Inside a Modern Fraud Attack: From Bot Signups to Account Takeovers

**

What Happened

In recent years, cybercrime has evolved to become more sophisticated and widespread. Modern fraud attacks, for example, use a combination of automation and human-driven sessions to evade detection. According to a recent report, these attacks start with automation to create scale, using bots and scripts to open large numbers of accounts with minimal human effort. Those bots are usually powered by "aged" or compromised emails and leaked credentials, making every account look like it belongs to a long-standing user.

New Exploits Emerge

A new exploit kit, known as Coruna, has been linked to the Triangulation attacks that targeted iPhones via zero-click iMessage exploits in 2023. The kit contains five full iOS exploit chains leveraging 23 vulnerabilities, including CVE-2023-32434 and CVE-2023-38606. Coruna is an evolution of the framework used in the Operation Triangulation espionage campaign, which targeted iPhones on Kaspersky's network.

Global Spyware Market Expansion

The global spyware market is expanding through intermediaries, despite government restrictions. A recent study found that third-party resellers and brokers are foiling transparency efforts and allowing spyware to spread. This has significant implications for cybersecurity, as spyware can be used to compromise sensitive information and disrupt critical infrastructure.

Key Facts

• What: Modern fraud attacks use automation and human-driven sessions to evade detection.
• When: The Coruna exploit kit was linked to the Triangulation attacks in 2023.
• Where: The global spyware market is expanding through intermediaries, despite government restrictions.
• Impact: Cybercrime is becoming increasingly sophisticated, with significant implications for cybersecurity.
• Who: Databricks has previewed a new open agentic Security Information and Event Management software (SIEM) named Lakewatch, which signals its first deliberate step beyond data warehousing into security analytics.

What Experts Say

> "Right now, existing solutions' (rival SIEMs) ingestion costs force teams to discard up to 75% of their data, so while attackers can use AI to attack anywhere, defenders only see a fraction of their own data. Our goal with Lakewatch is to close this gap... because our lakehouse architecture is uniquely built to handle massive amounts of data cheaply." — Andrew Krioukov, general manager of Lakewatch at Databricks.

What to Watch

As cybercrime continues to evolve, it's essential to stay vigilant and proactive in protecting sensitive information. The emergence of new exploits, such as Coruna, and the expansion of the global spyware market through intermediaries, highlight the need for robust cybersecurity measures. The development of new security tools, such as Lakewatch, offers hope for improving cybersecurity, but more needs to be done to stay ahead of the threats.