In the fourth quarter of 2016, the number of users that encountered malware capable of stealing money or valuable financial information reached 319,000, 22.49% more than in the same period in 2015. An increase in the number of attacks was spotted during the Black Friday, Cyber Monday and Christmas periods.
At end of 2016, Kaspersky Lab researchers conducted a retrospective look at the cyberthreats landscape during the holiday period (October, November and December) in 2014 and 2015. The main conclusion of their analysis was that criminals are trying to tie their malicious campaigns to specific holiday dates.
Analysis of the holiday period in 2016 showed that last year’s season wasn’t the exception. Kaspersky Lab protection technologies detected attacks against 22.49% more users than in the same period in 2015. This means that after a decrease in 2014, cybercriminals are again investing in developing malware capable of stealing financial data, such as credit card information and online banking credentials.
As the dynamics of attacks in November 2016 showed, the most attractive day of the fall-winter holidays for cybercriminals is Cyber Monday. In November 2016, Kaspersky Lab protection technologies detected a clear spike in the number of users attacked, and on November 28th (Cyber Monday) there were twice as many users attacked than during the previous day.
When it comes to the Black Friday and Christmas periods, the pattern is different, with the spikes in attack dynamics occurring one or two days prior to the actual holiday dates. These differences in malicious behavior can be explained by the different nature of the holidays. Unlike Black Friday and Christmas, Cyber Monday is all about online sales, thus criminals see more sense in focusing their malicious campaigns on this particular date.
To reach their goals, criminals used one of 30 families of banking trojans, consistently tracked by Kaspersky Lab. Five of these are the most widespread: Zbot, Nymaim, Shiotob, Gozi and Neurevt. These trojans are responsible for attacks against 92.35% of users in the holiday period.
“Data on the dynamics of attacks shows that financial malware operators tried to attach their activity to particular dates in 2016, and the holiday season’s contribution to the number of financial malicious attacks during this time is clearly visible. Financial malware attacks are on the rise again and all their targets – from owners and clients of e-shops, to credit card holders and banks – should be aware of the dangers and take adequate steps to stay safe. As a holiday season follow-up protection measure, we advise shoppers who used their credit cards to buy presents and goods during last three months to keep an eye on their financial transaction information in the coming months. Typically, criminals don’t start to withdraw money from stolen cards right after the theft. They often wait for several weeks or even months to prepare for cashing out first,” said Oleg Kupreev, security expert at Kaspersky Lab.
