While financial threats tend not to get as much news coverage as ransomware, maybe because they have a less visual impact, they are far more prevalent. With over 1.2 million annual detections, the financial threat space is 2.5 times bigger than that of ransomware. Further Reading Financial malware more than twice as prevalent as ransomware (https://www.symantec.com/connect/blogs/financial-malware-more-twice-prevalent-ransomware) Financial threats review 2017 (https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/istr-financial-threats-review-2017-en.pdf)

2. 2
o
o
o
o
o
o

3. 3
 

4. 4

5. 5
o
o
o
o
o
o
o
o
o
o
o
o
o
o
o
o

6. 6
Banswift attacks: February 2016
o
o
o
o
o
o
o
o
o

7. 7
The Banswift Connection
o
o
o
o
o
o

8. 8
Banswift targets
o
o
o
o
o
o
o
o
o
o
o
o

9. 9
o
o
o
o
o

10. 10
Disruptive attacks against banks
o
o
o
o

11. 11
Common financial Trojans

12. 12
Email attacks up, web attacks down
0
100,000
200,000
300,000
400,000
500,000
600,000
700,000
800,000
900,000
Jan-16 Feb-16 Mar-16 Apr-16 May-16 Jun-16 Jul-16 Aug-16 Sep-16 Oct-16 Nov-16 Dec-16
W97M.Downloader JS.Downloader

13. 13
Typical emailed malware infection process

14. 14

15. 15
Financial Trojans: down but not out
0
50,000
100,000
150,000
200,000
250,000
300,000
o
o
o

16. 16
o
o

17. 17
0
10,000
20,000
30,000
40,000
50,000
60,000
70,000
80,000
90,000
Bebloh Ramnit Snifula Zbot
Activities of common financial Trojan families

18. 18
Top tactics
o
o
o
o
o
o
o
o

19. 19
Techniques
o
o
o
o
o
o
o
o
o
o

20. 20
o
o
o
o
When to use manual remote access?
o
o
o
o

21. 21
Japan  36.69% 3.21%
China  6.92% 4.69%
India  6.37% 6.31%
USA  6.30% 8.54%
Indonesia  4.78% 6.31%
o
o

22. 22
o
o
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Bebloh Snifula

23. 23
Top targeted countries by institutions
o
o
o
o

24. 24
Uneven sample/target distribution
oThree Dridex samples
targets the same 16
banks in Germany, and
10 in Austria
oPrevalence fluctuates a
lot
oNot all groups have
precision in
distribution method

25. 25
Mobile banking
o
o
o
o

26. 26
Mobile banking threats
o
o
joe_bloggs
********
https://my.bank.tld
Real bank websiteReal website

27. 27
Crimeware-as-a-service

28. 28
Underground market
o
o

29. 29
o
o
o
o
o
o
o

30. 30
o
o
o
o
o
o
o
o
o
o
o
o

31. 31
Symantec solutions #1

32. 32
Symantec solutions #2

33. 33
Key findings #1
o
o
o
o
o

34. 34
Key findings #2

35. 35
o BLOG: Financial malware more than twice as prevalent as
ransomware
o WHITEPAPER: Financial threats review 2017
Further reading

36. Thank you