A cybercrime group most likely based in the United States or Western Europe has been systematically targeting email accounts belonging to high-ranking corporate executives in order to gain access to insider information on mergers, acquisitions and other market-moving announcements, according to a recent report. This criminal campaign has been ongoing since at least mid-2013 and appears to be designed to extract information that could be used to manipulate the stock market.

Widespread Campaign

So far, executives from at least 100 publicly traded firms in various industries have been targeted. What remains unknown is how the cybercrime group, dubbed FIN4, is actually using or benefiting from the data, researchers at security vendor FireEye said in a report released Monday.

“However, one fact remains clear: Access to insider information that could make or break stock prices for dozens of publicly traded companies could surely put FIN4 at a considerable trading advantage,” the company noted.

Cybercrime Group Targets Health Care and Pharmaceutical Companies

FIN4’s targets have included C-level executives and other senior leadership, legal counsel and scientists; regulatory, risk and compliance personnel; and other people in senior advisory roles. Almost two-thirds of the targeted executives are from health care and pharmaceutical companies. The victims have included executives from biotechnology firms, medical device manufacturers, drug manufacturers and medical distributors.

People working in law firms, investment advice companies and other businesses that advise publicly traded organizations have also been frequent targets of FIN4. Only three of the publicly traded companies FIN4 is targeting are not listed on either the New York Stock Exchange or NASDAQ.

Spear-Phishing for Nonpublic Data

In most cases, the cybercrime group appears to have focused solely on compromising the email accounts — not the actual computers — of their victims by using sophisticated spear-phishing tactics. The spear-phishing themes used in many of the attacks suggest members of the cybercrime group knew their targets and the dynamics of the stock market quite well.

For instance, the group often used mergers-and-acquisitions-themed and Securities and Exchange Commission-themed lures to get victims to click on rogue email attachments that then gave attackers control of the account, FireEye noted in its report. The emails were often sent from compromised accounts belonging to people familiar to the intended targets.

“Many of FIN4’s lures appeared to be stolen documents from actual deal discussions that the group then weaponized and sent to individuals directly involved in the deal,” the vendor noted. In some cases, the documents were publicly available, while in others, the documents used as phishing lures contained nonpublic information designed to get the victim to open the email attachment. In one campaign, FIN4 simultaneously targeted individuals from five different organizations involved in a single acquisition discussion.

Troubling Sign

The report offers a glimpse into what could be the start of a troubling new trend by cybercrime groups to try to steal insider information from companies for stock manipulation on a massive scale. Though there is no indication that FIN4 has actually done such a thing yet, the possibility for such manipulation exists given the data to which the group has had access over the past 18 months.

The U.S. Securities and Exchange Commission and others have expressed concern recently over the exposure of Wall Street firms to cyberattacks. Most of the concern has focused on potential disruptions to U.S. financial markets from cyberattacks against stock exchanges, brokerages and other Wall Street firms.

The kinds of attacks being carried out by FIN4 are somewhat different in nature and scope from what the U.S. Securities and Exchange Commission has been paying attention to in recent months. However, given the potential implications, such attacks could get on the regulatory body’s radar soon as well.