Last Thursday, engineering and mathematical software firm Maplesoft reported that its administrative database had been breached. While specific details are not yet available, the breach may have been the result of an employee with access rights to the database getting infected with the well-known Zeus banking Trojan or another type of malware with key-logging capabilities, such as Dark Comet and Poison Ivy remote-access tools.

This attack demonstrates the ease with which a corporate network can be compromised. The breach was apparently only discovered because Maplesoft customers reported receiving phishing emails; otherwise, the attack could have gone undetected for an extended period.

In this banking Trojan incident, the attackers seemed primarily interested in conducting banking fraud since reports indicate they only compromised an email database. They then tried to distribute Zeus, which is often used for online banking fraud, to the stolen addresses.

However, they could have easily conducted corporate espionage once inside the network. The criminals may even be planning to steal secrets from companies that fall victim to the subsequent phishing attack they launched against Maplesoft’s customers. Using information loaded from the database, they sent emails that advised customers to install a Maplesoft patch which was, in fact, the Zeus banking Trojan.

This attack illustrates how financial malware is now “crossing over” to silently target enterprises. Using social engineering techniques like the software ploy described above, it is easy to see how criminals can get a toehold inside corporate networks. From there, it is trivial for the malware to steal user credentials that provide unrestricted access to sensitive databases, applications and files. This is a worrisome trend since an attacker with valid user credentials can silently pillage a company’s intellectual assets and be long gone before the compromise is ever discovered — if at all.

Endpoint cyber crime prevention tools such as those being used to protect online banking sessions are the most effective way to secure employee machines against sophisticated malware such as Zeus, SpyEye and others that now target enterprises directly.

Take a proactive response to today’s advanced persistent threats! Read the white paper to learn how

More from Fraud Protection

New DOJ Team Focuses on Ransomware and Cryptocurrency Crime

While no security officer would rely on this alone, it’s good to know the U.S. Department of Justice is increasing efforts to fight cyber crime. According to a recent address in Munich by Deputy Attorney General Lisa Monaco, new efforts will focus on ransomware and cryptocurrency incidents. This makes sense since the X-Force Threat Intelligence Index 2022 named ransomware as the top attack type in 2021. What exactly is the DOJ doing to improve policing of cryptocurrency and other cyber…

What Are the Biggest Phishing Trends Today?

According to the 2022 X-Force Threat Intelligence Index, phishing was the most common way that cyber criminals got inside an organization. Typically, they do so to launch a much larger attack such as ransomware. The Index also found that phishing was used in 41% of the attacks that X-Force remediated in 2021. That's a 33% increase from 2021. One of the biggest reasons threat actors are increasing phishing attacks is that all it takes is one employee to make a…

Top Security Concerns When Accepting Crypto Payment

From Microsoft to AT&T to Home Depot, more companies are accepting cryptocurrency as a way to pay for products and services. This makes perfect sense as crypto coins are a viable revenue source. Perhaps the time is ripe for businesses to learn how to receive, process and convert crypto payments into fiat currency. Still, many questions remain. How can you safely enable customers to pay with Bitcoin or other digital currency? What are the security risks that come with cryptocurrency? Let’s…

NFT Security Risks: Old Scams and New Tricks

The non-fungible token (NFT) boom has also led to some serious security incidents. For example, the number of suspicious-looking domain registrations with names of NFT stores increased nearly 300% in March 2021. To participate in an NFT marketplace, you must have an active cryptocurrency wallet. This exposes NFT holders to new risks as attackers can find ways into your crypto wallet through your marketplace account. As we’ll see, threat actors have even infiltrated NFT marketplace OpenSea’s Discord server posing as…