential Mortgage Services, Inc. (RMS), paid USD 1.5 million for neglecting to notify about a 2019 data breach. In addition, a USD 3 million punishment was levied against National Securities for several security violations, including the absence of multifactor authentication (MFA) or “equivalent” cybersecurity measures. These businesses not only paid hefty fines but also incurred expenses for forensic investigations and cleanup, in addition to reputational damage.

No time for security checkboxes

The increased accountability in the financial services sector can only be good. However, banks are mainly left to their own devices to navigate the path to successful and compliant cybersecurity, as “constructive ambiguity” shapes the original NYDFS rule. This indicates that many still rely on cursory checkbox methods for automatic measures like encryption.

Organizations must alter their trajectory in the face of increasing pressure from regulators and threat actors. Because of today’s enlarged data thefts, banks’ accelerated digital transformation, and growing cloud use, centralized approaches to data security need to be revised. Any bank that forgoes using specialized and efficient encryption exposes itself to even the simplest ransomware and data exfiltration assaults.

This is because centralized identity and downstream access control invariably open the door to illicit activity. From the moment they obtain legitimate credentials, attackers, both internal and external, are granted complete, continuous access to all systems, databases, and files. The organization could then lose millions of dollars due to the exfiltration of sensitive information files.

In recent years, industry giants like Equifax, Yahoo, and the Office of Personnel Management, have had significant data breaches caused by stolen credentials. The use of compromised credentials is once again the most frequent cause of a data breach, costing an average of USD 4.5 million per event, according to the most recent IBM report.

Data encryption is irrelevant when centralized controls and checkbox identities are used. Furthermore, conventional encryption lacks protection against data exfiltration because it relies on centralized keys connected to the same user credentials that the attacker has stolen or copied.

An additional layer of protection: Multifactor encryption

Banks must abandon antiquated defence methods and alter their mitigation strategies as the security and regulatory environments change. To protect sensitive data, even when nefarious actors are present inside the perimeter, they require layered solutions that function when everything else fails.

It is crucial to have a sophisticated, decentralized data protection plan. Financial businesses can stop relying on identification as the cornerstone of all data security through the deployment of multifactor encryption and distributed key management (DKM), guaranteeing that sensitive data is protected during an exfiltration event. Criminals rapidly realize that there is no one point of weakness, making all their efforts futile.

What is the operation of multifactor encryption? AES-256 is used for data encryption at rest. To eliminate central points of attack, main points of failure, and risky reliance on identity and access management controls, a multifactor solution generates a unique key for each object before automatically fragmenting and distributing the critical shards across physical devices, such as laptops, mobile devices, tablets, or servers.

Due to multifactor encryption with DKM in place, hackers cannot decrypt files even after gaining access to a system. This is also true when banks move data to the cloud because unstructured data is still encrypted with several factors, making it impossible for anyone to access it, not even the cloud provider. As a result, only a small group of individuals have access to the critical shards on the approved physical devices.

The examination of data consumption and encryption status for compliance and business reporting requirements is also made possible by multifactor encryption. For example, banks can demonstrate their active compliance with authorities during audits and inspections, thanks to an irrefutable audit trail, assisting firms in meeting escalating standards. Administrators can also design unique notifications and warnings with detailed user activity logging, enabling data insights to be fed into current security monitoring programs.

Overcoming the regulatory obstacle

Account numbers must be unreadable when stored electronically by large non-financial institution originators, third-party service providers, and senders, according to the US-based National Clearing House Association (NACHA). This organization oversees electronic payment systems between nearly every bank and credit union account within the American jurisdiction. This represents a significant departure from obsolete identity and access management security methods. Financial companies would benefit significantly from technology like multifactor encryption, which eliminates the risk of file exfiltration while skillfully balancing user accessibility and data protection.

Banks must rely on something other than checkbox solutions and traditional centralized encryption when regulatory scrutiny and ransomware concerns are at an all-time high. Firms across the industry may secure themselves and demonstrate best-in-class regulatory compliance using distributed vital management and multifactor encryption, avoiding the shame of excessive fines and reputational embarrassment.

New regulatory trends in data privacy

Uncertainty is a result of fragmented regulations

Similar to the EU’s GDPR, China’s centralized Personal Information Privacy Law offers a comprehensive set of regulations regarding data protection. The US still has a uniform privacy framework, but as more states embrace laws like Virginia’s Consumer Data Protection Act, which will go into effect in 2023, calls for federal data protection legislation will grow.

Businesses may experience uncertainties due to the fragmented compliance requirements imposed by the US and international data privacy laws. In addition, the lack of a data transfer agreement between the EU and the US will increase doubts about the legitimacy of transatlantic data transfers.

Compliance is only one aspect of privacy

Privacy is undoubtedly a compliance component, but the organization’s culture must be changed for it to matter genuinely. Poorly controlled access within an organization frequently results in data privacy violations. Humans are the weakest link in the chain of privacy and security. Thus people and processes are just as important as technology. However, as remote working becomes more prevalent, controlling user access and protecting your essential data becomes more challenging.

Organizations seeking ISO 27001 certifications

Obtaining independent external certifications for their privacy program and practices is crucial for new entrants to confirm they are handling personal data correctly. These include ISO 27701, the EU’s binding corporate rules, and APEC’s cross-border privacy rules. In addition, these designations can benefit newcomers working on delicate, mission-critical operations, such as core-system modernization, as they can save time and effort during contract negotiations.

Thought Machine has applied for and been granted ISO 27001 certification and SOC 2 Type 2 accreditation, which outline requirements for putting in place information security management systems and show that internal controls and procedures are reliable and safe. Along with adhering to GDPR, the vendor complies with all pertinent data privacy legislation in other significant countries where it conducts business, including Singapore, Australia, and the US.

Cookies

Web cookies and Apple’s Identifier for Advertisers are two tracking techniques that have enabled personalization and targeting of advertisements at a level of complexity never before achieved. However, they have also raised the possibility of privacy abuses. Providers may no longer be able to rely on cookies to increase the effectiveness of customer outreach in various jurisdictions. Institutions that need to develop a plan to protect and expand their access to first-party data may need to increase their sales and marketing expenditures by 10 to 20% to achieve the same results.

In the meantime, the UK’s Department for Digital, Culture, Media, and SPORT is considering using cookies in local circumstances without user consent or where it would benefit the user.

Storing data

Financial institutions are finding it more difficult to transfer data among entities and across borders, to create target state data flow, and to build an insightful analysis for credit scoring due to global bank rules around data security, customer privacy, and ethical use of data, such as GDPR. Additionally, the use of data produced by various activities is governed by multiple legal restrictions. For instance, personal information from a profile on a social networking platform cannot be utilized for the same purposes as information from a financial transaction.

The post Data protection: Banks must rethink strategies appeared first on International Finance.

The malware, which was first identified in late 2021 and whose endpoint was unknown at the time, appears to have evolved into an infection service offered to anyone with the means to pay.

In a particular blog post, Microsoft cybersecurity researchers define Raspberry Robin as “part of a complex and interconnected malware ecosystem,” with connections to other malware families and attack techniques.

Infection For Hire
Whoever is responsible for Raspberry Robin has been busy over the past few weeks. Data from Microsoft Defender for Endpoint indicates that in the past 30 days, at least 3,000 devices across 1,000 companies have received alerts relating to the Raspberry Robin payload.

The business went on to say that there are different payloads for malware, including IceID, Bumblebee, Truebot, and the FakeUpdates virus that EvilCorp may have used. It’s all in July 2022.

Microsoft, however, also discovered FIN11 using Raspberry Robin in October 2022. (AKA TA505—the group behind the Dridex banking trojan and Locky ransomware). The company claimed that this behavior resulted in hands-on-keyboard compromises using Cobalt Strike and that sometimes a Truebot infection was present between the Raspberry Robin and Cobalt Strike phases. The organization launched the Clop ransomware after activating the Cobalt Strike beacon.

Microsoft concluded that the Raspberry Robin gang accepts payments for distributing various infections and ransomware to its victims’ endpoints.

The report concludes that it’s possible that the people behind these Raspberry Robin-related malware campaigns—which are usually spread through other methods like malicious ads or email—are paying the Raspberry Robin operators for malware installations. Again, this is because the cybercriminal economy is very interconnected.

Red Canary researchers first detected Raspberry Robin after seeing a “cluster of malicious activity.” Most of the time, infected USB drives are used to spread malware offline. However, the researchers found that the worm spreads to new devices through a malicious .LNK file after examining an infected flash drive.

The post Beware of Raspberry Robin malware, warns Microsoft appeared first on International Finance.