The proliferation and prevention of commodity cyber threats

Ransomware and malware

Ransomware is a type of malware that attempts to persuade victims to click on a malicious link or attachment sent in a phishing e-mail. Malicious code is executed when the victim opens the link or file, which leverages potential vulnerabilities in the victim’s computer to provide remote access to the attacker.

Once the attacker has control of the victim’s computer, they can exfiltrate potentially sensitive data from that system, move laterally to other computers on the victim’s network, or encrypt that computer to render it unusable by the victim until a password or key is provided by the attacker. 

This can lead to the attacker demanding a ransom payout to be made, typically using cryptocurrency such as bitcoin, in exchange for releasing the compromised systems or for not publicly disclosing the stolen data.

This type of attack can compromise your ability to perform regular business functions and potentially serve customers, resulting in a loss of revenue. In some cases, the disclosure of sensitive data gained by the attacker, such as personally identifiable information (PII) or trade secrets, can damage customer trust, causing them to take their business needs elsewhere.

Account takeover

An account takeover is a type of identity-based attack where bad actors gain access to a user's account credentials and use it to perpetrate malicious activities.

Attempts to compromise user accounts have been prevalent in the cyber threat landscape for a very long time. Practices such as password reuse, weak passwords, lack of multi-factor authentication (MFA), and the success of phishing and social engineering campaigns make this occurrence common in many organizations and web platforms. 

Using techniques such as credential stuffing or password spraying, attackers try to illegitimately access corporate e-mail accounts, online profiles, or web properties. Credential stuffing involves attackers using password lists from prior public breaches. Password spraying is a technique where attackers systematically input commonly used passwords to gain access by fluke. 

Once they access the account, attackers can then launch further attacks against the organization, customers, and partners. Malicious parties can also send illegitimate messages, make fraudulent transactions, make changes to profiles, and potentially view sensitive data.

Wire transfer fraud

Wire transfer fraud aims to deceive a member of your organization into transferring funds to an illegitimate receiver. They leverage the potential fear targets have of organizational hierarchy or the innate trust they have of others to convince them the request is legitimate.

Typically, an attacker inserts themselves into an e-mail chain or leverages a compromised e-mail account to contact a member of your organization in a financial role. The attacker then poses as a business partner, vendor, or ranking member of your organization to direct the target to change payment information, disclose financial data, or send funds to an illegitimate receiver. Financial institutions can often detect and freeze these transactions, but if the fraud isn’t detected or reported by the victim in time, funds may end up being released to the attacker.

If gone unnoticed, this illegitimate modification of payment information could lead to significant financial losses for the organization and a loss of trust from business partners and customers. If these fraudulent transactions were not detected by the financial institutions, it can sometimes be challenging to have the transactions reversed or have insurance compensation for damages, especially if some time has passed.