Financial Services Organizations Face More Sophisticated Threats Than Others

The better than average defenses that financial companies have been able to mount against modern cyber threats has become a bit of a double-edged sword for organizations in the sector.

While financial companies are able to detect and block a lot more malware than others, they face considerably more sophisticated threats as a result as well.

A new report this week from Lastline based on an extensive malware analysis shows that threat actors typically elevate their attacks when going after financial companies.

For the report, Lastline analyzed 30 days worth of threat data targeted specifically at financial service companies and finance departments at enterprises. Lastline then compared those results with data on more generalized threats that the security vendor had reported on previously.

The exercise showed that the proportion of malware displaying advanced behavior was 20% higher in the financial sector than elsewhere. For the report, Lastline defined malware as displaying advanced behavior if it is packed to avoid detection by static signature-based tools,  evade dynamic analysis, steal credentials, and remain stealthy.

One in 10 of the financial sector malware that Lastline analyzed integrated all four behaviors, compared to the 1 in 12 global average for advanced threats in other industry verticals. Overall, the percentage of total files that Lastline found to be malicious was 47% higher than the global data.

One reason could be that the financial sector's more effective security measures require a more sophisticated effort on the part of malware writers, says Andy Norton, author of the report and Lastline's director of threat intelligence.

"The finance industry is facing a more sophisticated threat than is encountered by a wider audience," Norton says. "They need to understand that more stringent security doesn’t make the threat go away; it only changes the nature of the threat."

To remain ahead of emergent threats financial organizations and finance groups at enterprise need to incorporate controls for inspecting the behavior of objects entering the internal environment rather than relying simply on existing controls and user awareness, he says.

The Lastline report comes just weeks after an Accenture study showing that cybersecurity has become a major issue for financial services organizations. The Accenture study, done in collaboration with the Ponemon Institute, found that the average number of breaches at financial services companies has more than tripled, from 40 in 2012 to 125 breaches in 2017.

The average annual costs of cybercrime for financial services companies has also increased sharply, rising from $12.97 million per firm in 2014 to $18.28 million last year, compared to an average of $11.7 million for organizations across other industries. Between 2016 and 2017 alone, spending on security breaches increased 10% among financial organizations.

But at the same time, the report found that organizations in the financial sector have gotten better than counterparts in other industries at dealing with more common forms of cyberattacks, especially those involving malware. Lastline's analysis too showed that financial companies are able to repel 30% more of the most common threats that they encounter compared to other organizations.

Lastline also found that a vast majority of the top malware tools targeted at financial companies are being delivered via Microsoft-office based documents and rich text format files. The security vendor's analysis of the 100 most recent malware samples showed that currently one of the most common threats targeted at financial companies is iSpy, a variant of the HawkEye keylogger. The malware is designed to capture and exfiltrate website, email and FTP credentials, and also license key information for the software on a compromised system.

Lastline also uncovered a high prevalance of Emotet and URSNIF two other keyloggers that are being delivered via Microsoft Office documents to financial companies. The two strains of malware contain features for evading dynamic analysis and are equipped among other things to highjack automated transfer payments, Lastline said. Like other advanced malware, Emotet and URSNIF have over the years integrated features that support lateral movement, additional credential theft and spamming.

"The email vector for delivering threats is higher in finance than other industries where web based compromise was also a major factor," Norton says. "[But] advancements in AI based anti virus have translated to better protection from email-based attacks," generally he says.

Related Content:

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for more information