Quarter Four Report 2018

This quarter, CERT NZ received 1,333 incident reports. This is the highest number of reports to date. These reports show how online threats and vulnerabilities can have a big impact on business operations and the day-to-day lives of New Zealanders.

Some examples include:

A significant spike in scam and fraud reports which made up 50% of the total number of reports received in quarter four, an increase of 230% from quarter three.
Reports increased by more than 60% (from quarter three) across every region in New Zealand, with the exception of Auckland which increased by 47%.
Reports from the age group 65+ made up over quarter of reports about individuals.

Quarterly Report: Highlights [PDF, 2.2 MB]

Quarterly Report: Data Landscape [PDF, 1015 KB]

Highlights

1,333 incident reports were received in quarter four, up 53% from quarter three.

$5.9 million in reported losses up $3m from quarter three.

783 reports were about individuals, up 103% from quarter three.

Malware reports continued to increase with 48 reports, more than double the amount in quarter three.

Results in numbers

Number of incidents reported by quarter

chart showing 1,333 incidents reported in Q4 2018, up from 870 in Q3, 736 in Q2 and 506 in Q1 2018 We received 1,333 reports in the fourth quarter of 2018. This is the highest number of incidents reported to CERT NZ since its establishment.

Results by incident

Breakdown by incident category

Scams and fraud, phishing and credential harvesting, and malware remained the highest incident categories in quarter four.

chart showing 666 reports of scams and frauds and 431 reports of phishing and credential harvesting, with much lower numbers for others categories

Significant spike in scams

graph showing spike in scams in 2018 quarter four

Reports of scams and fraud increased in quarter four, making up half the number of reports received, with a total loss of $4.9 million. In total, 666 scam and fraud reports were received in quarter four, up 236% from quarter three. 91% of scam and fraud reports were about individuals across all ages groups and regions in New Zealand.

Case study: CERT NZ helps business resolve malware infection

In quarter four, a medium-sized New Zealand business was disrupted by a malware infection.

An employee had unknowingly clicked on a link in a phishing email that looked like a legitimate invoice from a standard accounting software service. Clicking the link loaded a webpage, where malware downloaded and infected the employee’s computer.

When the employee accessed the business’ online banking, the malware collected the login and two-factor authentication information and sent it to the attacker. The attacker used the information to access the real banking login page, while the employee was redirected to a 'site under temporary maintenance' page.

The business’ bank noticed that the account was being accessed from an overseas IP address, and reported to CERT NZ. The business also contacted CERT NZ for help to resolve the malware infection while still maintaining their day-to-day operations. We gathered insights from this report and others and published an advisory alerting other businesses to the threat.

Advisory: Malware targeting business customers of New Zealand banks

Email extortion scam

Of all reports received in quarter four, a third related to a particular scam variant, email extortion scams.

This is where scammers target large lists, often sourced from data breaches, with threat-based emails demanding payment.

During quarter four, a number of email scam variants were reported showing that the scammers continually evolve their extortion tactics to try and trick recipients into paying.

Email extortion scams are threat-based emails that try and trick recipients into paying money to make the threat go away. Criminals behind these scams use a range of extortion tactics which have been refined over time.

The campaigns CERT NZ has seen this quarter show scammers have moved beyond just emailing large numbers of people with threats and payment demands. They now include personal information, like passwords, to make their threats seem more real.

How do they target individuals and businesses?

Like most cyber attacks, email extortion scams don’t target any particular individual or business. The scammers are looking for the easiest way to make money. They gather information from public sources, like data breaches, into large sets of user credentials and passwords, and target those users.

In many of the incidents reported, scammers sent an email that included a password they claimed belonged to the recipient. Some recipients reported that the password sent in the email was an old password they no longer used. This shows the scammers were likely using information they sourced from old data breaches, rather than ‘hacking’ the recipient's computer as the email claimed.

How do the scams work?

Scammers collect customer records from data breaches that are available online. Some of these collections contain millions of entries that include information like email addresses, passwords and other account details.

They then send extortion emails to all of the addresses on their list, sometimes including other account information made available in the data breaches. Because of the volumes of emails sent out, even if only a small percentage of people pay, the scammers can still make a considerable amount of money with little effort.

Email extortion example based on recent 'Collection #1' data breach

773 million users' details are exposed in a data breach

Scammers target the database wtih extortion emails

If the average payment demand was $100 and 0.001% of recipients paid, the scammers could potentially extort $773,000.

How do these scams change over time?

Scammers modify their approach to avoid being caught, or when scams become well-known and have less impact. In quarter four, CERT NZ saw this happen in rapid succession.

In October, scammers sent email threats saying they had compromised the recipient’s computer, recorded them using their webcam and monitored their browsing activity. The scammers then threatened to publish embarrassing content about the recipient if they were not paid. CERT NZ issued an advisory to New Zealanders following a high volume of reports.
Advisory: Webcam and password blackmail scam
In November, new email threats claimed that the recipient’s home router had been compromised, revealing sensitive or embarrassing information about them. Attackers used technical language to make the threat more convincing.
In December, scammers sent bomb threat blackmail emails to businesses. The emails threatened to detonate a bomb within the business' building if the payment demand wasn’t met. CERT NZ worked quickly with national and international partners and issued an advisory.
Advisory: Bomb threat emails affecting New Zealanders

What to do if you receive an extortion email

Although these emails can be frightening to receive, it’s important to report them to CERT NZ, and not contact the sender or respond to any threats made. If the scam email includes a password, make sure you change the password on any account where that password is used. You can also check if your information has been leaked in well-known data breaches with tools like ‘Have I been pwned?'

Report to CERT NZ

CERT NZ 2018 summary provides an overview of what we've seen and done in the past year.

2018 summary report