The business of cybercrime: making money off your mistakes

©Mikko Lemola via 123RF

CEO fraud or whaling is a highly targeted form of email spear-phishing. Here the criminal sends an email that appears to be from an individual or business that you know (often the CEO or CFO), the kind of person unlikely to be challenged to identify themselves properly. By impersonating your boss, cybercriminals use email to get you to send valuable data or wire funds to them.

Ransomware uses malware that prevents or limits users from accessing their systems, forcing them to pay a ransom through certain online payment methods. Only once they have done this will they be able to access their systems or get their private data back.

Exploiting human frailty

These types of malicious attacks exploit human frailty. The criminals know that computers don’t make mistakes, people do. So as technical defences have strengthened, they are turning to the people in front of the technology and exploiting them instead. They know that a successful attack on employees means they can effectively circumnavigate your traditional technical protections – a simple spear-phishing email with a malicious attachment or web link can open up your systems to further attack.

Cybercriminals know they can take advantage of the fact that employees often lack even basic cybersecurity awareness, making them vulnerable to well-crafted social engineering attacks like spear-phishing. So if you run a business (or its IT security) this targeted attack on your employees needs to be taken as seriously as an attack on your technology. Invest in technology and technical resources, but don’t forget staff training.

Rise in attacks

Dimension Data’s 2015 Global Threat Intelligence Report showed that attacks against businesses and professional services increased from 9% to 15% last year. The rise in threats, such as ransomware and spear-phishing, have seen cybercriminals cashing in, while businesses are left to deal with the devastation. Cybercrime statistics posted by the South African Banking Risk Information Centre (SABRIC) reveal that South Africans lose in excess of R2.2bn to internet fraud annually. The statistics have pegged South Africa as the most targeted country on the African continent.

So, just how much are cybercriminals making? A lot. The Cisco 2016 Annual Security Report has pointed out that attackers make around $34m (nearly R546m) in gross yearly income through ransomware per campaign. And the FBI reported losses due to CEO fraud or whaling in excess of $2bn in under two years. And these are losses recorded from just two ‘emerging’ attack strategies.

Keeping the bad guys out means building a human firewall around your business and its data, to match the capabilities of your IT firewall.