In the ever-evolving fraud landscape, fraudsters have shifted their tactics from using third-party devices to on-device fraud.

Now, users face the rising threat of fraud involving remote access tools (RATs), while banks and fraud detection vendors struggle with new challenges in detecting this invisible threat.

Let’s examine the modus operandi of fraudsters, prevalence rates across different regions, classic detection methods and Trusteer’s innovative approach to RAT detection through behavioral analysis.

A rising threat

Trusteer’s customer data analysis shows that RAT device takeover has become a prevalent form of fraud, constituting a significant proportion of browser-based fraudulent activities in the U.K. and Australia.

This modus operandi started in English-speaking countries and then moved to Spain and Latin America. It has recently surfaced in France and Japan, where it was previously unreported.

Modus operandi: The classic tech support scam

A popular method fraudsters use involves a legitimate RAT, such as Team Viewer or AnyDesk, which allows them to access the victim’s device remotely. These frauds typically involve a social engineering component to convince the user to install the tool and allow the fraudsters to access their device.

Most tech support scams follow these steps:

Step 1: A user is browsing online and is redirected to a malicious website with a pop-up claiming that the device has been infected with malware. The pop-up contains a phone number to a rogue technical support team that can “assist” with “cleaning” the device.

Step 2: The user calls the phone number and is asked to download a RAT and grant the fraudster permission to connect to their device remotely.

Step 3: Next, the legitimate user establishes a banking session to pay for the services. If a one-time password is required to authenticate a new target account identifier, this action is authorized by the victim.

Traditional detection methods

One of the traditional methods to detect RAT is through lower mouse movement frequency.

If on-device mouse movements comprise many small, frequent events, some of these events get lost while transmitting remote mouse movements. This results in fewer measurable events.

The image below illustrates how these movements would look in a graphic form.

However, the rise of remote work during COVID-19 pushed forward many improvements in remote communication tools — RATs included — altering the old detection models.

Challenge accepted: Trusteer’s innovative solution

Trusteer’s research teams have risen to the RAT fraud detection challenge by exploring alternative detection methods. We have identified distinct behavioral patterns unique to each RAT. The unique behavioral “fingerprints” allow Trusteer’s fraud detection products to detect the use of a RAT and identify the specific tool used during the attack.

The following graphic shows the distribution of a specific behavioral event for legitimate and fraudulent sessions. The X-axis represents the number of a distinct behavioral event, leveraging data from user flow, key and mouse elements. The Y-axis represents the probability of seeing this number in fraudulent and legitimate sessions. Our research shows that a high number of events is associated with fraudulent sessions with a specific RAT, which is mainly used in central Europe.

(Source: IBM Trusteer)

These patterns have been recorded in about 20% of fraud sessions using RATs, as opposed to only 0.01% of legitimate sessions. This helps our teams detect RAT-enabled fraud with more certainty.

Stay safe from RAT fraud

RAT fraud has reached every corner of the world while becoming increasingly invisible, posing a challenge to banks and security teams.

However, Trusteer’s fraud detection system, Pinpoint Detect (PPD), can identify fraud sessions involving RATs with remarkable coverage and accuracy based on behavioral analyses.

If you have further questions about RAT fraud, please contact IBM Trusteer Enterprise Support by opening a case in the Customer Portal.

This post was made possible through the contributions of Nir Somech, Andrey Finkelshtein and Dean David Hershkowitz.