RSA has released its online fraud report for May 2013

Jun 11, 2013 11:12 GMT  ·  By

On Monday, RSA released its monthly online fraud report for May. Besides the figures about worldwide phishing campaigns, the study also makes an interesting link between phishers and hacktivists.

While hacktivists, such as the ones from the Anonymous movement, usually rely on distributed denial-of-service (DDOS) attacks to make their point, they sometimes decide to leak sensitive data from the companies they target.

According to experts, cybercriminals eagerly wait until hacktivists publish data stolen from major organizations.

For instance, in the attack against Sony Entertainment, where the details of almost 25 million users were leaked online, Sony’s reputation wasn’t the only one that suffered.

Cybercriminals immediately made copies of the leaked information and started abusing it for their own profit.

“For fraudsters, the large-scale hacks are like candy. Hacktivists will set up publicly available download links for anyone to be able to see the exposed databases, their hunting trophy, and end their part there. But as soon as the links are public, cybercriminals and fraudsters will access and download it before it is taken down by the hosting authorities,” the RSA report reads.

This way, they don’t have to bother stealing the data themselves.

Cybercriminals can abuse data leaked by hacktivists for various malicious activities.

Phishing spam campaigns, identity theft, fraud, malware distribution, selling information on underground websites, and accessing victims’ other accounts (considering that many users utilize the same password for more than one account) are a few ways in which they can profit from a hacktivist operation.

“It’s easy to see how an attack that stems from idealistic motivations, targeting very large entities and supposedly conceived in order to protect people’s rights to information, ends up serving the fraudsters and flooding the Internet with confidential data,” the report notes.

“With the variety of actors that gain access to information publicly posted online, hacktivists end up inadvertently damaging the very people whose interests they claim to represent.”