August 23, 2023 By Camila Sablotny 3 min read

In the ever-evolving fraud landscape, fraudsters have shifted their tactics from using third-party devices to on-device fraud.

Now, users face the rising threat of fraud involving remote access tools (RATs), while banks and fraud detection vendors struggle with new challenges in detecting this invisible threat.

Let’s examine the modus operandi of fraudsters, prevalence rates across different regions, classic detection methods and Trusteer’s innovative approach to RAT detection through behavioral analysis.

A rising threat

As Fraud detection methods become more and more accurate, fraudsters have moved from account takeovers (ATOs) from a third-party device to on-device fraud. This can be done either by a legitimate remote access tool (RAT) or by one developed by fraudsters.

Trusteer’s customer data analysis shows that RAT device takeover has become a prevalent form of fraud, constituting a significant proportion of browser-based fraudulent activities in the U.K. and Australia.

This modus operandi started in English-speaking countries and then moved to Spain and Latin America. It has recently surfaced in France and Japan, where it was previously unreported.

Modus operandi: The classic tech support scam

A popular method fraudsters use involves a legitimate RAT, such as Team Viewer or AnyDesk, which allows them to access the victim’s device remotely. These frauds typically involve a social engineering component to convince the user to install the tool and allow the fraudsters to access their device.

Most tech support scams follow these steps:

Step 1: A user is browsing online and is redirected to a malicious website with a pop-up claiming that the device has been infected with malware. The pop-up contains a phone number to a rogue technical support team that can “assist” with “cleaning” the device.

Step 2: The user calls the phone number and is asked to download a RAT and grant the fraudster permission to connect to their device remotely.

Step 3: Next, the legitimate user establishes a banking session to pay for the services. If a one-time password is required to authenticate a new target account identifier, this action is authorized by the victim.

Explore IBM Security Trusteer Solutions

Traditional detection methods

One of the traditional methods to detect RAT is through lower mouse movement frequency.

If on-device mouse movements comprise many small, frequent events, some of these events get lost while transmitting remote mouse movements. This results in fewer measurable events.

The image below illustrates how these movements would look in a graphic form.

However, the rise of remote work during COVID-19 pushed forward many improvements in remote communication tools — RATs included — altering the old detection models.

Challenge accepted: Trusteer’s innovative solution

Trusteer’s research teams have risen to the RAT fraud detection challenge by exploring alternative detection methods. We have identified distinct behavioral patterns unique to each RAT. The unique behavioral “fingerprints” allow Trusteer’s fraud detection products to detect the use of a RAT and identify the specific tool used during the attack.

The following graphic shows the distribution of a specific behavioral event for legitimate and fraudulent sessions. The X-axis represents the number of a distinct behavioral event, leveraging data from user flow, key and mouse elements. The Y-axis represents the probability of seeing this number in fraudulent and legitimate sessions. Our research shows that a high number of events is associated with fraudulent sessions with a specific RAT, which is mainly used in central Europe.

(Source: IBM Trusteer)

These patterns have been recorded in about 20% of fraud sessions using RATs, as opposed to only 0.01% of legitimate sessions. This helps our teams detect RAT-enabled fraud with more certainty.

Stay safe from RAT fraud

RAT fraud has reached every corner of the world while becoming increasingly invisible, posing a challenge to banks and security teams.

However, Trusteer’s fraud detection system, Pinpoint Detect (PPD), can identify fraud sessions involving RATs with remarkable coverage and accuracy based on behavioral analyses.

If you have further questions about RAT fraud, please contact IBM Trusteer Enterprise Support by opening a case in the Customer Portal.

This post was made possible through the contributions of Nir Somech, Andrey Finkelshtein and Dean David Hershkowitz.

More from Fraud Protection

Web injections are back on the rise: 40+ banks affected by new malware campaign

8 min read - Web injections, a favored technique employed by various banking trojans, have been a persistent threat in the realm of cyberattacks. These malicious injections enable cyber criminals to manipulate data exchanges between users and web browsers, potentially compromising sensitive information. In March 2023, security researchers at IBM Security Trusteer uncovered a new malware campaign using JavaScript web injections. This new campaign is widespread and particularly evasive, with historical indicators of compromise (IOCs) suggesting a possible connection to DanaBot — although we…

Virtual credit card fraud: An old scam reinvented

3 min read - In today's rapidly evolving financial landscape, as banks continue to broaden their range of services and embrace innovative technologies, they find themselves at the forefront of a dual-edged sword. While these advancements promise greater convenience and accessibility for customers, they also inadvertently expose the financial industry to an ever-shifting spectrum of emerging fraud trends. This delicate balance between new offerings and security controls is a key part of the modern banking challenges. In this blog, we explore such an example.…

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today