Singapore a ripe target for cyberthreats and banking trojans

• Threats increasingly target Singapore, an advanced digital banking market
• A look at some cyber-attack campaigns, and advice on what can be done

IBM X-Force researchers continuously monitor and track the activity and migration of malicious banking trojans around the world, and recently observed that Singapore is becoming a rising target for cybercriminals.
 
Due to the country’s unique demographics, which include a mix of Chinese- and English-speaking businesses, many of the attacks seen in western countries, as well as malware traditionally aimed at Asian targets, have increasingly turned their sights to Singapore.
 
The trends that affect the country nowadays range from traditional site redirection and content overlay to the more advanced PC and mobile malware that intercept out of band authentication elements such as texted verification codes.
 
In fact, just a few months ago, the Association of Banks in Singapore warned Singaporean mobile phone users against mobile malware posing as a ‘software update’ for the popular messaging app WhatsApp.
 
READ ALSO: APAC businesses expect fraud to increase in next 5yrs
 
Why Singapore?
 
It is no coincidence that threats increasingly target Singapore, which is one of Asia’s most advanced countries in digital banking, and has the highest variety of digital offerings (PDF).
 
In the global arena, Singapore has the second highest inclination for digital banking, according to an A.T. Kearney and EFMA global retail banking study (PDF).
 
Furthermore, the perpetual growth of high-value accounts and multinational corporations conducting business in Singapore makes the region even riper for financial cyber-attacks.
 
Most of the organisations in Singapore communicate in English, which also pairs with the fact that most malware campaigns are launched in English.
 
However, our researchers are also seeing an increase of Chinese language based activity on the Dark Web in the region. This is yet another contributing factor to the increase of fraud directed at entities and individuals in Singapore as Chinese is also considered an official language of the country.
 
It is rather clear that Singapore is proving to be a valuable target for cybercriminals.
 
Here are some of the recent top malware campaigns targeting Singapore:
 
The Dridex trojan
 

 
The Dridex banking trojan, which was built on the Bugat code base, has been identified as the top malware family targeting Singaporean banks in 2016 so far. Moreover, Dridex represents 84% of attacks in the country over the past year.
 
Our research suggests that the organised cybercrime gang behind this malware is mimicking advanced attack methods, such as Dyre’s trademark ‘redirection’ attack technique, as it continues to intensify its focus on high-value business accounts in the region.
 
Leveraging the redirection attack technique, Dridex victims are unknowingly sent to an entirely new, fake website when they try to browse to their online banking site. Since they are immediately redirected to a fake site, they never actually access the bank’s true site.
 
The power of this attack lies in its simplicity. By keeping the user away from their bank’s site, the attacker can deceive them into divulging personal authentication codes without the bank’s counter-fraud systems recognising that a customer’s session has been initiated or diverted.
 
These tactics have already been seen in other parts of the world and are now shifting to Singapore.
 
The Tinba v3 Trojan
 
X-Force researchers first discovered Tinba targeting Singaporean banks in 2015, and this malware continues to be one of the most active threats in the region today.
 
In December 2015, Tinba v3 set its sights on business and corporate accounts held with nine major bank brands in Singapore. These Singaporean banks became the top target for the malware campaign, accounting for more than one-third of all Tinba-targeted brands.
 
In fact, Singapore is in the crosshairs of Tinba v3 27% of the time, making it the most targeted country for Tinba.
 

 
Tinba v3 continues to be an advanced, actively developed banking trojan and according to iuyr ongoing research into this malware’s evolution, it is likely to have a dedicated development team behind it.
 
GM Bot
 
GM Bot, mobile malware that affects Android based devices, is the latest and most popular commercial malware that organisations in Singapore need be aware of.
 
While it first emerged in the Russian-speaking cybercrime underground in 2014, GM Bot’s source code was recently leaked, making the trojan accessible to potential attackers to use for free.
 
With the code leaked, more cybercriminals can now recompile the code, create new variants and customise it for specific regions.
 
GM Bot is specifically designed to help fraudsters steal banking and payment credentials, as well as bypass verification techniques used in banking transaction authorisation.
 
For example, GM Bot can launch fake overlay windows to mimic bank applications to steal user login details and payment card information.
 
Additionally, the malware can control a device’s SMS relay and voice calls to intercept verification code text or calls incoming from a bank to the user.
 
How can Singapore fight back?
 
Singaporean organisations should consider using technologies that can adapt to emerging threats to detect infections and protect customer endpoints.
 
However, leveraging the right detection solutions is only part of the battle, and banks should also look to educate users, deploy specialised solutions for the detection of redirection attacks, and keep its security team ahead of emerging malware trends.
 
Keeping up to date is made easier by joining threat intelligence sharing platforms in order to share critical threat information and understand how to react to ever-changing threats.
 
As today’s cybercriminals continue to share information with each other on the Dark Web, those in the security community must also unite to these new breeds of increasingly sophisticated threats.
 
Limor Kessem is a senior cybersecurity evangelist at Trusteer (IBM Security).
 
Related Stories:
 
Singapore is world’s No 1 target for banking trojans: Kaspersky
 
Asian banks being targeted, time to get holistic on security
 
Mobile banking apps more vulnerable than you think: Researcher
 
 
For more technology news and the latest updates, follow us on Twitter, LinkedIn or Like us on Facebook.