IBM X-Force researchers continuously monitor and track the activity and migration of malicious banking Trojans around the world, and they recently observed that Singapore is becoming a rising target for cybercrime.

Due to the country’s unique demographics, which include a mix of Chinese-speaking and English-speaking businesses, many of the attacks seen in western countries as well as malware traditionally aimed at Asian targets have increasingly turned their sights to Singapore.

The trends that affect the country nowadays range from traditional site redirection and content overlay to the more advanced PC and mobile malware that intercept out-of-band authentication elements such as texted verification codes. In fact, just a few months ago the Association of Banks in Singapore warned Singaporean mobile phone users against mobile malware posing as a software update for the popular messaging app WhatsApp.

Why Singapore?

It’s no coincidence that threats increasingly target Singapore, which is one of Asia’s most advanced countries in digital banking. It reportedly has the highest variety of digital offerings in Asia, according to the DBS Research Group. In the global arena, Singapore has the second-highest inclination for digital banking, according to an A.T. Kearney and EFMA global banking study.

Furthermore, the perpetual growth of multinational corporations conducting business in Singapore makes the region even riper for financial cyberattacks due to a constant rise in the type of high-value accounts criminals are targeting. Due to the thriving growth of international business, most of the organizations in Singapore communicate in English, which pairs with the fact that most malware campaigns are launched in English.

However, IBM X-Force researchers are also seeing an increase of Chinese-language activity on the Dark Web in the region. This is yet another contributing factor to the increase of fraud directed at entities and individuals in Singapore because Mandarin is considered one of the country’s official languages. With these factors in place, it is clear that Singapore is proving to be a valuable geographic target for cybercriminals.

Here are some recent top malware campaigns targeting Singapore, based on IBM X-Force data and intelligence findings.

The Dridex Trojan: A Bugat Descendant

The Dridex banking Trojan, which was built on the Bugat code base, has been identified as the top malware family targeting Singaporean banks in 2016 so far. Moreover, Dridex represents 84 percent of attacks in the country over the past year. X-Force research suggested that the organized cybercrime gang behind this malware is adopting advanced attack methods such as Dyre’s trademark redirection technique as it continues to intensify its focus on high-value business accounts in the region.

Leveraging the redirection attack technique, Dridex victims are unknowingly sent to an entirely new, fake website when they try to access their online banking site. Since they are immediately redirected, they never actually access the bank’s true site. The power of this attack lies in its simplicity. By keeping users away from their bank’s site, the attacker can deceive them into divulging personal authentication codes without the bank’s counter-fraud systems recognizing that a customer’s session has been initiated or diverted.

These tactics have already been seen in other parts of the world and are now shifting to Singapore.

The Tinba v3 Trojan

X-Force researchers first discovered Tinba targeting Singaporean banks in 2015, and this malware continues to be one of the most active threats in the region today. In December 2015, Tinba v3 set its sights on business and corporate accounts held with nine major bank brands in Singapore.

These Singaporean banks became the top targets for the Asia-focused malware campaign, accounting for more than one-third of all Tinba-targeted brands. In fact, Singapore is in the cross hairs of Tinba v3 27 percent of the time, making it the most targeted country for the Tinba variety.

Tinba v3 continues to be an advanced, actively developed banking Trojan. Judging from ongoing IBM X-Force research into this malware’s evolution, it is likely to have a dedicated development team behind it.

GM Bot: Most Prolific Android Banking Trojan

GM Bot, mobile malware that affects Android-based devices, is the latest and most popular commercial malware that organizations in Singapore must be aware of. While it first emerged in the Russian-speaking cybercrime underground in 2014, GM Bot’s source code was recently leaked, making the Trojan accessible to potential attackers to use for free. With the code leaked, more cybercriminals can now recompile the code, create new variants and customize it for specific regions.

GM Bot is specifically designed to help fraudsters steal banking and payment credentials, as well as bypass verification techniques used in banking transaction authorization. For example, GM Bot can launch fake overlay windows to mimic bank applications to steal user login details and payment card information. Additionally, the malware can control a device’s SMS relay and voice calls to intercept verification code texts or calls incoming from a bank to the user.

How Can Singapore Fight Back?

IBM Security regularly works with customers around the globe to study and stop banking Trojan attacks launched by gangs that operate threats such as Dridex, Tinba and GM Bot. Singaporean organizations should consider using technologies that can adapt to emerging threats to detect infections and protect customer endpoints.

However, leveraging the right detection solutions is only part of the battle, and banks should also look to educate users, deploy solutions for the detection of redirection attacks and keep security teams ahead of emerging malware trends.

Keeping up to date is made easier by joining threat intelligence sharing platforms like the IBM X-Force Exchange to share critical threat information and understand how to react to ever-changing threats. As today’s cybercriminals continue to share information with each other on the Dark Web, those in the security community must also unite to combat these new breeds of increasingly sophisticated threats.