2018 forecast — CyberWire Special Edition

Dave Bittner: [00:00:02] Hello everyone, and welcome to the CyberWire's Research Saturday presented by Juniper Networks. I'm Dave Bittner, and this is our weekly conversation with researchers and analysts tracking down threats and vulnerabilities, and solving some of the hard problems of protecting ourselves in a rapidly evolving cyberspace. Thanks for joining us

Dave Bittner: [00:00:25] And now a quick word about our sponsor, Juniper Networks. They're empowering you to automate your security, see your networks, and protect your clouds. Juniper Networks has you covered, so your security teams can finally get back to fortifying your security posture. Learn more at juniper.net/security, or connect with Juniper on Twitter or Facebook. That's juniper.net/security. And we thank Juniper for making it possible to bring you Research Saturday.

Dave Bittner: [00:00:58] And thanks also to our sponsor, Enveil, whose revolutionary ZeroReveal solution closes the last gap in data security: protecting data in use. It's the industry's first and only scalable commercial solution enabling data to remain encrypted throughout the entire processing lifecycle. Imagine being able to analyze, search, and perform calculations on sensitive data - all without ever decrypting anything. All without the risks of theft or inadvertent exposure. What was once only theoretical is now possible with Enveil. Learn more at enveil.com.

Jon Clay: [00:01:38] Trend Micro has been basically researching a number of the underground - cybercriminal underground communities around the world.

Dave Bittner: [00:01:47] That's Jon Clay. He's Director of Global Threat Communications at Trend Micro. The research we're discussing today is titled, "Cash and Communication: New Trends in the Middle East and North Africa Underground."

Jon Clay: [00:01:59] So, we've done research on the Chinese one, the Japanese, Russian - a whole slew of them. And so, we thought we would move to the Middle East and North Africa region, and see what's going on within those undergrounds. So, we started doing research a couple of years ago. We published our first report last year, and then we made an update to it this year.

Dave Bittner: [00:02:22] So, let's dig into some of the things that you've found. What were some of the things that shifted in 2018?

Jon Clay: [00:02:30] Yeah, it's interesting. It appears that this underground is getting more sophisticated. And part of the reason we're seeing this trend is because of the way they're communicating within the community. Last year, what we saw was a lot of open-source messaging solutions being used, communication channels being used, and they've really moved to a more secure channel. They're using more encryption-based messaging products now, so that the communications between each other is encrypted. And so, obviously, they're looking to stay under the radar, stay out of reach of law enforcement by going to this route. So that's one thing.

Jon Clay: [00:03:10] The second thing that we noticed was more money laundering services being offered within this underground. And again, it shows this sophistication - moving to a better form of selling their services and goods in order to make a profit, and keeping it under the radar again. So we're seeing a lot more of these actors within this underground utilizing better communication channels and improved selling services.

Dave Bittner: [00:03:39] Well, let's dig into some of the details here. Specifically, with the financial services, can you take us through - what sort of things are they doing here, and how are they handling their money?

Jon Clay: [00:03:50] Yeah. You know, it's interesting, because we see this in other communities out there around the world, where other actors will offer actors within the community underground services. And in this case, it's money laundering. So they're using money laundering services and offering those to other criminals within the underground. This allows them, obviously, to make more money. They are working within the community, they get to know the other actors within the community. You start building up a reputation within that community of offering good service.

Jon Clay: [00:04:23] And, as such, we're seeing these actors utilize more and more of these types of money laundering services. And this really is just a way for them to make sure that a transaction cannot be found by law enforcement or other good people out there in the world that are tracking this kind of stuff.

Dave Bittner: [00:04:43] Now, they're also using these types of services to convert actual physical items into cash?

Jon Clay: [00:04:50] Yeah, that's part of the service as well. So, depending on what is stolen - you know, if it is electronic data, obviously, then they're trying to sell that data in that underground to other actors, or to people who come to this underground from other areas of the world to buy goods and services within this underground. So, they're selling the electronic stuff.

Jon Clay: [00:05:10] But in a lot of cases, they will try to utilize physical goods and services as a way to create money for themselves. So, let's say, for example, you wanted to change some electronic money into physical cash, you can go get gift cards or do something, you know, purchase goods and services using stolen credit cards and get those physical items shipped to you, and then you can sell them into, you know, to people around that community.

Dave Bittner: [00:05:38] Now, in terms of these folks finding each other, can you describe to us, what are the forums like? Is this a private thing? How does one prove their worth to be able to have access in these forums?

Jon Clay: [00:05:50] I think a lot of it comes from just the sharing of the different forums. People doing searches within the underground community, finding the different forums that are out there. So, there's forums on carding, there's forums on money laundering, there's lots of different things there. So you just kind of search for it.

Jon Clay: [00:06:07] And once you find a community or a forum that you want to be able to work with, in a lot of cases, you do have to join. They can be private, although a lot of them still are public. We still do see a lot of public communications out there in this underground, because it still is a pretty new underground community, within the big scheme of things. So, they are learning as they go. You know, most of the actors we found being male in their mid-twenties, is kind of the profile today of the typical actor within this community.

Jon Clay: [00:06:42] And so, you know, they are just communicating amongst each other. Once they find somebody who they like and they work with well, then usually you see that communication move to more of a private mode. And again, using communication channels that are all encrypted.

Dave Bittner: [00:06:59] I see. Now, one of the other things that you highlighted in this research is the availability of discount travel services. What's going on here?

Jon Clay: [00:07:07] Yeah, this is an interesting one. In fact, we even published a full report on this. And we're seeing more and more of these, you know, the actors want to go on vacation, right? Just like anybody else in the world, they want to be able to go and take a trip. Now, the thing that interesting in the underground is that they can get these trips and - whether it's a airline ticket or hotels or car service - and they're buying these services in the underground at very discounted prices, because, in a lot of cases, other actors are stealing this type of data, or are obtaining this kind of data at a very low discount - a very large discount, I should say.

Jon Clay: [00:07:48] And so,again, you know, there's lots of different services being available in these undergrounds. Travel is one of them, and is being used by more and more of these actors, because they do, like I said, want to just go and take some vacation sometime.

Dave Bittner: [00:08:02] Now, is this another opportunity to launder some money by having it flow through these travel services?

Jon Clay: [00:08:09] Very much so. Again, you know, these actors have found another way of laundering their goods and services that they have stolen. And so they basically money launder it by selling that to other actors who pay them money for those services, then they're done with them. So, it's another form of looking for profit and obtaining profit from their mischievous activities.

Dave Bittner: [00:08:32] Now, is there any sort of reputation tracking? I can imagine - particularly with travel, you know, if I show up to a hotel somewhere halfway around the world, and they don't know anything about my reservation, well, my vacation might be ruined.

Jon Clay: [00:08:49] (Laughs) Yeah. In fact, part of the service is actually - they have a concierge service. So, you can contact the organization that you purchase these from and they will manage that for you. So, they will be contacting the hotel, for example, making sure the reservation is good. And again, you know, part of it is, when you find an organization or an actor who is providing this, if he's providing a good service, you get - you know, just like the others - you get five stars or four stars, or something like that, and you get rated. So, people will use those that have a good reputation and make sure that - and those that follow through on the goods and services that they are selling.

Dave Bittner: [00:09:28] Now, let's dig into some of the means by which they're communicating with each other. This is another thing that you all tracked in the research?

Jon Clay: [00:09:34] Yeah. Again, it's the shift that we saw was the use of some of the more public messaging. So, Facebook Messenger or some of the other types of open-source, so to speak, messaging platforms, to some of the newer platforms that have a more encrypted capacity associated with it, or feature associated with it. So, we're starting to see more and more of these actors move to these platforms, these messaging platforms that have encryption built into them. And that allows them, again, to ensure that their communication between each other is private and is very difficult to break, essentially.

Dave Bittner: [00:10:13] And so, the sort of flow of the conversation is - do they meet each other in the forum and then generally take it offline?

Jon Clay: [00:10:21] Yeah, that's one way. But even within the forums, if you're communicating, in a lot of cases, they will try to do encrypted channels within the forum as well. So, you're going to see that. But if it - definitely in the one-to-one communication model, it is definitely going to be an encrypted channel in most cases today.

Dave Bittner: [00:10:39] So, what are you tracking as we head into the new year, just starting with 2019? What do you expect to see happening here? What sort of evolution are you going to track?

Jon Clay: [00:10:50] Well, we're definitely going to keep tracking this underground, because we are seeing a lot of shifts and changes within it. We tend to focus on the cybercriminal aspect of it. We don't look at the nation-state, potential nation-state-type activities. We're looking at more of the cybercrime, profit-oriented actors within this underground.

Jon Clay: [00:11:12] And what we're seeing with them is definitely shifting to a more global presence. So, they are looking to attack more global organizations outside of their region. We're seeing more improved malware development within the underground. So, we'll likely see improved malware coming out of this underground, and being used by the actors within this underground.

Jon Clay: [00:11:34] I think we're also seeing somewhat of a shift in who they're targeting. In the past, they were targeting some of the government and other types of organizations, and we're seeing them shift more to the oil and gas industry within that region. And one of the things that we are concerned about is that they are somewhat doing proof-of-concepts within their own region against oil and gas, and we could see an expansion to some of the oil and gas organizations around the world, and targeting those organizations through the learning process that they've made to make sure that they can attack them in a successful manner.

Dave Bittner: [00:12:11] Now, when you say targeting oil and gas, what kind of stuff are they doing there? What are they going after?

Jon Clay: [00:12:17] It can be a lot of things. A lot of it is extortion today. So, they're looking to take down certain manufacturing processes, or certain systems that are running the business, in order to extort that organization into paying them money to bring those systems back online. We also are seeing a lot of data theft. It could be intellectual property theft that they plan to sell to other oil and gas organizations around the world.

Jon Clay: [00:12:41] So, lots of different types of activities that we could see come from them. You know, once you're inside an organization's network, you really have free reign to do what you want, and so, it really just depends on the actor and what they're interested in doing at the time.

Dave Bittner: [00:12:57] Now, you mentioned how, in your research, you tend to keep separate the nation-state activity from the criminals. In this part of the world, to do those two groups tend to stay apart from each other? Is there overlap? Do you have any sense on that?

Jon Clay: [00:13:11] I haven't seen that today, Dave. But I think, you know, one thing that you do see inside these undergrounds is the sharing of information, and the selling of the threat content, right? The threat vectors. So, whether it's a piece of malware or something. So, it's not unlikely to see actors who are doing different types of attacks using threats that come from the other actors that are building it for a different type of an attack, Right? Like a cybercriminal attack or a profit attack, versus a destructive attack. They may look at using the same type of malware or the same type of infrastructure.

Dave Bittner: [00:13:49] Now, what about the breadth of services that you're seeing here? I'm thinking specifically of, you know, catering to people with different technical capabilities. Can I - if I was interested in something, you know, from a turnkey service to something more technically sophisticated, can I sort of dial it in for myself?

Jon Clay: [00:14:09] Yeah, that's all available within this underground, although this one, this underground, still is a bit early in terms of sophistication. So, if you're looking for a very sophisticated or a weaponized type of malware, you're probably going to go to a different underground. A lot more likely, like the Russian underground is known for that type of malware.

Jon Clay: [00:14:31] And that's the thing that, also, is unfortunate for us, in this community, because these actors are starting to be more global and work together in other regions of the world. So, you know, picking and choosing which services you need and who makes the best within that, you start seeing those types of communities being built up around the world. And so, obviously, with the internet being a global communication channel, you can do that.

Jon Clay: [00:14:59] But again, you know, going back to this particular underground community, really it depends on what you want. And if you want it, it's more than likely you'll be able to find it.

Dave Bittner: [00:15:10] Now, what about language barriers? Do the local languages spoken - does that tend to keep things more regional? Are they staying close to home?

Jon Clay: [00:15:21] Yes. In fact, in this particular underground - Middle East underground - they do speak in local languages more than we see in some of the other undergrounds around the world. So that tends to keep it somewhat closed. So, unless you are speaking the local language, you may not get access to some of those forums. You may not be able to participate in some of the communications that are happening in there. So that does tend to hinder the size of this, and growing the size of this underground. Unlike the Russian underground, for example, where English is used in many, many cases - although Russian is still used in a lot of places. But English is still available within that underground, and predominantly.

Dave Bittner: [00:16:05] Now, in terms of folks around the world keeping this group on their radar, what are your recommendations for dialing in an appropriate level of monitoring and concern?

Jon Clay: [00:16:16] Yeah, I think for most people out there, obviously, reading the reports that us and other other organizations are putting out about this underground is a good place to start learning about it. I think we also are seeing, for example, the United States DHS coming out on occasion with reports or alerts about activities that you see from this region of the world. So, I think all of those are good places to start.

Jon Clay: [00:16:43] You know, like I said, we're going to continue to do investigations within this underground, and we'll continue to - whether it's a blog update or another report next year - keep you on your toes and see what's happening.

Dave Bittner: [00:17:00] Our thanks to John Clay from Trend Micro for joining us. The research is titled, "Cash and Communication: New Trends in the Middle East and North Africa Underground." We'll have a link in the show notes.

Dave Bittner: [00:17:12] Thanks to Juniper Networks for sponsoring our show. You can learn more at juniper.net/security, or connect with them on Twitter or Facebook.

Dave Bittner: [00:17:21] And thanks to Enveil for their sponsorship. You can find out how they're closing the last gap in data security at enveil.com.

Dave Bittner: [00:17:30] The CyberWire Research Saturday is proudly produced in Maryland out of the startup studios of DataTribe, where they're co-building the next generation of cybersecurity teams and technology. The coordinating producer is Jennifer Eiben. Editor is John Petrik. Technical editor is Chris Russell. Executive editor is Peter Kilpe. And I'm Dave Bittner. Thanks for listening.