1 00:00:00,000 --> 00:00:00,833 In this lesson, 2 00:00:00,833 --> 00:00:04,200 we'll be covering organized crime in the cyberspace. 3 00:00:04,200 --> 00:00:06,960 In recent years, a new formidable force has arisen 4 00:00:06,960 --> 00:00:08,850 in the world of threat actors. 5 00:00:08,850 --> 00:00:11,910 Just like the mafia dons of the 1940s and 1950s 6 00:00:11,910 --> 00:00:15,120 in the United States, new organized crime groups have found 7 00:00:15,120 --> 00:00:17,490 that it was time to move their operations online 8 00:00:17,490 --> 00:00:18,750 to increase their reach 9 00:00:18,750 --> 00:00:21,510 and their ability to profit from their attacks. 10 00:00:21,510 --> 00:00:23,970 When we refer to this new class of threat actor, 11 00:00:23,970 --> 00:00:25,800 we refer to them as organized crime 12 00:00:25,800 --> 00:00:27,840 or organized cybercrime. 13 00:00:27,840 --> 00:00:30,390 Organized cybercrime groups are sophisticated, 14 00:00:30,390 --> 00:00:33,870 well-structured entities that leverage the resources 15 00:00:33,870 --> 00:00:36,300 and technical skills for illicit gain 16 00:00:36,300 --> 00:00:39,750 while causing significant harm to individuals, businesses, 17 00:00:39,750 --> 00:00:41,670 and governments alike. 18 00:00:41,670 --> 00:00:44,610 At their core, organized cybercrime groups are groups 19 00:00:44,610 --> 00:00:46,830 or syndicates that have been banded together 20 00:00:46,830 --> 00:00:49,980 to conduct criminal activities in the digital world. 21 00:00:49,980 --> 00:00:52,170 These groups are typically well-structured, 22 00:00:52,170 --> 00:00:54,690 with members assigned specific roles based 23 00:00:54,690 --> 00:00:56,820 on their skills and expertise. 24 00:00:56,820 --> 00:00:59,190 Organized crime groups operate similar 25 00:00:59,190 --> 00:01:02,310 to traditional organized crime in the physical world, 26 00:01:02,310 --> 00:01:05,160 but their activities are focused on cyberspace, 27 00:01:05,160 --> 00:01:06,960 which provides them anonymity 28 00:01:06,960 --> 00:01:09,150 and global reach of the internet. 29 00:01:09,150 --> 00:01:12,270 Also, since they are operating across national borders, 30 00:01:12,270 --> 00:01:15,570 these transnational organized cybercrime organizations 31 00:01:15,570 --> 00:01:18,840 can create increased complexity for law enforcement 32 00:01:18,840 --> 00:01:21,900 when they attempt to prosecute these attackers. 33 00:01:21,900 --> 00:01:23,850 In terms of their technical capabilities, 34 00:01:23,850 --> 00:01:26,310 organized crime groups possess a very high level 35 00:01:26,310 --> 00:01:27,540 of technical capability 36 00:01:27,540 --> 00:01:30,750 and they often employ advanced hacking techniques and tools, 37 00:01:30,750 --> 00:01:32,790 including custom malware, ransomware, 38 00:01:32,790 --> 00:01:35,190 and sophisticated phishing campaigns. 39 00:01:35,190 --> 00:01:37,890 Their criminal operations are usually well-planned 40 00:01:37,890 --> 00:01:41,490 and coordinated based on the criminal ring structured nature 41 00:01:41,490 --> 00:01:44,700 and strategic approach to conducting attacks. 42 00:01:44,700 --> 00:01:48,120 Organized cybercrime groups also demonstrate a high level 43 00:01:48,120 --> 00:01:49,380 of adaptability, 44 00:01:49,380 --> 00:01:51,870 since they are constantly evolving their methods 45 00:01:51,870 --> 00:01:55,680 and response to new security measures and opportunities. 46 00:01:55,680 --> 00:01:57,630 These groups are also known 47 00:01:57,630 --> 00:02:01,140 to exploit emerging technologies such as cryptocurrencies, 48 00:02:01,140 --> 00:02:02,190 the dark web, 49 00:02:02,190 --> 00:02:04,860 and the use of cellular collection devices 50 00:02:04,860 --> 00:02:08,550 to facilitate their activities and evade detection. 51 00:02:08,550 --> 00:02:10,050 When it comes to the motivations 52 00:02:10,050 --> 00:02:11,940 for organized cybercrime groups, 53 00:02:11,940 --> 00:02:14,190 it is almost always found to be focused 54 00:02:14,190 --> 00:02:16,410 on the group's financial gain. 55 00:02:16,410 --> 00:02:18,930 These criminal groups will engage in a variety 56 00:02:18,930 --> 00:02:22,950 of illicit activities to generate revenue for their members, 57 00:02:22,950 --> 00:02:26,790 including data breaches, identity theft, online fraud, 58 00:02:26,790 --> 00:02:28,620 and ransomware attacks. 59 00:02:28,620 --> 00:02:30,780 Often, these groups will target small 60 00:02:30,780 --> 00:02:32,430 or medium-sized businesses 61 00:02:32,430 --> 00:02:34,530 and high net worth individuals 62 00:02:34,530 --> 00:02:38,400 who have substantial financial resources or valuable data. 63 00:02:38,400 --> 00:02:40,680 Unlike hacktivists or nation-state actors, 64 00:02:40,680 --> 00:02:43,440 organized cybercrime groups are not typically driven 65 00:02:43,440 --> 00:02:45,690 by ideological or political objectives. 66 00:02:45,690 --> 00:02:48,720 However, these groups may be hired by other entities, 67 00:02:48,720 --> 00:02:51,720 including governments, to conduct cyber operations 68 00:02:51,720 --> 00:02:53,463 and attacks on their behalf. 69 00:02:54,390 --> 00:02:55,740 So while they may operate 70 00:02:55,740 --> 00:02:58,320 in the political spectrum, they only do so 71 00:02:58,320 --> 00:03:00,990 in order to generate financial gains for the group. 72 00:03:00,990 --> 00:03:03,540 Essentially, when conducting these types of attacks, 73 00:03:03,540 --> 00:03:05,580 the groups are acting as hired guns 74 00:03:05,580 --> 00:03:08,280 or mercenaries for the political organization 75 00:03:08,280 --> 00:03:10,080 or government that hires them. 76 00:03:10,080 --> 00:03:12,990 A good example of an organized cybercrime group is a group 77 00:03:12,990 --> 00:03:15,480 that is referred to as FIN7. 78 00:03:15,480 --> 00:03:18,030 FIN7 is a sophisticated cybercrime syndicate 79 00:03:18,030 --> 00:03:21,570 that has been linked to numerous high-profile data breaches 80 00:03:21,570 --> 00:03:23,700 which primarily targeted the retail 81 00:03:23,700 --> 00:03:25,650 and hospitality industries. 82 00:03:25,650 --> 00:03:28,650 FIN7 is known for its advanced phishing campaigns 83 00:03:28,650 --> 00:03:31,350 that use carefully crafted emails and websites 84 00:03:31,350 --> 00:03:32,490 to trick employees 85 00:03:32,490 --> 00:03:34,680 into revealing their login credentials 86 00:03:34,680 --> 00:03:37,500 or installing malware onto their systems. 87 00:03:37,500 --> 00:03:40,800 Another organized cybercriminal group is the Carbanak group, 88 00:03:40,800 --> 00:03:44,250 which has reportedly stolen over $1 billion 89 00:03:44,250 --> 00:03:46,170 from various banks around the world. 90 00:03:46,170 --> 00:03:48,330 The Carbanak group uses sophisticated piece 91 00:03:48,330 --> 00:03:50,880 of malware they created, known as Carbanak, 92 00:03:50,880 --> 00:03:52,860 to infiltrate various banking networks 93 00:03:52,860 --> 00:03:55,530 in order to manipulate the bank's system 94 00:03:55,530 --> 00:03:59,280 to allow the group to transfer money between accounts 95 00:03:59,280 --> 00:04:02,670 and to dispense cash from ATMs remotely. 96 00:04:02,670 --> 00:04:05,130 So remember, organized cybercrime groups refer 97 00:04:05,130 --> 00:04:07,470 to the coordinated groups or networks 98 00:04:07,470 --> 00:04:10,290 of individuals who engage legal activities 99 00:04:10,290 --> 00:04:11,550 in the digital realm 100 00:04:11,550 --> 00:04:14,550 for financial gain or other malicious purposes. 101 00:04:14,550 --> 00:04:17,910 These organized cybercriminals represent a significant 102 00:04:17,910 --> 00:04:20,670 and growing threat online due to their combination 103 00:04:20,670 --> 00:04:22,230 of being highly structured 104 00:04:22,230 --> 00:04:25,350 and their use of a traditional organized crime strategy 105 00:04:25,350 --> 00:04:26,700 that is then combined 106 00:04:26,700 --> 00:04:29,580 with advanced technical skills to enable them 107 00:04:29,580 --> 00:04:30,780 to conduct large-scale 108 00:04:30,780 --> 00:04:34,263 and highly lucrative cyber attack operations.