Learning About Russian Hackers

When British and US officials blamed Russian military hackers for last summer’s NotPetya ransomware attack, they were confirming long-held suspicions among western governments that Russia is stepping up its hostile cyber capabilities.

The announcement in February was consistent with the recent rhetoric of political and military leaders in the UK and the US as the two countries turn up the heat on Russia and other state adversaries they hold responsible for a string of aggressive cyber-attacks. 

“I think we have been watching nation states grow steadily more aggressive in their use of cyber capabilities,” says John Hultquist, director of intelligence analysis at FireEye, a cyber security company.

February brought a second Russia-related cyber security controversy. On February 16 an indictment filed by Robert Mueller, the US special counsel who is investigating Russian meddling in the 2016 US Presidential elections, charged 13 individuals and three entities with conducting “information warfare” against America.

The work of the Internet Research Agency, a Saint Petersburg-based company accused of creating fake news and setting up phony US social media accounts to attract online political audiences, may not be a cyber-attack in the strictest sense. However, it fits a broader pattern of online warfare being waged by Russian president Vladimir Putin to disrupt the west and its institutions.

In December, the US and Britain came together to attribute last May’s WannaCry attack to the secretive North Korean regime of Kim Jong Un. Like NotPetya, WannaCry targeted computer operating systems, locking users’ machines unless they paid a ransom. 

The online attack, one of the most virulent yet, hit hundreds of thousands of computers in 150 countries but was most sharply felt in the UK, where a third of the country’s National Health Service trusts were affected. A former US intelligence chief is now citing India and Pakistan as countries raising the threat of international proliferation. “Other countries will soon start copying what the Russians have been doing.”

A recent report from US intelligence sets out the cyber threats faced by western countries. In the briefing document, American spymasters describe cyber threats as the “new normal”.

It criticises Russia and North Korea but also highlights Iran and China as being “sensitive to international political events”, which can influence the level of malicious activity. Greg Sim, chief executive of Glasswall Solutions, a cyber security company, says government and business must embrace innovation to keep up with the changing threat. “The techniques used are easily evading reactive technologies.”

Indeed, businesses need to pay attention as much as countries. A January survey by Kroll, a corporate intelligence company, showed that attacks on companies by random cyber criminals were top of its list of 14 types of incident, accounting for a third of attacks in 2017. 

Aggrieved ex-employees came second (28 per cent) and competitors were ranked third (23 per cent). Attacks by nation states sat in 13th place and accounted for only 10 per cent of cyber hostility.

The question of how to respond to such threats is made all the more pertinent when one considers the US and its allies are battling adversaries who may be armed with cyber tools stolen from American intelligence agencies the NSA and CIA.
According to cyber specialists, both WannaCry and NotPetya were developed from the American cyber espionage tools EternalBlue and DoublePulsar, first leaked by a hacking group called the Shadow Brokers in early 2017.

A report by Crowdstrike, a cyber security technology company, published at the end of February, showed that the volume and intensity of cyber-attacks “hit new highs” in 2017 as the overall level of sophistication experienced a “meteoric rise”. 
The report said there was a blurring of the lines between hostile state attacks and more widespread criminal activity. “If you think about cyber, a lot of the techniques we are seeing were born out of nation-state attacks,” says George Kurz, co-founder and chief executive of Crowdstrike.

The Kroll survey showed that e-crime is the biggest worry for corporate executives. A total of 86 per cent of executives said they had experienced a cyber-attack in the past year. The survey also reported that 36 per cent of companies had been affected by a virus or worm attack, an increase of 3 percentage points since 2016; a third had suffered an email-based phishing attack; 27 per cent had suffered a data breach; and 25 per cent were affected by data deletion.

In the UK, the National Cyber Security Centre, part of the signals intelligence agency GCHQ, has been taking steps to protect public bodies and companies. It has been advising them on how to deal with these lower-level criminal attacks that, it says, “affect the majority of people, the majority of the time”. 

“There is much hyperbole about the capabilities of cyber actors,” says Ian Levy, NCSC’s technical director. “Certainly, some nation states invest huge sums of money and significant highly skilled resources in their cyber programmes and use those for various things that are detrimental to the interests of the UK.

“However, the vast majority of people in the UK will not be directly harmed by these actors,” he says. “They are more likely to fall victim to cyber-crime.”

Financial Times:

You Might Also Read:

Russian Hackers Trying To Infiltrate US Senate:

Australia Points The Finger At Russia For Cyberattacks:

 

« Five Steps To Keeping Your Cloud GDPR Compliant
One A Day: Healthcare Breaches Are A Daily Event »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Business Intelligence Associates (BIA)

Business Intelligence Associates (BIA)

BIA's TotalDiscovery is a defensible and cost-effective corporate preservation and legal compliance software solution.

Intruder

Intruder

Intruder is a cloud-based vulnerability scanner that finds cyber security weaknesses in your digital infrastructure, to avoid costly data breaches.

SAS Institute

SAS Institute

SAS is a leader in business analytics software and services providing solutions for a wide range of critical business areas including risk management, compliance and fraud prevention.

SecureKey Technologies

SecureKey Technologies

SecureKey is a leading identity and authentication provider that simplifies consumer access to online services and applications.

CloudAlly

CloudAlly

CloudAlly provides online cloud to cloud backup and recovery solutions, which backs up daily changes in your SaaS to unlimited Amazon S3 storage and makes it available for restore or export.

Langner

Langner

Langner is a software and consulting firm specialized in cyber security for critical infrastructure and large-scale manufacturing.

Cyber Security & Cloud Expo

Cyber Security & Cloud Expo

The Cyber Security & Cloud Expo is an international event series in London, Amsterdam and Silicon Valley.

Partnership for Conflict, Crime and Security Research (PaCCS)

Partnership for Conflict, Crime and Security Research (PaCCS)

PaCCS delivers high quality and cutting edge research to improve our understanding of current and future global security challenges in areas including cybersecurity.

DigiSec360

DigiSec360

DigiSec360 is a technology firm focused on the human element of cybersecurity.

Network Utilities (NetUtils)

Network Utilities (NetUtils)

Network Utilities provide identity centric network and security solutions to organisations from Telecoms and ISPs to SMEs and large corporates.

SubRosa Cyber Solutions

SubRosa Cyber Solutions

SubRosa Cyber Solutions solves its clients’ most tenacious information security, risk and compliance challenges through a multitude of information technology services and expertise.

Packetlabs

Packetlabs

Packetlabs specializes in penetration testing services and application security.

Argentra

Argentra

Argentra is a specialist engineering company, we have years of experience developing custom security software and providing security risk consulting.

Sikich

Sikich

Sikich LLP is a leading professional services firm specializing in accounting, advisory, technology and managed services.

DATS Project

DATS Project

DATS Project enables the utilization of high computing power across a number of cybersecurity services, all on a pay-as-you-go basis, eliminating the need for upfront investment costs.

Xeliumtech Solutions

Xeliumtech Solutions

Xeliumtech Solutions are a Digital Transformation partner with quality offerings in Mobile App Development, Ecommerce, Devops, RPA, AI, IoT development, Cybersecurity and more.