15:19 - 28.08.2018

---

August 28, Fineko/abc.az. Kaspersky Lab has unveiled a report on the state of cybercrime for Jan-Jul of the year.

The Lab informs that banking Trojans is the most common tool with the help of which attackers are fishing for confidential financial data from users: bank card number, account data in the online banking system, etc.

According to Kaspersky Lab, the number of mobile banking Trojans (Android) in the 2nd quarter of 2018 was 3-fold more than in the beginning of the year. The company has identified more than 61,000 installation packages.

Thus, for Jan-Jul the share of users attacked by banking Trojans (out the total number of users faced with cyber threats) in Azerbaijan made up 1.50%, Armenia 1.53%, Belarus 1.13%, Kazakhstan 1.02%, Russia 0.65%. The share of users attacked by malicious banking software for Android (out of the total number of users faced with cyber threats) in Azerbaijan reached 0.08%, in Belarus 0.13%, Kazakhstan 0.25%, Russia 1.15%.

Often, to infect the victim in order to steal his money, attackers use methods of social engineering - first of all, phishing (fake web pages, as well as messages on behalf of legitimate organizations). As Kaspersky Lab found out, in the first half of the year almost half (44%) of phishing attacks were directed at the financial sector, and every fourth attempt to download a phishing page was associated with bank phishing.

Thus, over Jan-Jul the percentage of users faced with phishing attacks (out of the total number of users faced with cyber threats) in Azerbaijan was 11.28%, Belarus 15.95%, Kazakhstan 12.85%, and Russia 17.38%.

An interesting feature is the use by criminals of the infrastructure of already infected financial institutions for new attacks. For example, they send messages from real e–mail addresses of employees to new victims with a request to open a bank account. This trick allows to lull the vigilance of the recipient.  In addition, financial institutions continue to face mass malware, phishing, DDoS attacks, etc.

"Lately, we’ve seen great changes in the world of cyber threats for financial organizations. The fact that criminals attack cash machines is no longer news. But now they've moved on. At the end of 2017 Kaspersky Lab first found the malware software Cutlet Maker for attacks on cash machines. The peculiarity of this malware was that it could be bought on the Darknet market for several thousand dollars (with the attached step-by-step instructions for the user in the kit). This turn of events turns the attack on the cash machine from a complex, long, good preparation requiring operation in quite a simple action, which quite possibly will lead to the mass nature of this threat," the report said.

Attacks on POS-terminals and systems also develop. By infecting the cash register computer connected to the POS-terminal, attackers can gain access to the data of bank cards that have passed through the device.

According to Kaspersky Lab, the number of users faced with mining programs in 2017-2018 was by 45% more than in 2016-2017. In an effort to make money on cryptocurrencies, attackers infect with special programs-miners both devices of ordinary users and powerful computers and servers in corporate networks.

Usually attackers use multiple schemas of infection. Most often, this is a hidden installation of the miner on users' computers with help of malware. Such programs can be masked by attackers, for example, under pirated versions of licensed products that users download on the Internet. Another scheme is the use of web miners - special scripts built into the sites. When a user visits a particular site, the browser loads a script that causes the device to mine the cryptocurrency. In addition, malicious applications with miners for mobile devices are detected in app stores, for example, Google Play.

At the same time, the percentage of users faced with miners (out of the total number of users faced with cyber threats) in Azerbaijan was 0.04%, in Belarus 0.82%, Kazakhstan 0.06%, and Russia 1.11%.