Weeks before Russia invaded the Ukraine, American intelligence agencies warned that Vladimir Putin was planning state-sponsored cyber operations around the world against critical infrastructure. Targets include Defense, Energy, Governments, Healthcare, and Telecommunications. The Cybersecurity and Infrastructure Security Agency, Federal Bureau of Investigation, and National Security Agency issued a joint Cybersecurity Advisory outlining the threats and for the global community to adopt a proactive, heightened state of awareness.
The CSA overview served to highlight the risks and list strategies to assist with detection, mitigation and incident response. The advisory noted in the technical details, “Historically, Russian state-sponsored advanced persistent threat actors have used common but effective tactics—including spearphishing, brute force, and exploiting known vulnerabilities against accounts and networks with weak security—to gain initial access to target networks.” A reward of up to $10 million may be offered for information about Russian cyber operations targeting U.S. critical infrastructure, an example of how seriously CISA, the FBI, and NSA are taking the threat.
How it started?
On February 24, 2022, as Russia launched a large-scale attack on the Ukraine, CISA issued another alert about a group of Iranian government sponsored APTs known as MuddyWater, a subordinate element within the Iranian Ministry of Intelligence and Security. The group was observed “Conducting cyber espionage and other malicious cyber operations targeting a range of government and private-sector organizations across sectors—including telecommunications, defense, local government, and oil and natural gas—in Asia, Africa, Europe, and North America.”
The eve of the invasion came with a dire warning from President Putin, translated into English, “To anyone who would consider interfering from the outside – if you do, you will face consequences greater than any you have faced in history.” Of course, the world has good reason to take the threat seriously.
Just days before the physical assault came a pre-emptive virtual strike, with distributed denial of service attacks on Ukraine’s government websites, foreign ministry, state security services and banks. Ukraine’s defense ministry and major banks were hit with DDoS attacks the week before, with limited impact.
How it’s going?
“The war [in cyberspace] is underway and unfolding very intensively,” the Russian Foreign Ministry’s international information security director said in December 2021. “The media rightly says that this [is] a Third World War, and what matters now is to calculate the damage and determine who will lose it in the end and what shape the world will eventually acquire as a result of this war.”
A botnet malware dubbed Cyclops Blink is being used by the notorious Sandworm hackers, a destructive threat group that has been working with the Russian military to exploit vulnerabilities in firewalls and infect networks to gain remote access. Systems may then be used as a conduit to conduct additional attacks elsewhere, as the point of entry may not be the primary target.
Such strategy may well have been underway for months if not years. The US Energy Secretary noted, “Experts believe that Russian hackers trying to bring down part of the U.S. grid would probably enter via a side route — breaking into a major energy provider’s networks by infecting a software update from a less secure company.”
Another weapon in the Russian war machine cache is misinformation. Putin’s propaganda tactics have been a hallmark of his political career. Social Media has been infiltrated by Russian troll farms to wage political warfare on his adversaries. Russia was accused of spreading fake news through troll factories, swaying the US Presidential election in favour of Trump, confirmed by former FBI Director Robert Mueller when he investigated the alleged Russian interference in the 2016 election.
When the Kremlin invaded Crimea, Ukrainian journalist and political analyst, Mykola Riabchuk, said the Russian hype had evolved into a full-fledged information war. Riabchuk wrote, “Three major narratives emerged that can be summed up as “Ukraine’s borders are artificial”, “Ukraine’s society is deeply divided”, and “Ukrainian institutions are irreparably dysfunctional.” To put it simply, Ukraine is a failed state (“not a country”) . . . and it, therefore, needs external, apparently Russian, guardianship.”
Putin’s deceptive attempt to rationalize his attack on Ukraine was characteristic, according to one criminal justice professor who was quoted as saying, “This is one of those times where we can expect Russian troll farms to be heavily active in an attempt to either depict a narrative that fits the notion that they’re a peacekeeping force, or that there’s false flag events that have occurred that justify their presence there or the use of serious violence against civilians or anything else.”
Ukraine responded to the cyber threats by asking the hacker world to come to its aid. Just as the country has built a strong resistance from within to defend against the military attack, volunteers have rushed in to answer the call to strike back at Russian targets online. An IT army with thousands of hackers have already answered the call within a matter of days. Elon Musk assisted the effort by activating Starlink satellite service over Ukraine.
Hacktivists took over Russian TV stations to broadcast footage from the front lines, thwarting the state efforts to control the narrative, which likely fuelled the increased number of protestors who risked arrest by defiantly demonstrating against the invasion of their neighbours. Russian media sites were hijacked to be replaced with a tombstone bearing the number of reported Russian troop casualties.
How to be prepared?
With the potential for anyone to become a victim if Russia retaliates with a global cyber conflict, now is the time to be extra vigilant with your online behaviour.
Know that governments are focused on keeping critical infrastructure safe in this heightened state of crisis. This means being aware is important but there is no need to panic. Arm yourself with trustworthy information and don’t amplify baseless reports.
Myntex recommends several methods to keep your digital vectors safe from attack. Start with some basics, like ensuring your system updates are handled promptly to patch developer vulnerabilities. Implement multi-factor authentication wherever possible. Practice cybersecurity common sense by staying apprised of phishing attack techniques and other means of infiltration used by threat actors. Ensure your service provider secures the servers you rely on with DDoS protection. In these uncertain times, it is wise to have a plan to remain operational in the event of a cyber-attack, such as ransomware.
The best way for business to secure mobile devices is to remove the risk from online browsing and to use end-to-end encrypted communications to safeguard your privacy. Don’t trust free apps, you’ll be giving away your personal data when you agree to their terms of use. If you’re not paying for the product, you become the product.
While the implications for a growing cyber-conflict are real, it is encouraging to note the world is standing guard against attacks, which have yet to materialize at the time of writing this post.