Netskope Threat Labs Report: Banking 2024

Learn why Netskope debuted as a leader in the 2024 Gartner® Magic Quadrant™️ for Single-Vendor Secure Access Service Edge

Get the report

Read how innovative customers are successfully navigating today’s changing networking & security landscape through the Netskope One platform.

Get the eBook

Learn about Netskope Partners

Group of diverse young professionals smiling

Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG), and Private Access for ZTNA built natively into a single solution to help every business on its journey to Secure Access Service Edge (SASE) architecture.

Go to Products Overview

Netskope Next Gen SASE Branch converges Context-Aware SASE Fabric, Zero-Trust Hybrid Security, and SkopeAI-powered Cloud Orchestrator into a unified cloud offering, ushering in a fully modernized branch experience for the borderless enterprise.

Learn about Next Gen SASE Branch

Get your complimentary copy of the only guide to SASE design you’ll ever need.

Get the eBook

Learn about NewEdge

Lighted highway through mountainside switchbacks

Learn how we secure generative AI use

Learn about Zero Trust

Choose Netskope GovCloud to accelerate your agency’s transformation.

Learn about Netskope GovCloud

2025 Predictions
In this episode of Security Visionaries, we're joined by Kiersten Todt, President at Wondros and former Chief of Staff for the Cybersecurity and Infrastructure Security Agency (CISA) to discuss predictions for 2025 and beyond.

Play the podcast Browse all podcasts

Read how Netskope can enable the Zero Trust and SASE journey through secure access service edge (SASE) capabilities.

Read the blog

Learn how to navigate the latest advancements in SASE and zero trust and explore how these frameworks are adapting to address cybersecurity and infrastructure challenges

Explore sessions

Learn about the future convergence of networking and security tools in today’s cloud dominant business model.

Learn about SASE

Netskope is proud to participate in Vision 2045: an initiative aimed to raise awareness on private industry’s role in sustainability.

Find out more

Supporting Sustainability Through Data Security

At Netskope, founders and leaders work shoulder-to-shoulder with their colleagues, even the most renowned experts check their egos at the door, and the best ideas win.

Join the team

Go to Customer Solutions

Learn about Training and Certifications

Banking
November 2024

In This Report Introduction Social Engineering Malicious Content Delivery

TA577 Indrik Spider

GenAI Data Security Recommendations Netskope Threat Labs About This Report

9 min read

In This Report

Adversaries targeting victims in the banking industry are focused on financial fraud, using phishing as one of their main strategies to steal bank account details and banking login credentials.
The top adversary groups targeting the banking industry in the past year were criminal groups TA577 and Indrik Spider operating out of Russia. The top malware families included the downloader SLoad, the infostealer AgentTesla, and the JavaScript-based malware FakeUpdater and Parrot TDS.
The banking industry mitigates the risk of users leaking regulated data to genAI apps by deploying more aggressive controls than other industries, including aggressive blocking strategies and real-time DLP policies.

test answer

Introduction

This report focuses on three types of threats the banking industry faces:

Social engineering – Adversaries use tactics including phishing and impersonation to exploit human behavior and bypass security measures.
Malicious content delivery – Adversaries attempt to trick their victims into accessing malicious content on the web or in the cloud.
Data security – Data security is at risk from external adversaries in targeted breaches and insiders mishandling data.

Social Engineering

Social engineering is among the banking industry’s most significant cybersecurity threats. Social engineering includes phishing, fake software updates, tech support scams, and Trojans. Phishing is one of the most common tactics, with 3 out of every 1000 individuals working in banking clicking on a phishing link each month, which aligns with other industries. The victims click on links in various places, including email, messaging apps, social media, ads, and search engine results. Adversaries targeting the banking industry focus on financial fraud, so their phishing targets align with that objective. Instead of targeting cloud apps–common in other sectors–adversaries create phishing pages that look like the target banking institutions’ websites to steal bank account details and bank portal login credentials and commit financial fraud. The following chart breaks down the most common targets, where more than half of the clicks were on links mimicking banking institutions.

Malicious Content Delivery

Netskope leverages its Advanced Threat Protection engines to prevent 1 out of every 100 individuals working in banking from accessing malicious content on the web or in the cloud monthly. This malicious content takes multiple forms, including malicious JavaScript content that the browser executes and malware downloads that the victim must execute. The top five families that recently used to target the banking industry are listed below.

Downloader.SLoad (a.k.a Starslord) is a downloader often used to deliver Ramnit.

Infostealer.AgentTesla is a .NET-based Remote Access Trojan with many capabilities, including stealing browsers’ passwords, capturing keystrokes, and stealing clipboard content.

Trojan.FakeUpdater (a.k.a. SocGholish) is a JavaScript downloader that delivers various payloads, including Dridex and Azorult.

Trojan.Parrottds is a JavaScript-based traffic direction system that has been used to redirect traffic to various malicious locations since 2019.

Trojan.Valyria (a.k.a. POWERSTATS) is a family of malicious Microsoft Office documents that contain embedded malicious VBScripts, usually to deliver other malicious payloads.

Netskope Threat Labs tracks adversaries actively targeting Netskope customers to understand their motivations, tactics, and techniques, so that we can build better defenses against them. We generally categorize adversary motivations as either criminal or geopolitical. The two top adversary groups targeting the banking industry over the past year were criminal groups based in Russia.

TA577

Location: Russia
Motivation: Criminal
Aliases: Hive0118

TA577 has been targeting multiple industries worldwide, delivering malware payloads, including Qbot, Ursnif, and Cobalt Strike.

Indrik Spider

Location: Russia
Motivation: Criminal
Aliases: Evil Corp, Manatee Tempest, DEV-0243
Mitre ID: G0119

In their early days, Indrik Spider primarily used the banking Trojan Dridex before pivoting to ransomware and using BitPaymer, WastedLocker, and Hades. Indrik Spider frequently uses JavaScript to deliver their payloads and uses the popular red team tool Cobalt Strike to establish persistence in victim environments.

Attributing activity to a specific adversary group can be challenging. Adversaries try to hide their true identities or even intentionally launch false-flag operations wherein they try to make their attacks appear to come from another group. Multiple groups often use the same tactics and techniques, some going as far as to use the same tooling or infrastructure. Defining adversary groups can be challenging as groups evolve or members move between groups. Adversary attributions are fuzzy and subject to change and evolve as new information comes to light.

GenAI Data Security

The most urgent security risks for organizations using genAI apps are data-related, and users are the critical actors in causing and preventing those risks. There are two angles to these risks.

Input: What data do users send into genAI apps?
Output: How do users leverage the outputs they receive from genAI apps?

For the input, the primary risk is data leakage. For the output, the risks include correctness (genAI apps are very good at providing hallucinations and misinformation) and legal concerns (many companies trained their genAI apps on copyrighted or licensed content). This report focuses on the inputs since protecting sensitive data is typically the highest priority for most organizations.

Conservative adoption

The banking industry has succeeded in slowing GenAI adoption by adopting more aggressive policies to restrict its use. 93% of banking organizations block at least one genAI app, whereas the worldwide average is only 77%. Furthermore, banking organizations blocking genAI apps tend to block more genAI apps than their counterparts in other industries. The following figure shows that the average number of genAI apps that a banking organization blocks has increased from 5 a year ago to almost 9 today, with the top 25% of organizations blocking at least 24 apps. In contrast, the global average is only 2.6 apps, with 12 apps in the top 25% of organizations.

The apps with the most blocks include apps from multiple categories, including writing assistants, chatbots, image generators, and audio generators, bearing many similarities with global trends.

Threat Labs Report: Banking 2024 - Most blocked AI apps by percentage of organizations enacting a blanket ban on the app

On the other hand, the most popular genAI apps in the banking industry include chatbots, writing assistants, copilots, and note-taking apps, mirroring many global trends.

Organizations in the banking industry control access to allowed genAI apps using a combination of controls, including data loss prevention (DLP) and real-time user coaching. DLP as a genAI control is popular in the banking industry, with more than half of all organizations using it to restrict sensitive information from flowing into genAI apps, compared to a 43% global average. In banking, a highly regulated industry, the most common type of sensitive data uploaded to genAI apps is unsurprisingly regulated data, where DLP controls help prevent such data from being disclosed to third-party genAI vendors.

The genAI controls used in the banking industry have been very effective. The industry sees generally lower genAI adoption than other industries, with 87% of organizations using genAI compared to the global average of 97%. Although adoption continues to increase, it is doing so modestly, rising 7 points in the past year. Similarly, the average number of genAI apps used in each organization, 6, is lower than the global average of 9.6.

Recommendations

Netskope Threat Labs recommends organizations in the banking sector review their security posture to ensure that they are adequately protected against these trends:

Inspect all HTTP and HTTPS downloads, including all web and cloud traffic, to prevent malware from infiltrating your network. Netskope customers can configure their Netskope NG-SWG with a Threat Protection policy that applies to downloads from all categories and applies to all file types.
Ensure that high-risk file types like executables and archives are thoroughly inspected using a combination of static and dynamic analysis before being downloaded. Netskope Advanced Threat Protection customers can use a Patient Zero Prevention Policy to hold downloads until they have been fully inspected.
Configure policies to block downloads from apps and instances that are not used in your organization to reduce your risk surface to only those apps and instances that are necessary for the business.
Configure policies to block uploads to apps and instances that are not used in your organization to reduce the risk of accidental or deliberate data exposure from insiders or abuse by attackers.
Use an Intrusion Prevention System (IPS) that can identify and block malicious traffic patterns, such as command and control traffic associated with popular malware. Blocking this type of communication can prevent further damage by limiting the attacker’s ability to perform additional actions.
Use Remote Browser Isolation (RBI) technology to provide additional protection when there is a need to visit websites that fall into categories that can present higher risk, like newly observed and newly registered domains.

Netskope Threat Labs

Staffed by the industry’s foremost cloud threat and malware researchers, Netskope Threat Labs discovers, analyzes, and designs defenses against the latest cloud threats affecting enterprises. Our researchers are regular presenters and volunteers at top security conferences, including DefCon, BlackHat, and RSA.

About This Report

Netskope provides threat protection to millions of users worldwide. Information presented in this report is based on anonymized usage data collected by the Netskope One platform relating to a subset of Netskope customers with prior authorization.

This report contains information about detections raised by Netskope’s Next Generation Secure Web Gateway (SWG), not considering the significance of the impact of each individual threat. Stats in this report are based on the period starting May 1, 2023 through April 30, 2024. Stats are a reflection of attacker tactics, user behavior, and organization policy.

Threat Labs Reports

In the monthly Netskope Threat Labs Report, you will find the top 5 malicious domains, malware, and apps that the Netskope Security Cloud platform blocked plus recent publications and a threat roundup.

Browse reports

Accelerate your security program with the SASE Leader

Get Started