Quarter Two: Cyber Security Insights 2022

This quarter, CERT NZ responded to 2,001 incident reports about individuals and businesses from all over New Zealand. This report shares information around these incidents as well as highlighting examples of work CERT NZ is doing to help.

There are 2 parts to the report:

An Insights report focusing on selected cyber security incidents and issues.

A Data Landscape report providing a standardised set of results and graphs for the quarter.

Highlights

$3.9 million in direct financial loss was reported in Q2. 19% of incidents reported financial loss.

2,001 incidents were responded to by CERT NZ in Q2 2022, down 14% from Q1 2022.

Scams and fraud reports decreased by 6.9%.

23% decrease in malware reports from Q1 2022.

Number of incidents responded to

A total of 2,001 incidents were responded to in Q2 2022.

Chart: Breakdown of incidents by quarter from quarter 3 2020 to quarter 2 2022.

Year	Quarter	Incidents
2022	2	2,001
2022	1	2,333
2021	4	3,977
2021	3	2,072
2021	2	1,351
2021	1	1,431
2020	4	2,097
2020	3	2,610
2020	2	1,965

Breakdown by incident category

Phishing and credential harvesting remains the most reported incident category.

Chart: Breakdown of incidents by category from 1 April to 30 June 2022

Incident category	Incident count	Percent change from previous quarter
Phishing and credential harvesting	1,116	-19.00%
Scams and fraud	526	-6.90%
Unauthorised access	230	0.90%
Malware	62	-23.00%
Website compromise	13	-46.00%
Ransomware	5	-71.00%
Botnet traffic	2	-71%
Denial of service	2	-50.00%
C and C server hosting	1	-75%
Suspicious network traffic	0	-100%
Attack on system	0	0%
Other	44	38%

Focus area: 'Phone spoofing' impacting bank customers

In quarter two, CERT NZ became aware of a spike in scam calls where attackers were pretending to be from a bank to try and trick recipients into sharing financial information, giving access to their bank accounts or allowing remote access to their devices or PCs.

Attackers are constantly evolving techniques to try and catch people out. In these specific scam calls, they use ‘phone spoofing’ software which changes out the scammer’s actual phone number and instead shows a phone number of the scammer’s choosing (like a bank’s phone number) on the recipient’s caller ID. CERT NZ is aware of New Zealanders losing large sums of money to these types of scams, with some recipients experiencing these incidents more than once – this happens when scammers call back, pretending to be from the bank and offering help to recover from the previous scam.

New Zealand banks have worked with telecommunication providers and the New Zealand Telecommunications Forum (TCF) to block their numbers from being spoofed.

CERT NZ and New Zealand banks are now aware that scammers have further evolved the approach by changing out one or two numbers to closely imitate the banks’ phone numbers.

How is this happening?

Phone spoofing diagram: The scammers uses intermediary software that generates signals to hide their phone number. Then the number the scammer chooses is displayed on the caller ID instead.

The scammers use intermediary software that generates signals to change the displayed caller ID.
Once the attacker has the target on the phone, they use social engineering tactics to try and get the financial information or access they are seeking.
To sound more plausible, attackers are often using scripts and dialogue similar to those used by the bank call centres. In many cases, they pretend to be from a bank’s fraud centre and say they’ve detected unauthorised access of the recipient’s account. In some cases, they use fear or urgency to get the recipient to act.

How to tell if you're being called by a scammer

If you receive a phone call from a person claiming to be from your bank, even if the phone number looks similar to the bank’s phone number, there are some red flags that can help you identify if the call is legitimate.

With a bank scam call, the scammer will usually do one of the following:

Ask the recipient to download remote access software under the pretext of being able to walk the customer through a necessary process.

Trigger a SMS code that is sent to the recipient’s phone. This is a code to either gain access or authorise a transfer, but the attacker will say it is a 'cancellation code' or something similar, and ask the recipient to read it out.
Ask for the recipient’s bank account log in information or full credit card number.

What to do if you think it’s a scam call

CERT NZ strongly recommends ending the call and hanging up if you have any concerns about the legitimacy of a call.
Then find the bank’s phone number from the bank’s website or on the back of your bank card and call them. This way you'll find out if the original call was genuine.

Image with 2 speech bubbles suggesting 2 things you can say to help end a call. 1. “I’ve got another call coming through. I’ll call back soon on the 0800 number” and 2. “There’s someone at the door. I’ll call the bank back soon. Goodbye."

In some cases, when a recipient tries to end a call, the scammer will use fear and urgency tactics to try and convince the recipient to stay on the call and respond to the request.

Protect yourself and your bank accounts from scam calls

Enable two-factor authentication (2FA) on your bank account. This adds an extra security layer on top of your password, like a code sent to your phone. That way if an attacker gets your login details, they still won’t be able to access your account. Never share these codes with anyone. Your bank will never ask you for a 2FA code.

Two-factor authentication
If you have clicked on a suspicious link or received a call where you’ve provided a 2FA code, contact your bank immediately and report the incident to CERT NZ.

www.certnz.govt.nz/report
Never give out account information, credit card details or remote access to your devices. Your bank will never ask for this information.

How CERT NZ is helping combat phone spoofing

CERT NZ works with other New Zealand organisations, like financial institutions, to combat scam calls. We share information and insights to better understand who is being targeted and the tactics scammers are using.

This information helps put a stop to these calls taking place, and also helps us develop relevant advice and mitigations so New Zealanders can better protect themselves from being impacted.

In June, CERT NZ, New Zealand banks and the Department of Internal Affairs (DIA) released a media statement to educate the public on these scam calls.

Scammers using sophisticated attacks against New Zealanders

Where possible, CERT NZ passes the details of scam calls to the Telecommunication Forum (TCF), so they can investigate the calls and the scammers can no longer use those phone numbers.

Insight: Romance scams

At the heart of scams and fraud

Scams and fraud are consistently one of the most reported categories to CERT NZ.

In quarter two, New Zealanders reported over 500 incidents about scams and fraud, and 92% of these reports (486) were about individuals – with a total direct financial loss of $3.2 million.

Of the types of scams and fraud reported, ‘buying and selling of goods online’ is consistently the most reported. This quarter, ‘dating and romance scams’ was the second most reported, with the number of incidents in this category steadily increasing across the past four quarters.

Quarter	Romance scams reported
Q3 2022	35
Q4 2022	37
Q1 2022	53
Q2 2022	57

Romance scams

A romance scam is when a scammer takes advantage of someone looking for a relationship online.

Scammers will use dating websites and apps or social media to build a relationship with someone. Once they’ve gained the person’s trust, the scammer will start to ask for money, gifts, personal details or they will make unusual requests that can be used to commit fraud or to exploit the individual.

More recently, CERT NZ has seen reports where romance scammers are building trust to try and trick the individual to buy into crypto investment scams. The scammers often use fake profiles to make it harder to track them down.

Preventions, checks and red flags

Avoid giving out too much personal information online, including on social media or by email.
If you’re unsure about a connection, reverse image search can help identify if the image has been used elsewhere or doesn’t match the identity of the person they are claiming to be. You can do this by uploading the image to a search engine.
Avoid responding to requests for financial help, making investments or sending money. This includes sending money to enable them to meet you in person.

Sometimes there are multiple scammers working together, look out for inconsistency in communication style.
If the contact is not willing to meet up or talk via video call, or comes up with a series of excuses to avoid meeting, they could be a scammer.

If you think you may have experienced a romance scam or are concerned about a connection you’ve made, we can help. Please report confidentially to CERT NZ.

www.cert.govt.nz/report

Insight: Unauthorised Access

Reducing the risk of internet exposed services

This quarter, CERT NZ received 230 reports about unauthorised access. This is when an attacker gains access to an account, a service or a device usually through vulnerabilities in software, or weak or stolen credentials.

Over the past four quarters, New Zealanders have reported $3 million in direct financial losses to this incident type. It can also cause significant impacts including operational, reputational and data loss.

One avenue for attackers to gain unauthorised access is through - internet-exposed services, like Remote Desktop Protocol (RDP), Network Attached Storage (NAS) devices, websites and databases. Once the attacker has gained access, they can carry out a number of malicious actions. The most significant actions can include running commands on a device remotely, deploying ransomware and stealing data and money. These can be costly and time consuming to recover from.

Why Services may be at risk

Exposing a device or service on the internet is not just connecting it to the internet but allowing someone to connect directly to your device from the internet. This can happen intentionally through port forwarding, port triggering, or a 'demilitarised zone' (DMZ) or unintentionally due to a poorly configured network firewall or missing network firewall. Attackers can only exploit what they can access. If you expose a service or device on the internet, it can be much easier to access.

How to reduce risk to your business

Many New Zealand businesses, small and large, use internet-exposed services.

The following mitigations may require some technical ability. If you are unsure whether they relate to your business, CERT NZ recommends checking with your IT provider.

Identify what is exposed to the internet to help mitigate this risk, it’s important to identify whatis being exposed to the internet. Asset Lifecycle Management can help you do this. You can also use scanning tools like Nmap and Nessus to help assess your situation.

Asset lifecycle management

Only expose what you really need to reducing the number of services you use lowers the number of targets that attackers have access to. This is known as reducing your attack surface.

Disabling unnecessary services and protocols
Segment your network to stop – internet-exposed services from reaching your internal network. If your more vulnerable services get compromised, a segmented network will make it harder for attackers to reach other devices.

Network segmentation and separation

Patch services and devices exposed on the internet. Having the latest version will fix many of the vulnerabilities known to the vendor, and that means attackers have fewer known vulnerabilities they can use to gain access.

Patching
Turn on multi-factor authentication (MFA) to add an extra layer of security and help prevent unauthorised access.

Multi-factor authentication and verification
Use logging and alerting to help monitor devices and services, especially any that may be exposed on the internet. These are potential weak points that attackers may target. This can help notify you of an incident and provide details of what has happened.

Centralised logging

Commonly targeted internet-exposed services are:

NAS devices
RDP
Databases
Device and service management interfaces
IoT devices

Our reporting tool is open over the holiday period. Any incidents reported after Friday 20 December 2024 will be responded to from Monday 6 January 2025 onward. Happy holidays!