Chapter 2 Cyber Threats in Focus: Actors Targeting Singapore CYBER CRIMINALS 5000 4000 3000 2000 1000 0 2014 2015 2016 CASE STUDY DDoS Copycats PROPORTION OF CYBERCRIME TO OVERALL CRIME CASES ROSE FROM 7.9 PER CENT IN 2014 TO 13.7 PER CENT IN 2016 The term cybercrime refers to (a) offences where a computer system is the target of a criminal act; and (b) offences where traditional crimes are committed via the means of a computer system. The first category of offences refers to offences under the Computer Misuse and Cybersecurity Act (CMCA) and the second category of offences refer to traditional crimes performed online such as online cheating, and cyber extortion. Ministry of Home Affairs, National Cybercrime Action Plan. (2016, July 20). Retrieved from https://www.police.gov.sg/ news-and-publications/mediareleases/20160720_others_-launch_ of_the_national_cybercrime_action_ plan_others 4 26 Singaporeans rely on the Internet for news and information, to connect with friends on social media, and to shop and transact online. Consequently, they have also become targets of cyber criminals who go online to seek illicit monetary gains. SPF has observed that criminals have been increasingly moving their activities online, with the proportion of cybercrimes to the total number of crimes in all categories (inclusive of physical crimes) increasing over the past two years. The proportion of cybercrime to the total number of crime cases has been growing from 7.9 per cent in 2014 to 13.7 per cent in 2016. In 2016, cyber criminals mostly committed online cheating cases (83 per cent), followed by CMCA cases such as unauthorised access to computer material (15 per cent) and cyber extortion (2 per cent) respectively4. The top three categories of online cheating cases were namely e-commerce, Internet love scam and creditfor-sex. Notably, CMCA cases more than doubled year-on-year, from 280 in 2015 to 691 in 2016. The top five CMCA cases in 2016, in no particular order, were related to ransomware, hacking, compromise of online accounts (such as Facebook), SingPass and Internet banking accounts. Cyber criminals will continue to be a significant threat actor group as they adopt more sophisticated social engineering techniques to lure their victims. The anonymity provided by the Internet and the borderless nature of cyberspace allow cyber criminals to operate freely and anonymously. Given this challenge, the Government, law enforcement agencies and the international community will have to work even more closely together to fight cybercrimes. In June 2016, a Singapore institution received a cyber threat which appeared to be from a cyber criminal group known for its DDoS attacks. They demanded the payment of a ransom, failing which they would launch a DDoS attack on the institution. The threat was sent in the form of a ransom e-mail to the institution, demanding for Bitcoins to be paid. A “demo attack” – akin to a warning shot by the attackers – was launched before the due date, but the DDoS threat was eventually not carried out. CSA assessed that the threat was likely from a copycat group. The actual cyber criminal group is infamous for being able to launch DDoS attacks of more than 1 Tbps, and had previously issued similar ransom threats to several companies in Switzerland. Identifying attackers and attributing attacks to them becomes even more challenging as actors within the community mimic one another to hide their tracks. 27