This week, the FBI warned financial institutions about malware attacks that are targeting their employees to steal login credentials. Although financial malware such as Zeus and SpyEye have been used to attack online banking customers for years, using these tools to perpetrate fraud directly against financial institutions by compromising employee bank accounts is relatively new. We are not surprised by this development. Last year, IBM Security predicted that 2012 would be the year financial malware would be used to attack enterprises.

So, why is this happening?

Web Fraud Detection Investments Starting to Pay Off

According to the 2012 Web Fraud Detection (WFD) Magic Quadrant report, many WFD customers reported fraud reduction rates of 80 percent or more. Banks are simply doing a better job of protecting against malware today than they did in the past. With their livelihood at stake, criminal gangs are now looking to get a foothold deep inside financial institutions to bypass controls that are standing in the way of their financial fraud schemes. They are now attacking bank employees with the same advanced malware and extensive mule and money laundering processes used to commit fraud against online banking users.

Enterprise Security Is Not Effective Against Malware Attacks

Most financial institutions implement controls such as antivirus protection on endpoint devices and intrusion prevention systems on networks. Both are evaded by malware kits that are readily available in the underground market. IBM Security intelligence has found that the infection rate of enterprise endpoints can reach up to 4 percent, as calculated on an annual basis. Over the past 12 months, one large U.S. bank has removed or blocked more than 20 different financial malware families from enterprise endpoints using IBM Security Trusteer Rapport.

Financial Malware Is ‘Maturing’

Earlier this year, we published several blogs on malware attacks targeting enterprise endpoints, including point-of-sale computers, payroll systems and employee VPN access. What did these attacks have in common? They all used garden-variety financial malware Trojans such as Zeus (or one of its many derivatives) and SpyEye.

This FBI report specifically mentions two types of malware attacks: keylogging and remote access tools (RATs). While key-logging has existed for many years, RATs are a relatively new addition to financial malware (e.g., Zeus) toolkits. They have been specifically added to enable pre-attack reconnaissance and attacks on non-browser-based applications on employee endpoints.

So, What Should Financial Organizations Do?

The FBI warning outlines a set of 16 security recommendations that, if followed, should protect against these attacks. However, few organizations can effectively implement all 16 recommendations in a timely manner without adversely affecting employee productivity and existing business processes. IBM recommends that organizations increase their focus on the root cause of these attacks: advanced malware. Organizations should implement security controls that prevent and remove malware infections and stop key-logging, screen-capturing and remote-acess Trojans’ activity.

More from Banking & Finance

How to Spot a Nefarious Cryptocurrency Platform

Do you ever wonder if your cryptocurrency platform cashes in ransomware payments? Maybe not, but it might be worth investigating. Bitcoin-associated ransomware continues to plague companies, government agencies and individuals with no signs of letting up. And if your platform gets sanctioned, you may instantly lose access to all your funds. What exchanges or platforms do criminals use to cash out or launder ransomware payments? And what implications does this have for people who use exchanges legitimately? Blacklisted Exchanges and Mixers…

Kronos Malware Reemerges with Increased Functionality

The Evolution of Kronos Malware The Kronos malware is believed to have originated from the leaked source code of the Zeus malware, which was sold on the Russian underground in 2011. Kronos continued to evolve and a new variant of Kronos emerged in 2014 and was reportedly sold on the darknet for approximately $7,000. Kronos is typically used to download other malware and has historically been used by threat actors to deliver different types of malware to victims. After remaining…

Why Cybersecurity Risk Assessment Matters in the Banking Industry

When customers put money in a bank, they need to trust it will stay there. Because of the high stakes involved for the customer, such as financial loss, and how long it takes to resolve fraud and potential identity theft, customers are sensitive to the security of the bank as well as fraud prevention measures. Banks that experience high volumes of fraud are likely to lose customers and revenue. The key is to protect customers and their accounts before problems…

Cost of a Data Breach: Banking and Finance

The importance of cybersecurity has touched almost every industry. Beyond that, robust cybersecurity is table stakes for several sectors, particularly health care and the banking and finance industry. Not only is financial data at risk, but so is customer trust. In banking and finance, trust means everything. Yet, consumers are hesitant to share their confidential data. A recent McKinsey survey revealed that no industry achieved a trust rating of 50% for data protection. Here’s the most sobering stat: 87% of…