While it may seem rather quaint and uneventful on paper, the picturesque British Overseas Territory of Gibraltar has become an unexpected hotspot for cybercrime in recent months.
Some recent developments have illustrated the urgent need for businesses in this territory to drastically improve their cyber resilience and fraud prevention strategies. As more companies fall victim to ransomware and suffer fines for failing to uphold GDPR privacy laws, Gibraltarian businesses are also suffering a similar fate.
As this is a popular expansion area for UK businesses due to its favourable business environment and economy, company owners must also contend with the elevated risks of operating in a digital space that is, frankly, rife with cyber threats and malicious actors seeking to exploit assets, funds, and data.
The Rising Tide of Cyber Threats
Gibraltar’s vibrant business community has recently been rocked by a series of sophisticated attacks that have left local organisations reeling.
Fraudsters have managed to swindle local businesses out of millions of pounds through elaborate social engineering schemes that exploit human vulnerability and technological gaps. This alarming incident involved a local company that fell victim to a scam where attackers – posing as bank employees – convinced staff members to grant them access to the company’s computer systems.
This was not an isolated incident – in the span of several days, several businesses reported similar attacks via telephone, with losses ranging from tens of thousands to hundreds of thousands of pounds. A Royal Gibraltar Police spokesman, following one notable incident, suggested that the total losses exceeded £1.7 million with attacks underway for several days afterwards.
The RGP recently put out a statement warning local businesses and the public to be increasingly vigilant of such phone scams.
This social engineering tactic illustrates how phishing attackers operate in the digital space, deceiving and manipulating users into divulging sensitive information or login credentials, under the pretence that they are at risk if they don’t. However, by doing so, they are allowing the opposite to take place, as they believe the fraudsters are legitimate entities or individuals. The recent spate of cybercrime and fraud underscores the need for increased awareness and vigilance for individuals and businesses, not just in Gibraltar, but everywhere.
The Anatomy of a Scam
The malicious actors behind the recent attacks on Gibraltar businesses have demonstrated an alarming level of sophistication in their methods. However, it’s exemplary of a typical pattern when a bad actor or fraudster attempts to exploit sensitive data held by a business, whether digitally, via telephone, or face-to-face.
The pattern usually consists of the following steps:
- Initial contact: The cybercriminal emails, calls or makes contact with the target, often using spoofed phone numbers or email addresses that appear to be from legitimate local banks or financial institutions. They could also use fake ID badges if making contact directly with an employee.
- Building trust: The person claims to be from, in this case, the bank’s fraud or cybercrime department, citing suspicious transactions on the victim’s account.
- Creating urgency: The perpetrator pressures the victim to act quickly to prevent further losses, emphasising a lack of time to complete the desired action.
- Technical manipulation: The victim could be told to download remote access software to allow the ‘bank’ to investigate the issue. Alternatively, they may be told to download files or software that appears legitimate but is, in actuality, ransomware which locks down systems and restricts users.
- Account takeover: Once remote access is granted, the scammer gains control of the victim’s computer and banking applications. Or, if ransomware, the scammers then extort money to restore access to the target, but there’s rarely a guarantee that actually happens.
This modus operandi has proven alarmingly effective, catching out even tech-savvy business owners who consider themselves well-informed about cyber threats and prevention methods.
Why Gibraltar?
Gibraltar’s unique position as an international business hub, particularly in the financial and gaming sectors, makes it an attractive target for fraudsters seeking to extort money. The high concentration of wealth of businesses and individuals in the territory, coupled with Gibraltar’s reputation as a centre for company formations, creates even more openings for opportunistic cybercriminals.
The rapid digitisation of business processes and interconnectivity has expanded the attack surface for cybercriminals. Meanwhile, the risk exposure for businesses has amplified, leaving those with access to large amounts of data or funds particularly vulnerable.
As companies strive to adapt to remote work, digital transactions, and automation, many have inadvertently left vulnerabilities in their security posture prone to exploitation.
Key Defence Strategies for Businesses
In the wake of these notable incidents and to prevent future attacks from occurring, Gibraltar-based businesses must take proactive steps to enhance their cyber security and threat awareness.
- Employee education: Regular, comprehensive cyber security training on proper etiquette and awareness is essential.
- Multi-factor authentication (MFA): Implement strong password policies and multi-factor authentication for all sensitive accounts and systems. This substantially reduces the chances of unauthorised access being granted to cybercriminals, even if login details are sussed.
- Rigid cyber security protocols: Establish and enforce strict protocols for financial transactions, especially those involving large amounts. Adopting cyber security frameworks like NIST 2.0 is a good measuring stick for financial preparedness and robustness.
- Technical safeguards: Deploy enterprise-grade firewalls, internet security, and anti-malware solutions, and keep all systems updated with the latest security patches to ensure known vulnerabilities are not exploited.
- Cohesive incident response: Develop and regularly test a comprehensive cyber incident response plan to contain threats and minimise damage in the event of a data or security breach.
- Third-party risk management: Carefully review and monitor the security practices of all third-party vendors and partners. Ensure you partner with those that adopt similar cyber hygiene and etiquette to your organisation.
- Regular security audits and risk assessments: Conduct frequent security assessments to identify and address vulnerabilities before they can be exploited. These can be executed internally or via third-party cyber security consultants and specialists, and give you a true indication of your risk exposure and posture.
What’s more, these strategies apply to businesses outside of this thriving British territory. Global cybercrime has accelerated exponentially, and these attacks are just some of the everyday incidents that occur worldwide. Employees at all levels and working remotely should be aware of risks and able to recognise phishing or social engineering attempts. They should also know how to respond to suspicious emails and phone calls. It’s in the best interest of every business – regardless of location – to uphold more robust cyber hygiene if they are to prevent funds from being transferred illegally to fraudsters and criminals.
The Role of Simulated Attacks in Building Resilience
One of the most effective ways to prepare for a wide range of cyber threats is through simulated phishing campaigns and security exercises. Controlled simulations – such as those offered by the award-winning Phishing Tackle solution, mimic real-world and scenario-based attack incidents, allowing employees to experience and learn from realistic threats without their systems or data being legitimately at risk.
Simulated attacks provide hands-on experience in identifying and responding to various types of threats, including phishing, ransomware, and other sophisticated attacks like man-in-the-middle (MITM) attacks. What’s more, by providing an immersive, realistic attack scenario, they reinforce good security practices, identify overt weaknesses in knowledge or protocols, and allow organisations to measure and track improvements over time.
What’s Next?
In response to the growing threat of phishing and cybercrime, we can only hope that Gibraltar’s regulatory bodies introduce more stringent cyber security requirements for businesses operating in the territory. The recent spate of attacks serves as a stark reminder that no business is too small or invaluable to be targeted. Companies must stay one step ahead of the curve if they are to avoid becoming victims of increasingly tech-savvy and manipulative fraudsters who prey on human intuition and behaviours.
In this critical time, it’s clear that ongoing training and realistic simulations will prove invaluable. Phishing Tackle’s range of cyber security training software and training modules will provide businesses with enough knowledge to build a robust foundational defence against evolving phishing threats. Book a free 14-day trial today and see for yourself how automated training can drastically improve cyber readiness.
