Experts say the hackers' use of low-tech tactics such as phone calls to target the financial industry illustrates how, despite sophisticated security programs and AI-driven threats, the oldest tactics still rank among the most effective. If successful, the hacks could compromise data of some of the biggest U.S. private equity firms that provide capital to companies.
“Because the fence is now so fancy and high-tech, we just have to trick the guard into opening the door for us,” said Lee Clark, a cyberthreat intelligence production manager with the Retail and Hospitality ISAC, an industry information sharing and analysis group.
“That human element consistently is why this has exploded in the way it has," he said.
KKR, Bain Capital, CME, TPG and Apollo declined to comment. Blackstone, Bridgewater Associates and Moody's did not immediately respond to requests for comment.
In its blog post, Google — a unit of Alphabet GOOGL.O — said the hackers had recently turned their attention to private equity, law firms, and financial ratings agencies.
Austin Larsen, the principal threat analyst at Google’s Threat Intelligence Group, said the hackers generally targeted industries based on financial calculations, often successfully.
“Really it’s a money thing,” Larsen said. “They think that these firms or organizations have data sensitive enough that, if taken, they would pay to prevent it.”
Google did not identify any of the hackers’ targets by name. Reuters reverse-engineered many of the company-specific online traps used by the hackers by running the 72 malicious websites Google listed in its report through web intelligence platforms such as DomainTools and urlscan, which flagged malicious subdomains tailored to each firm.
Speaking in general about the subdomains, Larsen said "they all were likely used in attempted intrusions" though he cautioned "they were not all successful."
Google said the hackers used “meticulous social engineering tactics,” reaching employees on their personal cellphones while pretending to call from their company’s help desk, sometimes displaying the correct help desk phone number. The hackers told their targets there was an urgent directive from IT to update their passkeys or multifactor authentication and steered the employees toward a booby-trapped website named “passkeyhelpdesk” or “secure-passkey.” If an employee followed the instructions to enter their password, the hackers would harvest their fail-safe passcode – typically sent by text or generated by an app – live over the phone and hijack their account before the call terminated.
Larsen said it was wrong to think of the tactic as particularly advanced.
"Sophisticated is not the right word," he said. "It is just really effective."
XLF•
