Outpost24 have released a new report revealing the underground operation of Traffers, cybercriminal organisations reshaping the business of stolen credentials.
The Rising Threat of Traffers report, compiled by Outpost24’s Threat Intelligence team, KrakenLabs, provides a deep dive into the credential theft ecosystem and encourages organisations to evaluate their security measures against these evolving threats.
Stolen credentials are a major problem for organisations, causing nearly 50% of all data breaches. While businesses are still trying to figure out how to fix the password problem, cyber criminals are organising, and innovating. The increased professionalisation of cyber criminal groups, specifically the rise of Traffers, is the latest threat against businesses.
Traffers are highly organised cybercriminal groups. They spread different types of malware families with the goal of exfiltrating credentials or profit. To spread the malware as far and wide as possible, they have formed an industry-like structure of product and service providers, as well as dedicated market places, in the form of Telegram channels, to facilitate the sale of those credentials.
To increase their success rate, Traffers target their would-be victims by driving their internet traffic with Google and Facebook Ads to fraudulent content. Traffers have developed a business model that involve specific recruitment, training and compensation, all of which distinguish them from other cybercriminals.
The price spike of information-stealing malware, the subscription models for accessing stolen credentials, and even the earnings of the Traffers themselves, are just some of the highlights in the report that demonstrate the increased activity and demand in the cybercriminal ecosystem.
“Credentials, and the tools used to steal them, are a commodity. With the growing trend of Initial Access Brokers (IABs) we know that criminal groups are willing to pay for services, which means they expect a bigger profit in return.” says Victor Acin, head of the KrakenLabs at Outpost24, “that’s bad news for businesses.”
As the underground economy circulates, current security measures may fall behind. Organisations need to consider the Traffers attack chain to stay protected against the latest threats. The Rising Threat of Traffers report provides practical advice that can protect credentials, and help businesses avoid malware infections, in the way it is done by Traffers teams.
Outpost24’s KrakenLabs will continue to monitor these groups as part of their cyber threat intelligence solution, helping organisations improve their cyber security posture with real-time threat detection and faster remediation.
