Cybercrime

Cybercrime is the use of electronic communication for criminal activities. The concept of cybercrime depends upon the purpose of the term. Cybercrime almost always encompasses acts against the confidentiality, integrity, and availability of computer data or systems. More broadly, the term refers to computer/content-related acts for personal or financial gain or harm.

History

Proto-cybercrime: Phone Phreaking
In the 1970s, crimes were committed via telephone lines much like they are today via the Internet. The perpetrators, called "Phreakers," figured out that the U.S. telephone system functioned on the basis of tones. Notoriously, John Thomas Draper, Steve Jobs, and Steve Wozniak reverse-engineered and imitated the tones needed to route long-distance calls. The computerization of telecommunications led to the end of the phreaking era, and the culture shape-shifted into computer hacking.
Hacking Becomes a Criminal Act
In 1982, Ian Murphy, aka Captain Zap, became the first person to be found guilty of a cybercrime, after hacking AT&T and manipulating its internal clock to enable free calls during peak hours.
First Governmental Response to DNS Misuse
On Nov. 2, 1988, Robert Tappan Morris released a worm that halted one-tenth of the Internet and led to the founding of the first Computer Emergency Response Team (CERT).
First Time a Hacker Makes Most Wanted List
In 1995, the FBI notifies the public that it really wanted to catch Kevin Mitnick for social engineering attacks and stealing sensitive government and personal financial data.
Expansion of Criminal Operations
In 2019, Interisle conducted a study on Criminal Abuse of Domain Names Bulk Registration and Contact Information Access, which explained that cybercriminals take advantage of bulk registration services to launch attacks across many domain names and that ICANN’s Temporary Specification for gTLD Registration Data has had a detrimental effect on cybercrime investigations.

2021 Cybercrime Reports

Current trends in cybercrime revolve around how the COVID-19 pandemic has shaped everyday work/home life and highlighted the importance of cyber networks in maintaining critical infrastructure.

• PurpleSec's 2021 Cyber Attack Report indicates that:

1. Receiving 38% of cyber attacks, the U.S. the number one victim of cybercrime
2. 92% of malware is delivered by email
3. 43% of cyber attacks target small businesses
4. 21% of Financial institutions suffered a Watering Hole Attack in 2020
5. 32% of financial institutions encountered Island Hopping, which refers to attackers using one compromised organization to gain entry into another
6. 25% of all malware attacks hit financial industries, more than any other critical infrastructure sector

• INTERPOL’s ASEAN Desk identified the top cyber threats as:

1. Business Email Compromise, as a high-return investment with low cost and risk;
2. Phishing, using COVID-19 jargon and misinformation to deceive unsuspecting victims;
3. Ransomware, to target medical centers and public institutions, expecting a better success rate due to the pandemic;
4. E-commerce Data Interception, undermining trust in online payment systems.
5. Malware-as-a-Service, are reaching non-technical threat actors and requiring minimal investment;
6. Cyberscams, because of the pandemic, more people are conducting transactions and working from home online; and
7. Cryptojacking, as the value of cryptocurrencies increases.

• Mandiant's M-Trends 2021 Report

1. 59% of the security incidents investigated by Mandiant last year were initially detected internally by the organizations themselves (12% better than in 2019).
2. Ransomware has evolved and now employs various extortion tactics.
3. FIN11, a financially motivated threat group, was responsible for widespread phishing campaigns and extortion operations.
4. The median dwell time dropped as threat actors capitalized on pandemic-related shifts in work/home life.
5. UNC2452, an uncategorized state-sponsored group, engaged in a broad espionage campaign after injecting a backdoor dynamic-link library (DLL) into the SolarWinds Orion process.
6. 63% of attackers used techniques outlined in the MITRE ATT&CK framework, and 5% of intrusions used over 1/3 of MAF techniques.
7. Threat actors exploited vulnerabilities in the infrastructure supporting work at home.

• Spamhaus's 2021 Q2 Report
  

This report focused on botnet Command and Control activity and compared the findings from Q1 with Q2. Key figures:

1. A 594% increase of newly registered botnet C&C domains at NameSilo! This sudden uptick knocked Namecheap out of first place.
2. Working with the FBI, Spamhaus discovered 1.3 million compromised email accounts; 22,000 compromised domains; and 3,000 compromised networks.
3. The three hosting providers with the largest abuse problems and/or worst responses to abuse reports are Ipjetable, Google, and Microsoft.
   

Other significant Spamhaus findings:

Top 20 Most Commonly Used Malware Families (ranked)	Function	Most Commonly Attacked TLDs (ranked)	Top 20 Geo-Locations of C&C Botnet Servers (ranked)
Raccoon	dropper	.com	U.S.
RedLine	remote access trojan (RAT)	.xyz	Russia
AsyncRAT	Credential Stealer	.buzz	Netherlands
Loki	RAT	.top	Germany
Gozi	RAT	.br	France
BitRAT	Credential Stealer	.vip	Latvia
Oski	RAT	.org	U.K.
VjWOrm	Credential Stealer	.ru	Ukraine
NjRAT	Credential Stealer	.net	Switzerland
RemcosRAT	e-banking Trojan	.cloud	Seychelles
NanoCore	RAT	.tk	Czech Republic
AgentTesla	RAT	.cn	Moldova
Tofsee	RAT	.eu	Panama
Arkei	RAT	.ga	Canada
STRRAT	credential Stealer	.ml	Malaysia
CryptoBot	credential Stealer	.online	Poland
CobaltStrike	RAT	.live	Finland
ServeHelper	credential Stealer	.su	Vietnam
IcedID	dropper	.info	Turkey
QuasarRAT	dropper	.cf	Brazil

Organizations

FBI	Focus Areas
	Advance Fee Schemes
	Business Email Compromise
	Business Fraud
	Charity and Disaster Fraud
	Counterfeit Prescription Drugs
	Credit Card Fraud
	Elder Fraud
	Election Crimes and Security
	Fraudulent Cosmetics and “Anti-Aging” Products
	Funeral and Cemetery Fraud
	Health Care Fraud
	Identity Theft
	Illegal Sports Betting
	Internet Auction Fraud
	Internet Fraud
	Investment Fraud
	Letter of Credit Fraud
	Market Manipulation (“Pump and Dump”) Fraud
	Money Mules
	Nigerian Letter or “419” Fraud
	Online Vehicle Sale Fraud
	Ponzi Schemes
	Prime Bank Note Fraud
	Pyramid Schemes
	Ransomware
	Redemption/Strawman/Bond Fraud
	Reverse Mortgage Scams
	Romance Scams
	Sextortion

The following IGOs, NGOs, and U.S. government agencies are key opponents of global cybercrime.

Organization	Focus Areas
EC Action Against Cybercrime	capacity buidling for compliance with Budapest Convention
INTERPOL	transnational information sharing
ITU	harmonization of technical standards
UNODC	thematic reports on transnational crimes;
	database of trans/national legislation and case law on cybercrime
APWG	industry association combats phishing and Email Spoofing;
	data standards and model response systems and protocols
Spamhaus	provides real time, actionable threat intelligence to
	network operators, corporations, and Cybersecurity vendors
eNASCO	child safety online
INHOPE	combating child pornography
IWF	combating child sexual abuse
The Rand Corporation	credible research
CCIPS	prosecuting computer and IP crimes
ECTF	investigating identify theft, network intrusions;
	Business Email Compromise (BEC), and ransomware
C3	technical support for cross-border crime
IC3	cybercrime complaints