Cyber Crime Toolkits Go On Sale
Dawne Dam
The Indiana Executive Council on Cybersecurity (IECC) recently launched two, all-new, FREE-to-download toolkits, both of which are designed to provide organizations with more of the necessary cybersecurity resources for protecting themselves, as well as their critical systems and the people they serve throughout the Hoosier State.
The mission of the U.S. Secret Service Cyber Fraud Task Forces (CFTF) is to prevent, detect, and mitigate complex cyber-enabled financial crimes, with the ultimate goal of arresting and convicting the most harmful perpetrators. Through a partnership with private industry, state, local, tribal, and territorial (SLTT) and federal law enforcement agencies, federal and state prosecutors, and academia, the CFTFs effectively leverage the collective expertise of a range of key stakeholders necessary to combat cybercrime. The CFTFs are staffed with special agents, technical experts, forensic analysts operating in the CFTF Digital Evidence Forensic Labs (DEFL), and SLTT task force officers trained through the Secret Service National Computer Forensic Institute (NCFI).
Standalone RDP shops exist, as well as shops that sell RDPs alongside other illicit goods such as email spamming tools. RDPs can also be found for sale on darknet marketplaces and numerous underground forums. In the course of this research, Blueliv analysts investigated cybercriminal conversations involving RDPs taking place in English-, French-, Spanish-, Portuguese-, and Russian-language underground communities. Strikingly, RDPs were discussed and observed for sale in all such linguistic communities.
In addition to the massive standalone RDP shops detailed above, RDPs are also swapped on darknet marketplaces and underground forums. Whereas RDP shops primarily cater towards Russian- and English-speaking clients, such peer-to-peer sales of RDPs can be found across various linguistic communities. This global interest in RDPs is noteworthy, as cybercriminal interest in certain schemes, tools, and malware tend to vary from region to region. RDP is one of the tools that span these linguistic divides.
Cybercriminals are attracted to RDPs as they are multitudinous, relatively easy to compromise, and can be weaponized in a variety of cybercriminal schemes. Common threats and attacks perpetrated thanks to RDP compromise include online payment card fraud, the cashout of stolen bank accounts, and ransomware deplyoment in corporate environments, among other illicit uses. Tools to facilitate RDP compromise can be found with ease and without requiring advanced knowledge of technical concepts. As a result, compromised RDPs exist in abundance on the cybercriminal underground, offered for sale across linguistic communities and even spawning their own specialized shops where threat actors may filter and browse through thousands of offerings in order to find something that fits their particular needs.
Country-specific RDP can help hackers bypass geo-blocking and carry out attacks on local organizations and governments. Flashpoint pricing analysis revealed that these RDPs go for $26 and are helpful in specific cybercrime groups.
The world of cybercrime is much like the world of technology itself. Every year brings new trends, new innovations, and new tools. To get a sense of how cybercrime changes year to year, check out our cyberthreats reports, as well as our reports on special topics.
The potentials of digital interconnectedness are enormous, but so is its vulnerability to attacks by cybercriminals. Find out more about the various faces of cybercrime and about approaches to counter cybercrime.
Cybercrime today is a professional field of business. There are many market places in the underground economy offering illegal goods such as drugs, weapons or child abuse material, stolen data and identities, but also services to commit cybercrime (cybercrime-as-a-service).
The police distinguish between "cybercrime in the narrower sense" (offences targeted against the Internet, data networks, IT systems or their data) and "cybercrime in the broader sense" (offences committed by means of information technology). Simply put, cybercrime in the broader sense thus includes offences that can also be committed in the analogue world, such as drug trafficking. Cybercrime in the narrower sense includes offences that are highly sophisticated in terms of technology and therefore, in turn, require the police to conduct technologically highly complex investigations.
Hardly any act of cybercrime is committed without malware or misused tools. They are used to spy out and intercept data, manipulate data traffic (e.g. in online banking) or extort money (ransomware). There are countless malware families, and they are continuously adapted by perpetrators.
Once a year, the Bundeskriminalamt publishes the National Situation Report on Cybercrime. The report contains current intelligence on cybercrime in Germany, including trends related to this phenomenon, representations of case trends as well as practical examples of cases. Moreover, it presents the results of law enforcement activities by the police.
It is, first of all, the police forces of the German Länder that are responsible for the prosecution and suppression of cybercrime in Germany. An overview of specialised police services that are available in case of a cyberattack and offer advice, in particular to business enterprises, can be found under this link:
It is in the very nature of cybercrime (which, simply put, requires only a computer and an Internet connection) that perpetrators do not act locally but globally. Cyberthreats or threat situations often cannot be narrowed down in terms of location, let alone be attributed to a specific location or region. International cooperation is therefore central to the successful suppression of cybercrime.
The Bundeskriminalamt is part of a global 24/7 network of all major cybercrime units and involved in a great number of joint operational measures aimed against cybercriminals. To support and intensify their cooperation, the countries involved exchange liaison officers, so-called embedded agents. At European level, there is a close and institutionalised cooperation with Europol. At international level, the cooperation with INTERPOL is an important component of cybercrime suppression. In addition, there is a constant bilateral exchange with various countries on identified cyberthreats and best practices.
Division CC is an integral part of the cybersecurity architecture in Germany and one of the world's leading units dealing with this area of crime. The focus is on the suppression of cybercrime in the narrower sense. This includes offences that are targeted against the Internet, further data networks, IT systems or their data.
The areas of the Division dealing with general affairs, analysis and reporting, service as well as investigative support are centralised in this subdivision. One core element is strategic analysis and situation assessment. The objective is to identify new developments in the field of cybercrime at an early stage and to draw conclusions and take necessary police countermeasures more quickly. In addition, this subdivision provides services in support of investigations to the specialised departments of the BKA. Apart from this, the central knowledge management of Division CC can be found here; this knowledge is, for instance, passed on to stakeholders within the BKA by way of in-house training. And finally, it is the task of the subdivision to deal with specialist legal issues in this still young and dynamically growing field of cybercrime.
An integrated approach to cybercrime suppression requires strong cooperation at international level. The international exchange of operational information plays an essential role in this context. In collaboration with international partners and stakeholders, Division CC is actively involved in a number of projects and initiatives and provides support in terms of both expertise and staff.
Division CC is the BKA's central office for the analysis of information held at the Division and the provision of such information to external stakeholders, notably the Länder. Furthermore, it is the BKA's central office for task analysis in the area of cybercrime. The "Central Office 4.0" ensures that the Länder and foreign cooperation partners are constantly supplied with phenomenon-related information held at the BKA. As far as possible, correspondence as well as combining investigations conducted by federal and Länder authorities is handled by Division CC in an automated form.
Phenomenon-related investigations, including structural investigations and investigations serving as pilot projects, are conducted by Division CC's investigation sections. Darknet investigations focus on the operators and administrators of criminal sales platforms. These sections have, moreover, original jurisdiction to investigate all offences committed in the field of cybercrime in the narrower sense. In addition, they conduct investigations relating to digital flows of payment and mobile payment systems.
The phenomenon-related operational analysis in the fields of cybercrime in the narrower sense, Darknet trading platforms and attacks on digital flows of payment serves to generate new and support ongoing investigations conducted by Division CC. Core tasks moreover include coordinating federal/Länder-level investigations ("Central Investigations") and carrying out analysis projects.
Suspect communication and data, their links and their phenomenological content as well as an intelligent, rule-based analysis and provision of this information have for years been forming the basis of successful investigations and analyses in the field of cybercrime in the narrower sense. Therefore, a dedicated central office for operational information gathering and data warehousing was set up at Division CC that provides information to the Division's operational units. The office focuses on the gathering and analysis of cybercrime-related suspect big data and the devising of police-specific strategies and technical solutions for a machine-assisted evaluation, enrichment and structuring of such data. High-level technical understanding and knowledge are pooled here so that, based on the analysed data, technical tools can be developed that may be used by the operational units of the BKA and the federal and Länder police forces in their fight against cybercrime.
0aad45d008