In the fourth quarter of 2016, the number of users that encountered malware capable of stealing money or valuable financial information reached 319,000, 22.49% more than in the same period in 2015. An increase in the number of attacks was spotted during the White Friday and the holiday period, according to Kaspersky Lab research.
The holiday season is an attractive period of time, not only for retailers experiencing a high demand for their products and shoppers looking for great deals, but also for cyber criminals who don’t hesitate to explore new opportunities to exploit people illegally, at a time of year when more users are spending money online than usual.
At end of 2016, Kaspersky Lab researchers conducted a retrospective look at the cyber threats landscape during the holiday period (October, November and December) in the last three years. The main conclusion of their analysis was that criminals are trying to tie their malicious campaigns to specific holiday dates.
Dynamics of attacks with financial malware during Q4 2016 (holiday period)
Analysis of the holiday period in 2016 showed that last year’s season wasn’t the exception. Kaspersky Lab protection technologies detected attacks against 22.49% more users than in the same period in 2015. This means that after a decrease in 2014, cybercriminals are again investing in developing malware capable of stealing financial data, such as credit card information and online banking credentials.
As the dynamics of attacks in November 2016 showed, the most attractive day of the fall-winter holidays for cybercriminals is Cyber Monday- a day dedicated to online sales and shopping worldwide. In November 2016, Kaspersky Lab protection technologies detected a clear spike in the number of users attacked, and on November 28th (Cyber Monday) there were twice as many users attacked than during the previous day.
When it comes to the White Friday and the holiday periods, the pattern is different, with the spikes in attack dynamics occurring one or two days prior to the actual holiday dates. These differences in malicious behavior can be explained by the different nature of the holidays. Unlike White Friday and the holiday period, Cyber Monday is all about online sales worldwide, thus criminals see more sense in focusing their malicious campaigns on this particular date.
To reach their goals, criminals used one of 30 families of banking trojans, consistently tracked by Kaspersky Lab. Five of these are the most widespread: Zbot, Nymaim, Shiotob, Gozi and Neurevt. These trojans are responsible for attacks against 92.35% of users in the holiday period.
“Data on the dynamics of attacks shows that financial malware operators tried to attach their activity to particular dates in 2016, and the holiday season’s contribution to the number of financial malicious attacks during this time is clearly visible. Financial malware attacks are on the rise again and all their targets – from owners and clients of e-shops, to credit card holders and banks – should be aware of the dangers and take adequate steps to stay safe. As a holiday season follow-up protection measure, we advise shoppers who used their credit cards to buy presents and goods during last three months to keep an eye on their financial transaction information in the coming months. Typically, criminals don’t start to withdraw money from stolen cards right after the theft. They often wait for several weeks or even months to prepare for cashing out first,” said Oleg Kupreev, security expert at Kaspersky Lab.
Although the holiday season is over, Kaspersky Lab advises people to keep in mind several simple rules to stay safe when it comes to financial operations online:
- Do not click on any links received from unknown people, or on suspicious links sent by your friends on social networking sites or via e-mail. They can be malicious.
- Do not enter your credit card details on unfamiliar or suspicious sites, to avoid passing them into cybercriminal hands. If these websites are offering advantageous deals that look too good to be true, they most likely belong to criminals.
- Always double-check the webpage is genuine before entering any of your credentials or confidential information (at least take a look at the URL). Fake websites may look just like the real ones.
- Install a security solution on your device, with built-in technologies designed to prevent financial fraud. For example, the Safe Money technology in Kaspersky Lab’s solutions creates a secure environment for financial transactions on all levels.
Read more about financial threats during holiday season 2016 in our blog on Securelist.com.
