Taking Public-Private Collaboration in combatting Cybercrime to the next level by Chris Lynam

Key Concepts

• Cybercrime as a Service (CaaS)
• Stolen Credentials
• Artificial Intelligence (AI) in Cybercrime
• Scattered Spider
• Business Email Compromise (BEC)
• Authorized Push Payments (APP)
• Scam Compounds
• Team Sport Approach to Cybercrime
• Four Lines of Effort: Prevent, Intervene, Pursue, Build
• Genesis Marketplace
• Lockbit Ransomware
• LabHost (Phishing as a Service)

Threat Landscape and Trends

• Cybercrime as a Service (CaaS): This is a major driver, enabling individuals with limited technical skills to engage in cybercrime.
• Stolen Credentials: The prevalence of stolen credentials is a significant issue, facilitating various types of cyberattacks.
• AI-Powered Cybercrime: AI is actively being used by cybercriminals for code design and sophisticated social engineering. Platforms like Ghost GBT or Escape are emerging as "LLM cybercrime as a service."
• State Actors: North Korea is identified as a major cyber threat, engaging in bank heists and cryptocurrency theft. They employ sophisticated operations, including placing IT developers in private sector companies in North America and Europe.
• Adaptive Adversaries: Groups like Scattered Spider, composed of young individuals with exceptional social engineering skills, pose a significant threat.
• Malicious Campaigns: High-profile individuals in government and the private sector are targeted with sophisticated campaigns.
• Cyber Fraud: Cyber fraud, including BEC and APP scams, is rampant. Economic losses from BEC are estimated to be higher than those from ransomware.
• Scam Compounds: Operations in Southeast Asia (Cambodia, Laos, Myanmar) lure individuals into forced labor in scam compounds, resulting in billions of dollars stolen from Western countries.

Financial Impact

• The Canadian Anti-Fraud Centre reported almost $650 million in losses in 2024.
• This figure is estimated to represent only 5-10% of the actual losses, suggesting a potential $6.5 billion impact when extrapolated.
• This does not include business interruptions and network rebuilding costs.

Law Enforcement Approach: Team Sport

• The National Cyber Crime Coordination Center (NC3) adopts a "team sport" approach, collaborating with law enforcement, the private sector, government entities, and nonprofits.

Four Lines of Effort

1. Prevent:
   • Traditional cybersecurity awareness and education.
   • Focus on deterring young Canadians (ages 10-12) from becoming cybercriminals, often influenced by the online video gaming community.
2. Intervene:
   • Reaching out to potential victims based on intelligence from law enforcement partners.
   • Assisting victims in recovering funds wired to fraudsters by freezing transactions through an international network of law enforcement and banks.
   • Providing decryption tools to ransomware victims to avoid ransom payments.
3. Pursue:
   • Joint, sequenced operations to target cybercriminals, aiming for arrests, infrastructure seizure, cryptocurrency account seizure, and disruption of their activities.
   • Discrediting cybercrime-as-a-service operations to discourage their use.
4. Build:
   • Upskilling law enforcement personnel in Canada and within the RCMP.
   • Addressing the need for increased investment in law enforcement to match the evolving threat landscape.

Operational Examples

1. Operation Cookie Monster (April 2023):
   • Joint operation against the Genesis Marketplace, which sold access to online accounts (email, Amazon, banking).
   • Genesis Marketplace offered over 1.5 million "bots" (compromised accounts) for sale at low prices.
   • 79 police actions across Canada, including arrests and search warrants.
   • Collaboration with the FBI, including the use of a "cyber dog" capable of detecting electronic components.
2. Operation Kronos:
   • International operation against the Lockbit ransomware-as-a-service group.
   • Lockbit was the most impactful ransomware globally, with a cult-like following.
   • Seizure of Lockbit infrastructure by 10 countries.
   • Unmasking and sanctioning of the organization's Russian-based leader.
   • Arrest and extradition of a Canadian affiliate to the US.
3. Project Nova:
   • Operation against the LabHost phishing-as-a-service platform.
   • LabHost allowed users to create realistic bank login pages and bypass multi-factor authentication for a monthly fee ($179-$249).
   • Over 5,000 subscribers to the Canadian Telegram channel targeting Canadian victims.
   • Estimated one million Canadians victimized, with potential losses of several hundred million dollars.
   • Close collaboration with financial institutions to proactively share victim data.

Intervention Example: Google Ads Campaign

• A Google Ads campaign was launched in Nova Scotia to deter potential cyber offenders.
• A webpage was created explaining the illegality of phishing and offering alternative, ethical uses for tech skills.
• The campaign targeted users searching for relevant keywords.
• Results: Over 10,000 impressions, 1,200 click-throughs, at a cost of $2,200.

Notable Quotes

• (Regarding AI in cybercrime) "It's full game on now... it is being used in a really prevalent way."
• (Regarding LabHost) "Stay safe and happy spamming, right?" (referencing the platform's promotional video)

Technical Terms

• LLM: Large Language Model, a type of AI model used in platforms like Ghost GBT.
• VPS: Virtual Private Server, used to host phishing pages.
• Anti-bot settings: Measures to prevent automated bots from accessing phishing pages.
• Impressions: The number of times an advertisement is displayed.
• Click-through rate: The percentage of impressions that result in a user clicking on the advertisement.

Synthesis/Conclusion

The cyber threat landscape is rapidly evolving, driven by factors like CaaS, AI, and sophisticated social engineering. The financial impact is substantial, with billions of dollars lost annually. Law enforcement is adopting a collaborative, multi-pronged approach, focusing on prevention, intervention, pursuit, and capacity building. Operations like Cookie Monster, Kronos, and Nova demonstrate the effectiveness of international cooperation and innovative tactics. Deterring young people from entering cybercrime and proactively intervening with potential victims are crucial strategies. Despite limited resources, a "team sport" approach is essential to effectively combat cybercrime and protect Canadians.