Learning About Russian Hackers

When British and US officials blamed Russian military hackers for last summer’s NotPetya ransomware attack, they were confirming long-held suspicions among western governments that Russia is stepping up its hostile cyber capabilities.

The announcement in February was consistent with the recent rhetoric of political and military leaders in the UK and the US as the two countries turn up the heat on Russia and other state adversaries they hold responsible for a string of aggressive cyber-attacks. 

“I think we have been watching nation states grow steadily more aggressive in their use of cyber capabilities,” says John Hultquist, director of intelligence analysis at FireEye, a cyber security company.

February brought a second Russia-related cyber security controversy. On February 16 an indictment filed by Robert Mueller, the US special counsel who is investigating Russian meddling in the 2016 US Presidential elections, charged 13 individuals and three entities with conducting “information warfare” against America.

The work of the Internet Research Agency, a Saint Petersburg-based company accused of creating fake news and setting up phony US social media accounts to attract online political audiences, may not be a cyber-attack in the strictest sense. However, it fits a broader pattern of online warfare being waged by Russian president Vladimir Putin to disrupt the west and its institutions.

In December, the US and Britain came together to attribute last May’s WannaCry attack to the secretive North Korean regime of Kim Jong Un. Like NotPetya, WannaCry targeted computer operating systems, locking users’ machines unless they paid a ransom. 

The online attack, one of the most virulent yet, hit hundreds of thousands of computers in 150 countries but was most sharply felt in the UK, where a third of the country’s National Health Service trusts were affected. A former US intelligence chief is now citing India and Pakistan as countries raising the threat of international proliferation. “Other countries will soon start copying what the Russians have been doing.”

A recent report from US intelligence sets out the cyber threats faced by western countries. In the briefing document, American spymasters describe cyber threats as the “new normal”.

It criticises Russia and North Korea but also highlights Iran and China as being “sensitive to international political events”, which can influence the level of malicious activity. Greg Sim, chief executive of Glasswall Solutions, a cyber security company, says government and business must embrace innovation to keep up with the changing threat. “The techniques used are easily evading reactive technologies.”

Indeed, businesses need to pay attention as much as countries. A January survey by Kroll, a corporate intelligence company, showed that attacks on companies by random cyber criminals were top of its list of 14 types of incident, accounting for a third of attacks in 2017. 

Aggrieved ex-employees came second (28 per cent) and competitors were ranked third (23 per cent). Attacks by nation states sat in 13th place and accounted for only 10 per cent of cyber hostility.

The question of how to respond to such threats is made all the more pertinent when one considers the US and its allies are battling adversaries who may be armed with cyber tools stolen from American intelligence agencies the NSA and CIA.
According to cyber specialists, both WannaCry and NotPetya were developed from the American cyber espionage tools EternalBlue and DoublePulsar, first leaked by a hacking group called the Shadow Brokers in early 2017.

A report by Crowdstrike, a cyber security technology company, published at the end of February, showed that the volume and intensity of cyber-attacks “hit new highs” in 2017 as the overall level of sophistication experienced a “meteoric rise”. 
The report said there was a blurring of the lines between hostile state attacks and more widespread criminal activity. “If you think about cyber, a lot of the techniques we are seeing were born out of nation-state attacks,” says George Kurz, co-founder and chief executive of Crowdstrike.

The Kroll survey showed that e-crime is the biggest worry for corporate executives. A total of 86 per cent of executives said they had experienced a cyber-attack in the past year. The survey also reported that 36 per cent of companies had been affected by a virus or worm attack, an increase of 3 percentage points since 2016; a third had suffered an email-based phishing attack; 27 per cent had suffered a data breach; and 25 per cent were affected by data deletion.

In the UK, the National Cyber Security Centre, part of the signals intelligence agency GCHQ, has been taking steps to protect public bodies and companies. It has been advising them on how to deal with these lower-level criminal attacks that, it says, “affect the majority of people, the majority of the time”. 

“There is much hyperbole about the capabilities of cyber actors,” says Ian Levy, NCSC’s technical director. “Certainly, some nation states invest huge sums of money and significant highly skilled resources in their cyber programmes and use those for various things that are detrimental to the interests of the UK.

“However, the vast majority of people in the UK will not be directly harmed by these actors,” he says. “They are more likely to fall victim to cyber-crime.”

Financial Times:

You Might Also Read:

Russian Hackers Trying To Infiltrate US Senate:

Australia Points The Finger At Russia For Cyberattacks:

 

« Five Steps To Keeping Your Cloud GDPR Compliant
One A Day: Healthcare Breaches Are A Daily Event »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Latham & Watkins LLP

Latham & Watkins LLP

Latham & Watkins is an international law firm. Practice areas include Data Privacy, Security and Cybercrime.

Navista

Navista

Navista's hardware and software modules are especially designed to ease the deployment of secure networks.

Arista Networks

Arista Networks

Arista Networks is an industry leader in data-driven, client to cloud networking for large data center, campus and routing environments.

Intuity

Intuity

The Intuity suite of services provides companies with a complete awareness of their security status and helps them in an efficient, efficient and sustainable improvement process.

NewGens

NewGens

NewGens is a solution and service provider to banking institutions in the APAC region. Areas of expertise include cybersecurity, AML, fruad prevention, compliance and risk management.

TechRate

TechRate

Techrate is an analytics agency focused on blockchain technology and engineering. Or expertise includes security and technical audits of projects.

VIBE Cybersecurity International

VIBE Cybersecurity International

VIBE’s certificate-less authenticated encryption enables scalable, flexible key exchange, and other advanced cryptographic functions using identity-based elliptic curve cryptosystems (ECC).

ComoNExT Innovation Hub

ComoNExT Innovation Hub

ComoNExT is a Digital Innovation Hub and a startup incubator with a focus on the issues of digital transformation and Industry 4.0.

Variti

Variti

Variti Intelligent Active Bot Protection technology — traffic analysis, detection and stopping of malicious bots in real-time and effective response to DDoS attacks.

SDG Corp

SDG Corp

SDG is a global cybersecurity, identity governance, risk consulting and advisory firm, addressing complex security, compliance and technology needs.

Secura B.V.

Secura B.V.

Secura is an independent specialized cybersecurity expert, providing insights to protect valuable assets and data.

CYMOTIVE Technologies

CYMOTIVE Technologies

Combining Israeli cyber innovation with a century of German automotive engineering. CYMOTIVE operates under the assumption that connectivity is a game changer for the automotive industry.

inWebo

inWebo

inWebo is the specialist in multi-factor strong authentication (MFA). We guarantee the security of data and identities in a digital world with increasingly important economic and political stakes.

Tausight

Tausight

Tausight is an AI-Powered patient data security startup with a mission of reducing healthcare cyber incidents using a more proactive, risk management philosophy.

Arculus Cyber Security

Arculus Cyber Security

Arculus Cyber Security enables customers to securely realise the benefits of digital transformation through pragmatic solutions, guidance and services.