Kaspersky reports on cybercriminal activity on the Darknet market in the region

27 September 2022

According to Kaspersky’s Digital Footprint Intelligence (DFI) report for APAC, database leaks in the region account for 95% of the total amount of advertisements. Singapore’s and Australia’s data leaks market are by far the largest when looking at the weighted GDP amounts of orders.

The report highlights results collected last year for organisations and even countries to keep an eye on possible external threats and stay informed about potential cybercriminal activities, including ones being discussed on the Darknet.

Monitoring of external data sources in Kaspersky’s Digital Footprint Intelligence service, including Darknet resources, provides insights into cybercriminal activity through different stages of attack lifecycle. In this the second part of the report, the company presents Darknet analysis results.

There are two major types of data found when analyzing an organisation’s digital footprint: fraudulent activities and cyberattack footprints. While Kaspersky discovered numerous fraud signs, the focus in the report remains on attack detection.

Darknet activity related to attack impact (advertisements on selling data leaks and compromised data) dominates the statistics as these are spread over time, where criminals sell, resell and repack a lot of data leaks from the past.

Stage 1: Interest to buy access

Cybercriminals who are looking for initial access offers know that there is a large market of such advertisements. Organisations from Australia, India, mainland China and Pakistan are the major adversaries’ interest to start an attack. These countries were present in 84% of ads from the attack preparation category.

Pakistan and Australia attract huge interest as seen by the number of orders weighted with their GDP.

Looking at the size of infrastructure, businesses, and industrialisation – mainland China poses relatively low interest for adversaries. This may indicate the presence of a language barrier cybercriminal scene in the APAC region or the complications with network-level access to organizations in the country.

Access buy order is a request to buy access to a single or a list of specific organizations or industries in a specific region.

Insider activity buy orders, however, are requests to buy insider services which can lead to credentials or data leaks, source of information gathering service (e.g., PII data exfiltration by request). Those orders are the most inconclusive type of findings for remediation planning.

Stage 2: Orders for access – ready to execute

The most promising findings are from attack execution stage: artifacts are stating that adversaries have capabilities or already have access to organizations’ networks or services, but there is no business impact yet. In terms of advertisements on the Darknet, indicating an attack executed, Australia, India, mainland China and the Philippines cover 75% of those detected by Kaspersky.

It is divided into three types:

• Initial access brokers – Sell orders for specific organisations, or bulk orders with organisations grouped by industry and/or region.
• Insider activity sell orders – Request to sell insider services that can lead to credentials leak, source of information gathering service (e.g. PII data exfiltration by request), or data leak. The source is usually an insider’s broker.
• Malware logs – Credential stealing malware (stealers) collect credentials into resalable or otherwise accessible data with account usernames and passwords.

Philippines, India, and mainland China are dominating the insider services market with 82% of orders turnover.

Stage 3: Data leaks and data for sale

Once a data leak occurs, the sale or free access to the stolen information will follow. An indicator of compromise can be data leaks as well as insider activity orders – sale or free access to internal data, including but is not limited to databases, confidential documents, PII, credit cards, VIP information, financial data and many more.

Organisations from Australia, mainland China, India, and Singapore take 84% of all data leaks sell orders placed on the Darknet.

Singapore’s and Australia’s data leaks market are by far the largest when looking at the weighted with GDP amounts of orders.

It should be noted, that Philippines, Pakistan, and Thailand organisations were among the adversaries interest to begin an attack or appeared as already compromised, but the amount of data leaks is on par with other countries from the middle of the group.

“Cybercriminal operations beneath the surface web are clearly busy. From attack preparation and execution, to the impact of a data leak and then selling and reselling of stolen information, this functioning malicious system is a serious threat for businesses and organisations here in APAC,” says Chris Connell, Managing Director for Asia Pacific at Kaspersky.

“Selling data and access to the companies often goes hand in hand. This means a successful attack to your organisation can be two pronged. Your confidential information can be stolen and be sold, and these cybercriminals can open and offer your infected system to more malicious groups. A double whammy that requires a proactive defense that includes strong incident response and Darknet monitoring capabilities through real-time and in-depth threat intelligence reports,” he adds.

How to protect your company from these kind of threats

Demand for corporate and personal data on the black market is high, and it doesn’t always involve targeted attacks. Attackers may gain access to the infrastructure of a random company to sell it to blackmailers or other advanced cybercriminals later.

An attack like this can affect a company of any size, big or small, because corporate system access is often priced moderately on underground forums, especially compared to the potential damage to a business.

Sellers on the dark web most often offer remote access via RDP. To protect corporate infrastructure from attacks through remote access and control services, make sure the connection via this protocol is secure by:

• providing access to services (for example, RDP) only through a VPN,
• using strong passwords and Network Level Authentication (NLA),
• using two-factor authentication for all services,
• monitoring for leaks of access data. Dark web monitoring is available on Kaspersky Threat Intelligence Portal.

[1] The weighted value is the ratio of adverts number to GDP

Click here to purchase Kaspersky solutions on Shopee.

By Anton Ivanov, Chief Technology Officer at Kaspersky

September 28, 2022

Digital transformation, that’s been boosted by the pandemic, has reached an unprecedented scale, with IDC expecting its global spending to reach $2.8 trillion within three years. Companies shifting their businesses online inevitably led to an increased adoption of digital products and a surge in IT expenditure. According to rough estimates, an average organization used about 110 different software-as-a-service applications in 2021. In comparison, that figure stood at 16 just five years ago. It’s clear that we are currently in a stage of high software consumption. What isn’t clear though is whether it has already peaked or if the peak is yet to come.

From a cybersecurity perspective, a business’ reliance on numerous types of software is a big issue as threat actors can benefit from the expanded attack surface. A recent global survey of over 400 companies showed that 98% of organizations were concerned about the security of their software. However, there isn’t much that they can do about it, aside of diligently patching their software as soon as updates are available.

However, on a level of mature enterprise, sustainability of IT infrastructure that includes various types software depends how much we know about each solution and our visibility into them. IT products are developed with extensive use of various open source libraries and elements sourced from third parties. With dozens and hundreds of software solutions in use, this means that achieving high level of visibility is extremely challenging. Without clear security requirements for evaluating software security and promoting greater transparency, the cyber domain is likely to remain under limited control.

One of the concepts aimed at streamlining the connections across software supply chains is Software Build of Materials (SBOM). Borrowed from manufacturing, where the ‘Build of Materials’ represents a list of items used in a product, SBOM is a de facto list of components that make up a software, containing comprehensive information and describing the relationships between each elements. By having SBOMs in place, businesses have more chance of coping with security vulnerabilities and cybersecurity risks in a prompt manner by employing automation tools which can track newly identified flaws across them all.

In the fall of 2021, as part of its transparency efforts, Kaspersky made its SBOMs available at the company’s Transparency Centers. These centers primarily serve as facilities for the review of the company’s code, software updates, threat detection rules and other technical and business processes. Along with measures implemented by Kaspersky as part of its Global Transparency Initiative (GTI), the inclusion of SBOMs aims to empower our customers and partners with the information on how exactly our products are designed, what components they are made of, and how they operate. In doing this, our key goal is to ensure greater visibility into our solutions, our work and to give firm assurance in the security and integrity of our products.

Despite the fact that regulators and private players have praised the SBOM concept as crucial for ensuring sustainable and safe software use, fresh statistics show that fewer than a half of software developers use SBOMs to some extent today. On top of that, a mere 18% of companies use SBOMs across all segments of their business or have established practices that include the use of SBOMs.

The situation could potentially change in the near future as some governments can start considering SBOMs a necessary measure to enhance risk management in supply chains. The first being the US where, after the SolarWinds incident, SBOM has been promoted at a government level to become a wide-industry effort. Hopefully, the SBOM concept for software transparency will turn into an international effort.

Speaking of clear security requirements for software security, the European Union has also started a wider discussion on a legal framework that would bring together cybersecurity rules for digital products and services. It is likely that other governments will follow the EU’s lead, ensuring software vendors place adequate cybersecurity safeguards in their solutions, effectively respond to vulnerabilities throughout their products’ lifecycle, and systematically provide information on the product’s security. All these measures, while requiring greater transparency from software manufacturers, have the potential to enhance the security of products and build public trust in the digital economy.

For Kaspersky, the security of our users and customers is our first and foremost priority. The trust of our customers has always been seen as indispensable, and that’s why we make every effort to provide them with as much visibility into our work as possible. In 2017 we launched our GTI which was aimed at further strengthening our relationships with our partners and customers by boosting their assurance and trust in our solutions and services. We continue to develop and strengthen this initiative, for example, we have recently successfully renewed our SOC 2 audit for the protection of the development and the release process of our antivirus basis by a Big Four firm.

The industry developments that we see today indicate that transparency is achieving greater prominence: this is reflected by developments within the industry and various governments’ increasing their attention to greater security and integrity of software. Kaspersky, for its part, will seek to deliver solid support for this trend, making further continued investment in digital trust and transparency.

Click here to purchase Kaspersky solutions on Shopee.