How To Stop a Keylogger from Exploiting Your Business Data

How To Stop a Keylogger from Exploiting Your Business Data

Table of Contents

Your company information offers a lucrative incentive for a cybercriminal intent on theft. Data such as login credentials and sensitive customer and company information provides hackers with the necessary information to carry out a host of cyberattacks, including ransomware infections and Business Email Compromise (BEC) scams. According to the most recent studies, infections by Infostealer malware, like keyloggers used to gather data, have increased by 58%. Individuals and businesses are at risk from this insidious type of malware that spies on your every keystroke.

What is Keylogger Malware?

What is Keylogger Malware?

Keyloggers can have legitimate uses, such as in an educational setting. However, they can also be a type of malware. Once installed on a device, like a laptop or mobile phone, the keylogger will capture and record all of the user's interactions with their keyboard. As such, a keylogger is a form of spyware malware.

Some sophisticated keyloggers are also designed to use your device's camera and microphone to take recordings of your image and voice. There are hardware forms of this malware, but they need to be physically connected to the device. Because of the more complex setup of a hardware keylogger, software keyloggers are more common.

Software keyloggers are installed on computers if a user downloads an infected application. Once installed, the keylogger records the data it is designed to capture and then sends it to the hacker via a remote server known as a Command and Control (C&C) center. The types of data gathered by a keylogger include login credentials, financial data, personal information like social security numbers, and proprietary commercial information.

Keyloggers find their way onto a device using various methods, including the following:

  • Phishing: Attackers love phishing in all its forms, including email, SMS text messages, social media, and mobile messaging apps. Phishing messages trick users into clicking malicious links or downloading infected attachments.
  • Dark web marketplaces: Attackers can buy login credentials and other data from dark web marketplaces and use these to gain unauthorized access that allows them to install malware.
  • Social engineering: Attackers manipulate victims using social engineering techniques to reveal login credentials or download keylogger malware.
  • Exploiting vulnerabilities: Software vulnerabilities can offer attackers a way into an operating system, allowing them to install a keylogger.
  • Supply chain attacks: Compromised supply chain vendors can be exploited and used to distribute keyloggers via legitimate software or hardware.

How Do Keyloggers Harm Small to Medium-Sized Businesses?

The information captured and sent to a hacker by the keylogger malware is then used to carry out secondary cyberattacks. The most common types of harmful events that occur because of a keylogger infection are as follows:

Login Credential Theft

Man-in-the-Middle (MitM) keyloggers are typically installed in a browser during an attack. Stolen credentials are a foundational tactic that leads to many other types of cyberattacks, including Business Email Compromise (BEC) and ransomware infections.

Data Theft and Exposure

Keyloggers can lead to stolen and exposed data. The malware can be designed to gather specific types of data, such as financial or sensitive company information. Bank login details, PINs, and credit card info are all at risk from keyloggers.

However, company details such as private business details, sales numbers, and new product features yet to be released are also at risk. Keyloggers used for industrial espionage go back to the 1970s when Soviet engineers developed the Selectric bug to spy on American Embassy electric typewriters.

Account Takeover Attacks (ATO)

Stolen login credentials can lead directly to an account takeover. Around 83% of businesses have suffered the impact of an ATO attack. Account takeovers may compromise email accounts, allowing attackers to impersonate employees and executives.

Once an attacker has control over an email account, they can use this to manipulate others into performing acts that benefit the cyberattack. One of the most common forms of attack that exploits email accounts is a Business Email Compromise (BEC) scam.

BEC Scams

Business Email Compromise scams are heavily reliant on social engineering. However, having login credentials obtained using a keylogger can help make the scam more successful. BEC attackers use the implicit trust between a C-level executive and their team in accounts to trick employees into making payments to fraudsters.

Ransomware Infection

Login credentials provide the means to gain unauthorized access to sensitive areas of a network. Even low-level access accounts provide an entry point. Cybercriminals use specialist tools to escalate the privileges once inside a network to a point where they have administrator access. Once they have the right access rights, they can install ransomware.

Theft of Sensitive and Proprietary Business Information

Industrial espionage is one of the common uses of keylogger software. Cybercriminals may use the dark web to identify and gather target information. Also, cybercriminals post stolen trade secrets and other proprietary information on the dark web for sale to competitors or as a way to extort money from a company.

The Costs to an SMB Infected by a Keylogger

Keyloggers are a small but costly form of malware that opens the door to many forms of cyberattacks. Costs from keylogger infection depend on the use of the data, but the figures below give you some idea of the impact on an SMB:

Financial Losses From BEC Scams

The FBI recorded $2.9 billion in financial costs to U.S. businesses from BEC scams, with the average cost to a business being $137,132. (Source)

A recent case highlighted by the National Cybersecurity Alliance shows the impact of a keylogger-based BEC scam on an SMB. The attackers targeted a small family-owned construction company using a malware-infected phishing email. An employee opened the email, believing it was from a supplier. On opening, the keylogger software was installed. This allowed the attackers to capture the online banking credentials.

Even though challenge questions were needed to access the bank account, the attackers could identify these questions because of the keylogging malware. The business owner was notified that an unknown source initiated an ACH transfer of $10,000. Overall, the cybercriminals made a company bank totaling $550,000 within one week of installing the malware. (Source)

Industrial Espionage

It can be difficult to put a figure on the losses experienced if company secrets, like customer data, get into the hands of a competitor. However, the World Economic Forum (WEF) has found that one in three CEOs places cyber espionage and loss of sensitive information/ intellectual property (IP) theft as a top concern. Costs for IP losses to the USA estimated by the Commission on the Theft of American Intellectual Property range from $225 billion to $600 billion, or about 1% to 5% of the US GDP.

Reputation Damage

One of the hidden costs of a cyberattack is the cost of a damaged reputation from a ransomware attack or breached customer data. Reputation damage can include loss of customer trust, brand updates to account for the damage, and financial losses from lost sales.

Data Breach Costs

According to an IBM study, the average cost of a data breach is $4.88 million. Data breaches at smaller companies cost an average of $2.98 million, and organizations with fewer than 500 employees an average of $3.31 million.

Downtime and System Damage

The cost of a single hour of downtime ranges from $1,000 to over $100,000, depending on the severity of the attack and the size of the SMB (Source).

Which of the Following Cyber Risks Are You Most Concerned About in the Context of Geopolitical Tensions?

Source: WEF Global Cybersecurity Outlook

Signs of a Keylogger Malware Infection

Signs of a Keylogger Malware Infection

Look for these signs that your device may be infected by a keylogger:

  • Your device runs slowly – keyloggers are resource-hungry
  • Weird glitches and error messages pop up
  • You notice a password has changed or there is unusual account activity
  • You notice increased Network Activity – this may be the stolen data being sent to the hacker.
  • Your mouse Cursor is erratic, or you find clicking difficult.

How To Detect a Keylogger Infection

You should regularly carry out the following:

Full Malware Scan

Anti-malware / anti-virus software should be run regularly to scan for keyloggers and other forms of malware. However, cybercriminals are continually finding ways to evade detection by these tools. It is, therefore, important to use other measures alongside anti-malware tools.

Task Manager (Windows) or Utility Monitor (Mac)

Keylogger malware and other forms of malware often show up as unusual applications that you do not recognize. These applications typically show excessive use of resources.

Once detected, keyloggers should be removed with caution. If an anti-malware tool finds the malware, this can be used to remove the keylogger.

How To Stop a Keylogger from Harming Your Company

Detection of a keylogger that is already installed is worth doing, however, prevention is better than a cure. Use the following measures to help ensure your company devices do not get infected with keylogger malware.

Prompt Software Patching

Prompt Software Patching

Keylogger software, like many forms of malware, may exploit software vulnerabilities during the installation process. To help prevent the installation of malware, always keep software up-to-date by promptly installing patches.

Dark Web Monitoring

Keyloggers are often used to steal sensitive company information, which can then end up for sale on the dark web. Dark Web monitoring tools allow a business to identify risks to its business from within the dark web. The tools monitor stolen company information, including login credentials, corporate credit cards, and other sensitive company data. By continuously monitoring the dark web for stolen data, your business can be forewarned and stay ahead of cyber attackers targeting your company.

Keystroke Encryption

Keystroke encryption is designed to scramble keystroke output and so prevent cybercriminals from using the data. It is specifically designed to protect against keyloggers but not other forms of malware.

MFA

Multi-factor encryption adds an additional layer of authentication when logging into accounts. This can help prevent unauthorized access gained by passwords stolen by a keylogger. MFA is a useful extra protective layer, but not infallible, as cybercriminals have developed several MFA bypass methods.

Anti-Phishing Tools

Phishing emails are often the source of keyloggers. These malicious emails may contain infected attachments that, once opened, automatically install the keylogger. Anti-phishing tools use advanced technologies, including AI, to identify potentially infected emails and stop them from entering an employee's inbox.

Anti-Malware Tools

Anti-malware is an important foundation measure in detecting keyloggers and other malware attempting to install on a device. It must be kept up-to-date. Next-generation anti-virus solutions offer more advanced technologies to help with evasive malware.

Security Awareness Training

Training employees to identify cyber threats is essential to help prevent a keylogger infection. Security awareness educates employees on the tactics used by cybercriminals when creating phishing messages.

Real-World Examples of Keylogger Malware Infection

Two real-world examples show the widespread use and damage caused by keyloggers:

HawkEye Reborn v8.0 and v9.0

The infamous keylogging malware Hawkeye was used in spam campaigns targeting business users. The spam email was branded to look like it was from a large Spanish bank. Targeted industries included transportation and logistics, agriculture, and healthcare. Once installed, the keylogger malware stole account credentials and sensitive data. The data was then used for further attacks, such as ATO and business email compromise (BEC).

Olympic Vision Keylogger

The Olympic Vision keylogger was used to compromise the accounts of key personnel in companies from 18 countries, including the U.S., the Middle East, and Asia. The phishing emails were made to look like messages from business partners. Once installed, the malware was used to steal login credentials, email clients, FTP programs, and instant messaging applications. The attackers then used the data to carry out Business Email Compromise scams.

Table of Contents