CHAPTER 1 SPOTLIGHT ON CYBER THREATS COMMONLY SPOOFED ORGANISATIONS IN 2018 Apple Alibaba Adobe PayPal AT&T DHL ATB Financial PHISHING URLS GitLab Docusign Facebook Yahoo Bank of America Chase Bank Microsoft Google Dropbox Postmaster Amazon Free Mobile France Mailbox 16,100 phishing URLs with a Singapore-link were observed in 2018, a 30 per cent decrease from 2017. Phishing e-mails usually spoof, or pretend to originate from, reputable firms and organisations. Companies in the banking and financial services, technology, and file hosting services made up almost 90 per cent of spoofed companies in 2018. In Singapore, websites of Government organisations such as Ministry of Manpower (MOM), Singapore Police Force (SPF) and Immigration & Checkpoints Authority (ICA) were commonly spoofed to steal personal and financial data from victims. Phishing activity typically increases when major events occur. Threat actors dupe victims into opening phishing e-mails and their attachments 14 1st Banking and Financial Services (e.g. Bank of America) 2nd Technology (e.g. Microsoft) 3rd File Hosting Services (e.g. Dropbox) Users are advised to remain vigilant against phishing attacks, and to be cautious and verify the identity of the sender, before clicking on suspicious URLs. OK NUMBER OF PHISHING URLS WITH A SINGAPORE-LINK OBSERVED IN 2018 3,849 2,406 1,931 1,867 1,601 1,526 1,879 1,786 1,155 812 JAN FEB MAR 553 APR MAY JUN by taking advantage of their interest in such events. During the FIFA World Cup tournament in June 2018, several soccerthemed phishing e-mails and websites were observed, targeting sports fans with fake gifts from FIFA or its sponsors. Fans who responded to these JUL AUG 767 SEP OCT NOV DEC “giveaways” ended up giving away their personal information to cybercriminals. Separately, in the lead-up to the Democratic People’s Republic of Korea-USA Singapore Summit held in June 2018, an intelligence-gathering campaign targeted South Koreans with phishing e-mails. These contained malware that could be used for keylogging and executing malicious commands on compromised devices. Increasingly, threat actors are also using ingenious tactics to trick individuals and evade detection. Some examples include the use of HTTPS, Dynamic Domain Name System (DDNS) services, and using generic top level domains: TAKING ADVANTAGE OF “HTTPS” 2,450 phishing URLs were observed using “HTTPS” in 2018, a more than tenfold jump from just 200 of such URLs in 2017. Using “HTTPS” – rather than “HTTP” – lures victims into a false sense of security, by having them believe that they were transacting on a secure website. USE OF DYNAMIC DOMAIN NAME SYSTEM SERVICES (DDNS) SERVICES 210 URLs were observed using DDNS services in 2018, three times more than in 2017. Such services enable malicious URLs to change their IP addresses constantly to evade applications that block static malicious IP addresses. LEVERAGING GENERIC TOP LEVEL DOMAINS Domains such as “.com” (8,100 URLs) and “.club” (700 URLs) were commonly abused, making up more than half the observations for 2018. They are relatively cheap (or even available for free) and lack regulation, allowing threat actors to constantly create new malicious URLs. 15