In the ever-evolving fraud landscape, fraudsters have shifted their tactics from using third-party devices to on-device fraud.
Now, users face the rising threat of fraud involving remote access tools (RATs), while banks and fraud detection vendors struggle with new challenges in detecting this invisible threat.
Let’s examine the modus operandi of fraudsters, prevalence rates across different regions, classic detection methods and Trusteer’s innovative approach to RAT detection through keystroke analysis.
A rising threat
As Fraud detection methods become more and more accurate, fraudsters have moved from account takeovers (ATOs) from a third-party device to on-device fraud. This can be done either by a legitimate remote access tool (RAT) or by one developed by fraudsters.
Trusteer’s customer data analysis shows that RAT device takeover has become a prevalent form of fraud, constituting a significant proportion of browser-based fraudulent activities in the U.K. and Australia.
This modus operandi started in English-speaking countries and then moved to Spain and Latin America. It has recently surfaced in France and Japan, where it was previously unreported.
Modus operandi: The classic tech support scam
A popular method fraudsters use involves a legitimate RAT, such as Team Viewer or AnyDesk, which allows them to access the victim’s device remotely. These frauds typically involve a social engineering component to convince the user to install the tool and allow the fraudsters to access their device.
Most tech support scams follow these steps:
Step 1: A user is browsing online and is redirected to a malicious website with a pop-up claiming that the device has been infected with malware. The pop-up contains a phone number to a rogue technical support team that can “assist” with “cleaning” the device.
Step 2: The user calls the phone number and is asked to download a RAT and grant the fraudster permission to connect to their device remotely.
Step 3: Next, the legitimate user establishes a banking session to pay for the services. If a one-time password is required to authenticate a new target account identifier, this action is authorized by the victim.
Explore IBM Security Trusteer Solutions
Typical detection methods
One of the typical methods to detect RAT is through lower mouse movement frequency.
If on-device mouse movements comprise many small, frequent events, some of these events get lost while transmitting remote mouse movements. This results in fewer measurable events.
The image below illustrates how these movements would look in a graphic form.
However, the rise of remote work during COVID-19 pushed forward many improvements in remote communication tools — RATs included — altering the old detection models.
Challenge accepted: Trusteer’s innovative solution
Trusteer’s research teams have risen to the RAT fraud detection challenge by exploring alternative detection methods. We have identified distinct behavioral patterns unique to each RAT. The unique behavioral “fingerprints” allow Trusteer’s fraud detection products to detect the use of a RAT and identify the specific tool used during the attack.
For example, the following graphic shows a distinct behavioral pattern, leveraging data from user flow, key and mouse elements in fraud sessions with a RAT mainly used in central Europe.
(Source: IBM Trusteer)
These patterns have been recorded in about 20% of fraud sessions using RATs, as opposed to only 0.01% of legitimate sessions. This helps our teams detect RAT-enabled fraud with more certainty.
Stay safe from RAT fraud
RAT fraud has reached every corner of the world while becoming increasingly invisible, posing a challenge to banks and security teams.
However, Trusteer’s fraud detection system, Pinpoint Detect (PPD), can identify fraud sessions involving RATs with remarkable coverage and accuracy based on behavioral analyses.
If you have further questions about RAT fraud, please contact IBM Trusteer Enterprise Support by opening a case in the Customer Portal.
This post was made possible through the contributions of Nir Somech, Andrey Finkelshtein and Dean David Hershkowitz.
