Computer Cyber Crime Unit

A compromise in the security of an online data repository that arises through negligence or deliberate attack. It is then exploited to foster further harmful or criminal action. Often a criminal will gain access to a computer network through exploiting an unpatched vulnerability, installing malware on the target system, using stolen credentials (or brute-forcing weak passwords), or social engineering. However, data breaches are not only the target of external actors. It is also quite common for insider threats such as disgruntled employees to steal or destroy data as well. Some motivations for data breaches include:

Extortion

A criminal will steal data and threaten to release it publicly unless the victim pays them (usually in bitcoin).

Sale of Personally Identifiable Information (PII)

Criminals will steal personally identifiable information and resell it to criminals who use it for other crimes such as fraud and money laundering.

Industrial Espionage

Theft of company data or trade secrets for financial gain. This type of activity is typically carried out by state actors, business competitors, or employees who are leaving to work for a competitor or start their own company.

Phishing is a common threat in which criminals, posing as a trustworthy entity like a financial institution or government, will try to acquire your personal information by sending fake emails, text messages, or by impersonating a website. Many of these phishing campaigns are mass-market campaigns that are generic and target millions of people. Spear-phishing on the other hand is a type of phishing campaign where a criminal will conduct background research on a potential victim to specifically tailor the phishing email to that individual. Phishing is the medium for a whole host of criminal activity including:

Wire Fraud

Wire transfer frauds that are perpetrated through phishing attacks typically come in one of two flavours:

• The Vendor Scam,where a criminal will craft a convincing email or invoice from one of a business’s suppliers or service providers (such as a web hosting service) providing a new account that is controlled by the fraudster. In some cases the criminal may have access to the email accounts of the business, the vendor, or both allowing them to craft very convincing and legitimate-looking emails.
• The Business Executive Scam,where a criminal will send an email to business posing as the CEO or another high level executive from the company (sometimes using a legitimate, but compromised email account) demanding a wire transfer to an account controlled by the fraudster.

Extortion

Many of these cases take the form of the mass-market phishing campaign targeting potential victims at random. The emails will state that the criminal has compromising video of the victim or evidence of an affair. It will then demand a ransom (usually in bitcoin) in exchange for not releasing the information. In most cases the criminal does not have any compromising information and is banking on a small number of victims actually being guilty of what the email accuses them of (usually of having an affair or viewing child pornography) and taking the threat seriously.

Spreading Malware

Another common use of phishing attacks are simply to trick potential victims into clicking a malicious link or opening a malicious document in order to install malware on their computer to facilitate some sort of criminal activity. Depending on what kind of malware is installed the criminal may be able to harvest login credentials, steal data, gain access to networked devices or install ransomware on the target system.

A ransomware attack occurs when a cybercriminal infects a victim’s computer systems with malware that encrypts the data on those systems making them inaccessible and unusable without the key to decrypt it. The cybercriminals then demand some sort of ransom (usually in bitcoin) in exchange for the decryption key.

Mass Market

This type of ransomware campaign does not target a particular victim. It is usually spread by phishing email and mimics a well-known and trusted entity such as a popular tech company, financial institution, or government agency.

Targeted

These campaigns typically target institutions and businesses rather than individuals, and will usually focus on a particular type of business, such as manufacturing, healthcare, or academia. They may use spearphishing attacks to gain access to target systems or hack the systems directly using known vulnerabilities. In many cases criminals will explore target systems and attempt to delete any connected backups before installing the ransomware.