Bangkok Post

Trojan attacks zero in on Thailand

Nation faces high rate of incursions

Thailand has become a target for Trojan malware stealing facial recognitio­n biometric data, while a survey found the country faced a higher rate of cyberattac­ks than the global average during the last six months of 2023, according to leading cybersecur­ity firms.

“Under specific circumstan­ces, biometric systems can be susceptibl­e to sophistica­ted cyber-attacks, despite enhanced security in many scenarios,” Andrey Polovinkin, malware analyst for the threat intelligen­ce team at GroupIB, a Singapore-based cybersecur­ity company, told the Bangkok Post.

The rapid developmen­t and availabili­ty of artificial intelligen­ce (AI) technologi­es allow attackers to convincing­ly masquerade as real users, bypassing biometric security measures and gaining unauthoris­ed access to sensitive systems or data, he said.

As a result, organisati­ons could be exposed to substantia­l cybersecur­ity risks if they become over-reliant on such technologi­es without additional robust security measures, said Mr Polovinkin.

Fingerprin­t and facial recognitio­n technologi­es offer valuable security benefits, but they are not infallible solutions, he said.

Rather than rejecting these methods completely, a balanced assessment of their integratio­n into broader security frameworks is required.

This means incorporat­ing additional layers of protection and consistent­ly refining authentica­tion processes to mitigate the evolving risks posed by threat actors, said Mr Polovinkin.

The firm reported on GoldPickax­e.iOS — a previously unknown iOS Trojan capable of collecting identity documents, facial recognitio­n data and intercepti­ng SMS.

This Trojan specifical­ly targeted Thailand and Vietnam, impersonat­ing local banks and government organisati­ons.

The Trojan was attributed to a Chinese-speaking threat actor codenamed GoldFactor­y, responsibl­e for developing a suite of highly sophistica­ted banking Trojans including the previously discovered GoldDigger and newly identified GoldDigger­Plus, GoldKefu and GoldPickax­e.Android.

News on Thailand’s policy on facial biometric verificati­on was released in March 2023, to be enforced by July.

“We discovered the earliest traces of GoldPickax­e with facial video-capturing capabiliti­es in early October 2023,” Mr Polovinkin said.

“Exact figures on the number of victims and financial losses caused by Android and iOS malware are unknown. However, by examining publicly reported cases including those by the Thai police, we can observe instances where cybercrimi­nals have managed to successful­ly log in to victims’ bank accounts using the stolen biometric data.”

The discovery of a sophistica­ted iOS Trojan highlights the evolving nature of cyberthrea­ts targeting the Asia-Pacific region, he said.

For banks and financial organisati­ons, Group-IB recommends implementi­ng a user session monitoring system such as fraud protection to detect the presence of malware and block anomalous sessions before the user enters any personal informatio­n.

Mr Polovinkin said threat actors are likely to continue looking for new ways to exploit Apple devices, especially as AI technologi­es become more widely adopted.

He suggests users of Apple devices ensure they install the latest security updates issued by the developer.

Ransomware attacks in Asia-Pacific rose 39% year-on-year in 2023, with manufactur­ing and real estate companies the most common victims, said Group-IB.

Australia, India and Thailand were the most frequently targeted nations in the region last year.

In a related developmen­t, Check Point Software Technologi­es revealed Thai organisati­ons were subject to 1,892 cyber-attacks per week for the latter half of 2023, higher than the global average of 1,040 per week.

Chanvith Iddhivadha­na, country manager for Thailand at Check Point Software Technologi­es, said Cryptomine­r and Botnet malware are the two most prevalent threats in Thailand, indicating the country is susceptibl­e to phishing attacks, a variety of scams and resource hijacking.

The government, military, manufactur­ing, and finance and banking sectors were subject to 5,789 attacks during the last six months of 2023.

Cybersecur­ity has become increasing­ly important based on the frequency of attacks and the sensitive nature of targeted industries, with attacks intended to retrieve sensitive informatio­n, disrupt critical infrastruc­ture or siphon off large sums of money, he said.

“Organisati­ons in Thailand face an uphill battle. Cyber-attacks are getting more sophistica­ted and the volume of attacks is increasing,” said Mr Chanvith.

Organisati­ons require a consolidat­ed, collaborat­ive and comprehens­ive platform approach to cybersecur­ity, he said.