Tomer Agayev leads a security team that keeps our hard-earned savings safe from fraudsters.

As threat research team lead at IBM Trusteer, Tomer guards the gateway to threats both known and unknown. His team’s responsibility is to monitor new and emerging threats, understand them intimately, and feed information to the cybersecurity protection content development teams so they know how to best defend against financial fraud.

The products developed by Tomer’s Trusteer colleagues are deployed by the world’s biggest financial institutions to protect their clients against malware, phishing, social engineering and more, and their success is largely thanks to Tomer’s penchant for figuring out what makes threat actors tick.

The World of Security Is ‘Pretty Amazing’

Tomer previously served in the Israeli Defense Forces and spent his last year of service as a system administrator and IT team leader. So when he entered the civilian workforce, information security was an obvious first port of call.

Tomer joined Trusteer in March 2013 as a help desk representative, but it wasn’t long before he felt he needed a change.

“I wanted to expand my knowledge, especially in a company like this that deals with information security at its heart,” he said. “That whole world is pretty amazing, and I knew there was more to learn and accomplish.”

So he spoke to managers and human resources, eager for an opportunity to grow and “make myself something bigger.” Luckily, Trusteer is a supportive and nurturing environment to work in, Tomer emphasized, and he soon began a new role as a security threat researcher.

Social Security: How Tomer Educates the Masses

One of the most common types of attack Tomer’s team encounters is social engineering.

“Most of the time, the threats will target the bank’s customers themselves; it’s the most popular attack,” he said.

He mentioned the work his team has done in Brazil to combat phone-based schemes: Fraudsters call businesses, introduce themselves as bank employees, and then trick customers into installing malware on their machines or prompt them to disclose their credentials.

It’s difficult to combat social engineering because it comes down to education, Tomer explained. Still, his team works tirelessly to research these cases and feed banks information to educate their customers about threats. By analyzing the malware, he said, the team can protect against malicious action regardless of social engineering.

“Even if the fraudster tries an attack, it would fail because our products are better and more powerful,” he said.

Still, it’s impossible for any mere human to keep up with the ever-evolving threat landscape, which is why the Trusteer team works with many automated processes. Tomer spoke proudly of its lab, which analyzes around half a million malware samples every year. As valuable as automation is, however, this analysis is augmented by manual hunting.

“This is one of the strengths of our threat research team,” he said. “We need to be in the trenches to know what’s going on, even if it’s not coming from the threat intelligence feeds we established,” he said.

Even if a threat hasn’t yet targeted the financial world, it’s still on Tomer’s radar; the Trusteer team often sees techniques shared across threat actors, he said.

A Threat Researcher Never Stops Learning

The life of a threat researcher is fast-paced and high-stakes, and there are new and unprecedented challenges to overcome every day. But that doesn’t bother Tomer in the slightest.

“It’s a lot of fun,” he said. “You need to learn all the time, which is something very important to me. When I’m stuck in one place that doesn’t challenge me, it’s a problem.”

In his free time, Tomer prefers quieter pursuits, such as nature photography and spending time with his wife.

“It’s the quiet; it’s very peaceful,” Tomer said of his photography hobby. “A lot of times, I find nature more fascinating than even a beautiful city landscape. It’s just so big and vast.”

Why You Should Always Be Suspicious

To work as a threat researcher, Tomer emphasized, you need to be curious, suspicious and ready to question what other people say. While conducting forensic analyses, threat researchers strive to “collect all the pieces of the puzzle” in order to recreate the entire scenario enacted by the fraudsters. Tomer likened this aspect of the job to solving a new mystery with each instance of fraud.

“In order to understand fraud, sometimes you need to think like a fraudster,” he said. “We need to try to understand how the other side would think to better understand how to combat them.”

Tomer also wants to make sure his friends and family are educated and aware of how to spot the fraud schemes that his team encounters so often.

“It’s a bit harsh to say, but the internet is not a safe place,” he said. “People just need to be aware that not everything that shines is a diamond.”

Meet Fraud Specialist Danna Pelleg

More from Fraud Protection

Web injections are back on the rise: 40+ banks affected by new malware campaign

8 min read - Web injections, a favored technique employed by various banking trojans, have been a persistent threat in the realm of cyberattacks. These malicious injections enable cyber criminals to manipulate data exchanges between users and web browsers, potentially compromising sensitive information. In March 2023, security researchers at IBM Security Trusteer uncovered a new malware campaign using JavaScript web injections. This new campaign is widespread and particularly evasive, with historical indicators of compromise (IOCs) suggesting a possible connection to DanaBot — although we…

Virtual credit card fraud: An old scam reinvented

3 min read - In today's rapidly evolving financial landscape, as banks continue to broaden their range of services and embrace innovative technologies, they find themselves at the forefront of a dual-edged sword. While these advancements promise greater convenience and accessibility for customers, they also inadvertently expose the financial industry to an ever-shifting spectrum of emerging fraud trends. This delicate balance between new offerings and security controls is a key part of the modern banking challenges. In this blog, we explore such an example.…

Remote access detection in 2023: Unmasking invisible fraud

3 min read - In the ever-evolving fraud landscape, fraudsters have shifted their tactics from using third-party devices to on-device fraud. Now, users face the rising threat of fraud involving remote access tools (RATs), while banks and fraud detection vendors struggle with new challenges in detecting this invisible threat. Let’s examine the modus operandi of fraudsters, prevalence rates across different regions, classic detection methods and Trusteer’s innovative approach to RAT detection through behavioral analysis. A rising threat As Fraud detection methods become more and…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today