Tomer Agayev leads a security team that keeps our hard-earned savings safe from fraudsters.

As threat research team lead at IBM Trusteer, Tomer guards the gateway to threats both known and unknown. His team’s responsibility is to monitor new and emerging threats, understand them intimately, and feed information to the cybersecurity protection content development teams so they know how to best defend against financial fraud.

The products developed by Tomer’s Trusteer colleagues are deployed by the world’s biggest financial institutions to protect their clients against malware, phishing, social engineering and more, and their success is largely thanks to Tomer’s penchant for figuring out what makes threat actors tick.

The World of Security Is ‘Pretty Amazing’

Tomer previously served in the Israeli Defense Forces and spent his last year of service as a system administrator and IT team leader. So when he entered the civilian workforce, information security was an obvious first port of call.

Tomer joined Trusteer in March 2013 as a help desk representative, but it wasn’t long before he felt he needed a change.

“I wanted to expand my knowledge, especially in a company like this that deals with information security at its heart,” he said. “That whole world is pretty amazing, and I knew there was more to learn and accomplish.”

So he spoke to managers and human resources, eager for an opportunity to grow and “make myself something bigger.” Luckily, Trusteer is a supportive and nurturing environment to work in, Tomer emphasized, and he soon began a new role as a security threat researcher.

Social Security: How Tomer Educates the Masses

One of the most common types of attack Tomer’s team encounters is social engineering.

“Most of the time, the threats will target the bank’s customers themselves; it’s the most popular attack,” he said.

He mentioned the work his team has done in Brazil to combat phone-based schemes: Fraudsters call businesses, introduce themselves as bank employees, and then trick customers into installing malware on their machines or prompt them to disclose their credentials.

It’s difficult to combat social engineering because it comes down to education, Tomer explained. Still, his team works tirelessly to research these cases and feed banks information to educate their customers about threats. By analyzing the malware, he said, the team can protect against malicious action regardless of social engineering.

“Even if the fraudster tries an attack, it would fail because our products are better and more powerful,” he said.

Still, it’s impossible for any mere human to keep up with the ever-evolving threat landscape, which is why the Trusteer team works with many automated processes. Tomer spoke proudly of its lab, which analyzes around half a million malware samples every year. As valuable as automation is, however, this analysis is augmented by manual hunting.

“This is one of the strengths of our threat research team,” he said. “We need to be in the trenches to know what’s going on, even if it’s not coming from the threat intelligence feeds we established,” he said.

Even if a threat hasn’t yet targeted the financial world, it’s still on Tomer’s radar; the Trusteer team often sees techniques shared across threat actors, he said.

A Threat Researcher Never Stops Learning

The life of a threat researcher is fast-paced and high-stakes, and there are new and unprecedented challenges to overcome every day. But that doesn’t bother Tomer in the slightest.

“It’s a lot of fun,” he said. “You need to learn all the time, which is something very important to me. When I’m stuck in one place that doesn’t challenge me, it’s a problem.”

In his free time, Tomer prefers quieter pursuits, such as nature photography and spending time with his wife.

“It’s the quiet; it’s very peaceful,” Tomer said of his photography hobby. “A lot of times, I find nature more fascinating than even a beautiful city landscape. It’s just so big and vast.”

Why You Should Always Be Suspicious

To work as a threat researcher, Tomer emphasized, you need to be curious, suspicious and ready to question what other people say. While conducting forensic analyses, threat researchers strive to “collect all the pieces of the puzzle” in order to recreate the entire scenario enacted by the fraudsters. Tomer likened this aspect of the job to solving a new mystery with each instance of fraud.

“In order to understand fraud, sometimes you need to think like a fraudster,” he said. “We need to try to understand how the other side would think to better understand how to combat them.”

Tomer also wants to make sure his friends and family are educated and aware of how to spot the fraud schemes that his team encounters so often.

“It’s a bit harsh to say, but the internet is not a safe place,” he said. “People just need to be aware that not everything that shines is a diamond.”

Meet Fraud Specialist Danna Pelleg

More from Fraud Protection

Remote access detection in 2023: Unmasking invisible fraud

3 min read - In the ever-evolving fraud landscape, fraudsters have shifted their tactics from using third-party devices to on-device fraud. Now, users face the rising threat of fraud involving remote access tools (RATs), while banks and fraud detection vendors struggle with new challenges in detecting this invisible threat. Let’s examine the modus operandi of fraudsters, prevalence rates across different regions, classic detection methods and Trusteer’s innovative approach to RAT detection through behavioral analysis. A rising threat As Fraud detection methods become more and…

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

The rise of malicious Chrome extensions targeting Latin America

9 min read - This post was made possible through the research contributions provided by Amir Gendler and Michael  Gal. In its latest research, IBM Security Lab has observed a noticeable increase in campaigns related to malicious Chrome extensions, targeting  Latin America with a focus on financial institutions, booking sites, and instant messaging. This trend is particularly concerning considering Chrome is one of the most widely used web browsers globally, with a market share of over 80% using the Chromium engine. As such, malicious…

What to do about the rise of financial fraud

6 min read - As our lives become increasingly digital, threat actors gain even more avenues of attack. With the average person spending about 400 minutes online, many scammers enjoy a heyday. Old impersonation scams continue to deceive people every day, as con artists and hackers are armed with advanced technologies and sophisticated social engineering tactics. According to the Federal Trade Commission, financial fraud increased by over 30% from 2021 to 2022, with total losses surpassing $8.8 billion. This ever-evolving threat will continue to…