SEC investigates financial hackers attacking biotech firms
The Securities and Exchange Commission doesn't usually investigate cyberattacks, but it's making an exception this time to hunt for a group of hackers known as FIN4. The group reportedly breaks into companies' email accounts to find corporate secrets and info, such as mergers, that can be used to game the stock market. According to Reuters, the agency has asked at least eight companies for detailed accounts of the security breach they experienced in the past few years in an effort to find the suspects. Security company FireEye Inc. first published a report about the hackers back in 2014, where it revealed some of the tricks they used to steal info. One of them is phishing for executives' and lawyers' log-in credentials through fake Microsoft Outlook home pages. They also use confidential info they dig up to persuade market insiders to divulge more secrets.
FireEye manager Laura Galante clarified that it wasn't their phishing method that made the hackers a serious threat, though. "What was insidiously brilliant," she said, "was that they could inject themselves into email threads and keep gleaning information. They really knew their audience." FIN4 has reportedly been around since 2013 and has targeted over 100 companies thus far, 60 of which belong to the medical, biotech and healthcare fields. These markets tend to fluctuate rapidly, so anyone who knows the latest acquisition, new product announcements and the like could earn some serious dough -- if they play their cards right.
That and the fact that the hackers seem to be fluent in English are the reasons why FireEye believes the team is based in the US or in Europe. The members must have a deep understanding of how the markets work in those locations, otherwise any info they steal is useless... unless they sell it to someone else.
[Image credit: Alamy]
