{"id":24537,"date":"2015-11-23T12:00:07","date_gmt":"2015-11-23T20:00:07","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=24537"},"modified":"2025-05-27T20:00:53","modified_gmt":"2025-05-28T03:00:53","slug":"a-dummies-guide-to-insider-trading-via-botnet-part-2","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/a-dummies-guide-to-insider-trading-via-botnet-part-2\/","title":{"rendered":"A Dummies Guide to ‘Insider Trading’ via Botnet, Part 2"},"content":{"rendered":"

This post, the second\u00a0of two parts, was written by Christiaan Beek<\/a>, Raj Samani, and Shane Shook.\u00a0<\/em><\/p>\n

In our first post, <\/a>we\u00a0examined the evolution of the botnet. In this follow-up we will discuss a new botnet operating model that allows an attacker to get an insider\u2019s view of infected organizations without actually being an insider\u2014all while remaining undetected and manipulating data for financial gain.<\/p>\n

Fiction or reality?<\/strong><\/h2>\n

Many examples of attacks by botnet malware resulting in financial theft or accounts fraud have been published that trace the evolution of \u201cpersonal\u201d information stealers into \u201ccorporate\u201d information stealers. In 2009 Patco Construction, in Sanford, Maine, was robbed of $588,000. In that same year, US law enforcement arrested individuals associated with the incursions via botnets into 390 companies in the United States, with estimated related losses at more than $70 million. Similar activities occurred in 2012 when Tennessee Electric Co. lost almost $328,000 after their bank account was taken over by cyber thieves.<\/p>\n

Other examples abound, but the evolution of the use of botnets continues as more and more corporate services are facilitated online. In 2014 Salesforce.com users were targeted by malware configured to automatically steal login details, and even bypass two-factor authentication. Numerous examples of malware configurations to target corporate financial, securities, and other web services are available through cursory Internet searches. Dyre samples include more than 450 URLs intended to be automatically monitored for credentials theft, including corporate and personal web services. Some of the configured URLs include nonspecific wildcards to harvest credentials used for popular corporate financial and HR applications.<\/p>\n

In May, the Australian Federal Police released a report concerning corporate securities trading fraud in which malware actors were targeting nontraditional financial platforms in Australia. Investigations into large sums of money fraudulently transferred from various Australian financial institutions using corporate accounts commenced in February 2014.<\/p>\n

The investigations showed that two brokerage services were making unusual transactions. Forensic investigations revealed the presence of \u201cfinancial\u201d malware. The malware, in this instance, was defined as malicious software that has been designed to steal, alter, and compromise financial transactions and credentials.<\/p>\n

Some results from the investigation:<\/p>\n