Organized Crime. Moving beyond garbage.

 

In the past couple of years we’ve seen a crime rings and hackers joining forces to steal information – credit card details, bank account logins, and even full identities.  They then sold this information in the underground economy.  

 

There has been another evolution in these attacks.  There is now a “stack” of operators in these groups, with organized crime facilitating and orchestrating the operations.  There are hackers and computer experts involved up front to get in and get the information and “mules” on the back end who are recruited to turn the identities or credit card numbers into actual money that is then funneled back to the crime leaders.  

 

A few major crime rings (see below) have all seen significant indictments and/or guilty pleas announced recently. Predicting the future operations of these crime rings is tricky, but what we do see is that these operations all seem to have been discovered long after the attack plans were complete.  The indictments we’ve seen are encouraging, but law enforcement seems to be chasing the problem, not getting in front of it.

 

Also, the current defenses at targeted organizations were not apparently sufficient to stop the 4-phase attacks (incursion, discovery, capture, and exfiltration) typically used by perpetrators.  It is quite likely that more of these sophisticated attacks are now “in play” or soon will be directed against other corporate targets.   

 

Bottom line?  These attacks are preventable.  With a combination of defenses at each stage of the attack, companies can defend themselves against organized crime and help to prevent being tomorrow’s headline.