We hear about major breaches taking place seemingly every day and in reality, new breaches are happening every minute—but what is it all worth? What are you worth to a hacker, and is it worth their effort? The answer to the latter question is an undeniable “Yes.” Monetarily, to an attacker, you (and your data) are worth every second and penny it takes to generate a successful intrusion.
To provide some perspective, the group of folks behind GandCrab, who created a popular Ransomware as a Service offering, claim to have generated over $2 Billion on behalf of their affiliates and have themselves generated over $150 Million in profits. They were so successful that they shut their service down due to simply no longer having a need for money.
What’s even more intriguing is the emerging theme of vaccinating your home nation from attack to avoid local law enforcement pressure. In the instance of GandCrab, code was written to specifically limit its ability to infect computers residing in Russia.
(GandCrab ransomware infection)
SOURCE: KrebsOnSecurity GandCrab post
Additionally, Armor recently released a Black Market Report, which details the going rate for common hacker goods and services. Here are some of the highlights from the report:
| Basic Credit Card | $5-12 each |
| Credit Card + Date of Birth | $15-25 each |
| Cloned ATM card with $10K balance | $800 |
| Paypal account with $1K balance | $100 |
| Bank credentials with $5K balance | $250-500 |
| "Fullz" Data (e.g., full data profile) | $30-40 |
| Generic Ransomware | $225+ |
| Ransomware with Training + Dashboard | $500 |
| High-end Trojan (ex. Emotet) | $1,000 |
| Corporate Article of Incorporation + EIN | $811 |
| Gift card with $1K balance | $100 |
| DDoS as a Service | $60/Hr |
| 20,000 spam emails | $35 |
| 1,000 Twitter Likes | $10 |
| 1,000 LinkedIn connections | $15 |
* SOURCE: Armor Black Market Report
Viewing this list, you can start to see how this works. Gaining credentials to a bank account is far more valuable than skimming a credit card. Buying a high-end trojan like Emotet is pricey, but the return on investment is quick. Creating social confidence via a LinkedIn network with “500+ connections” in order to social engineer connections is both cheap and effective. If you want to take down a website, a highly effective DDoS attack can be purchased by the hour, day, or week (creating an opportunity for misdirection). Both experienced and emerging hackers are making strategic investments to maximize their ability to profit. They’re consistently purchasing the latest tools, outsourcing monotonous tasks, and selling data and records to bidders that know how to maximize their value.
In closing, it’s vital to understand that the time and money spent by hackers to create a successful intrusion generates a consistent, sizable return. In the same manner, organizations have to match that time and investment to prevent an intrusion and secure their critical data and infrastructure. At ConvergeOne, we leverage our leading WAVES Methodology to help organizations prioritize and maximize those efforts.
[ GUIDE ] Building HUMAN FIREWALLS:
10 Steps to Cyber AWareness
Are your employees equipped to act as a human firewall, defending your organization against attempted cyber attacks?
The statistics are staggering: spear phishing accounts for 95% of enterprise network attacks, according to the SANS Institute. Since attacker can craft messages to your employees posing as a reputable contact, technology can only do so much. To effectively prevent your organization from falling victim to cyber attacks, it’s essential that your employees develop strong cyber instincts.
This guide contains an overview of ConvergeOne’s 10 steps to creating a cyber aware culture, including key questions and ideas for tackling each step.
Topics: Cyber Security
