Early detection of compromised credentials can greatly reduce impact of attacks

According to Blueliv’s credential detection data, since the start of 2018 there has been a 39% increase in the number of compromised credentials detected from Europe and Russia, compared to the same period in 2017 (January-May). In fact, Europe and Russia are now home to half of the world’s credential theft victims (49%).

In this podcast, Patryk Pilat, Head of Engineering and Cyberthreat Intelligence at Blueliv, talks about the report, and illustrates how these startling increases in cybercriminal success rates suggest that the credential theft industry is growing in the European region both in innovation and scope.

Here’s a transcript of the podcast for your convenience.

I’m Patryk Pilat, Head of Engineering at Blueliv, a leading cyber threat intelligence company from Barcelona. We help organizations protect themselves by giving them visibility over the Internet, giving customers all over the world, from financial to insurance to retail, super fresh actionable threat intelligence to help them reduce their cyber risk. This includes detecting millions of compromised credentials every year to help secure the infrastructure. I’m here today to talk about our latest report, which focuses on the lifecycle of these stolen credentials.

There is a growing industry in the cybercrime ecosystem focused on obtaining valid login credentials using multiple mechanisms and tools. These tools nowadays can be cheaply acquired in the underground, darknet markets and forums. And you don’t have to be a highly seasoned cybercriminal to launch an attack.

According to our credential detection data, since the start of 2018 up until the end of May, there has been a 39 percent increase in the number of compromised credentials that we have detected from Europe and Russia, compared to the same period in 2017. In fact, Blueliv’s observations conclude that Europe and Russia make up half of the world’s credential theft victims.

We also found that when we remove Russia from the dataset, the growth figure for European theft victims jumps to 62 percent. This European growth figures tracked by us are surprisingly higher than North America’s, which we call it a decline by almost half in this period. We think that these cyber criminals’ success rates mean that the credential theft industry is growing in the European region, both in innovation and scope. We believe there are several reasons for this.

Firstly, there are more data stealer campaigns distributed across Europe at the moment. We also see that we are using most services online than ever before, such as cryptocurrency exchanges and other services like gaming or even gambling. There are simply more credentials that can be monetized by the bad guys. We’ve also seen trends indicating that APTs, which are already well known for exchanging information online for targeted attacks, are continuing their collaboration at pace. In the report, we also point out that there has been a proliferation of cheap malware kits available for less skilled attackers to use.

We also highlight some more some sub-credentialed price lists. For example, stolen credentials for an e-commerce site which are available from about 9 dollars with bank account credentials varying in price depending on the account balance. They can rise up to twenty five thousand dollars for a single account, which has for example half a million deposited on it. All it takes is a single good credential for a threat actor to gain access to an organization and cause havoc. So, we have been concerned to see significant credential theft growth rates in our region.

Most of the time the motivation behind credential compromise is financial, from blackmail to ransom, selling sensitive information, to committing fraud. The end goal is usually to profit from the attack. This could be through extortion or blackmail, espionage or to cause reputational damage, or for a number of other reasons which we explore in-depth in the report.

Ultimately, Any organization which holds valuable data is at risk, and so should take appropriate measures to protect themselves. So, what different measures can be taken by organizations to prevent and mitigate the impact of credential theft?

Well, there are some key things that we think that organizations should take away from this report. As with many aspects of cybersecurity, education is key to mitigating attacks. People within any organization should treat any requests for credentials as guilty until proven innocent. The end users are always the weakest, and also the strongest link in the chain. A human touch complemented by threat intelligence is the best way to protect an organization. In fact, actionable intelligence enables organizations to block potential and trap intrusions at the firewall level. It helps to plug holes before the attacker can get in.

This continuous cyber hygiene within an organization prevents attacks and mitigates the impact of an attack when one happens. It forces IT security teams to locate sources of breach and patch vulnerabilities and go home, with ongoing penetration testing, red teaming exercises and the like.

Now, organizations should always remember that the fresher the credential, the more likely they can be used effectively by cybercriminals. On the flipside, the sooner compromise credentials are protected the sooner security teams can remediate.

So, having ultra fresh credential information is often extremely important. The very early detection of compromised credentials, no more than a few days after they have been compromised, can massively reduce the impact of the theft. We provide deep insight into the lifecycle of the compromised credentials, and have made sure that our report offers valuable guidance to all of us – from CISOs seeking to protect their business, to analysts looking for IOCs to shrink their attack surface. With actionable intelligence, both from our platform Threat Compass and from the report we can fight cybercrime together.

The report, The Credential Theft Ecosystem, is available to download now you can get it from www.blueliv.com on our homepage. This was Patryck Pilat from Blueliv in Barcelona. Thank you.