The UK National Cyber Force (NCF) – a partnership between the country’s armed forces and the Government Communications Headquarters (GCHQ) – disclosed details about its approach to ‘responsible cyber operations to counter state threats, support military operations, and disrupt terrorists and serious criminals’.
The document outlines that central to NCF’s approach is the ‘doctrine of cognitive effect’ – using techniques that have the potential to sow distrust, decrease morale, and weaken the adversaries’ ability to plan and conduct their activities effectively with the goal of changing their behaviour. This can include preventing terrorist groups from publishing pieces of extremist media online or making it harder for states to use the internet to spread disinformation. NCF’s operations are covert, and the intent is sometimes that adversaries do not realise that the effects they are experiencing are the result of a cyber operation.
‘In an increasingly volatile and interconnected world, to be a truly responsible cyber power, nations must be able to contest and compete with adversaries in cyberspace,’ GCHQ director Jeremy Fleming said. The statement was published alongside a 28-page paper designed ‘to illustrate aspects of how the UK is being a responsible cyber power’. It did not elaborate on the specifics of those operations.
The biggest internet service provider in Russia, Rostelecom, reports that 2022 saw a record number of Distributed Denial of Service (DDoS) attacks against Russian organisations.
According to the Rostelecom report, its experts recorded 21.5 million critical web attacks aimed at approximately 600 organizations from various industries, including critical infrastructure, financial, and the private and public sectors. DDoS assaults accounted for 80% of all cyberattacks directed at Russian entities.
Other findings suggest that 30% of all observed cyberattacks in 2022 targeted the governmental sector, followed by 25% on financial organisations and services and 16% on educational institutions.
With more than 500,000 DDoS attempts found, Moscow was the most often targeted region in 2022. The largest documented attack was 760 GB/sec, while the longest DDoS lasted nearly three months.
Following ten months of monitoring indicators of the group’s operations, Unit 42 announced that it had identified, among other issues:
‘An unsuccessful attempt to compromise a large petroleum refining company within a NATO member nation on 30 August 2022’ (neither the country nor the company concerned was named).
‘An individual who appears to be involved with Trident Ursa threatened to harm a Ukraine-based cybersecurity researcher immediately following the initial invasion.’
‘Multiple shifts in [the group’s] tactics, techniques and procedures.’
In October 2022, Amnesty International Canada detected and investigated a sophisticated digital security breach. The organisation announced that, according to forensic experts at the cybersecurity firm Secureworks, the attack was likely orchestrated by ‘a threat group sponsored or tasked by the Chinese state’. The conclusion was based ‘on the nature of the targeted information as well as the observed tools and behaviors, which are consistent with those associated with Chinese cyberespionage threat groups’. China’s embassy in Ottawa denied the allegations.
Microsoft has warned that Russian cyberattacks are likely to continue to target Ukrainian critical infrastructure, and may also target countries and companies that are providing Ukraine with vital supply chains of aid and weaponry. The company also noted that ‘cyber-enabled influence operations’ that target Europe are likely to be conducted in parallel with cyberthreat activity.
Microsoft also announced that its AI for Good Lab has created a Russian Propaganda Index (RPI) ‘to monitor the consumption of news from Russian state-controlled and sponsored news outlets and amplifiers’. Compared to other Western Europe countries, Germans read and watch significantly more Russian propaganda, the AI for Good Lab found.
The exercise involved 1000 cyber defenders from 26 NATO allies, Finland, Sweden, Georgia, Ireland, Japan, Switzerland, and the EU, as well as experts from business and academia.
Cyber Coalition 2022 was used to test and validate concepts, capture requirements, or explore disruptive technologies, in support of military operators and commanders. It included experiments on the use of artificial intelligence to help counter cyber threats, on the standardisation of cyber messages to foster information sharing, and on the exploitation of cyber threat intelligence to inform cyberspace situational awareness.
The Singapore-based research team, Group-IB, has identified 34 Russian cybercrime groups responsible for distributing info-stealing malware under the stealer-as-a-service model. The cybercriminals use this type of malware to target users of Steam, Roblox, and Amazon in 111 countries, obtaining user credentials stored in browsers, bank card details, and crypto wallet information from infected computers and selling them on the dark web. Group-IB estimates that more than 890,000 devices in 111 countries in the first seven months of 2022 have been infected. The five most attacked countries are the USA, Brazil, India, Germany, and Indonesia, while the estimated value of stolen credentials is around $5.8 million.
In the USA, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigations (FBI) have issued a cybersecurity advisory regarding an incident at a Federal Civilian Executive Branch (FCEB). Having assessed that the FCEB network was compromised by Iranian government-sponsored advanced persistent threat (APT) actors, the two entities provided details on the actors’ tactics, techniques, and procedures. One of the findings was that the cyber threat actors exploited the Log4Shell vulnerability in an unpatched VMware Horizon server. As such, organisations with affected VMware systems that did not immediately apply available patches or workarounds were advised toto assume compromise and initiate threat-hunting activities.
The Computer Emergency Response Team of Ukraine (CERT-UA) reported the spread of a new ransomware strain called ‘Somnia’, attributing the attacks to the Russian threat actor known as ‘From Russia with Love’ (FRwL), also known as ‘Z-Team’. The ransomware attacks targeted Ukrainian corporations’ employees, using their Telegram accounts to try and gain access to a corporate network.
As explained by CERT-UA, the group used fake sites that mimic the ‘Advanced IP Scanner’ software, which, if downloaded, infects the victim’s computer with the Vidar data-stealing malware that can capture Telegram session data, as well as take over the victim’s account.
Then, the threat actors used victims’ Telegram accounts to gain access to the corporate network. Once access to the target’s network was obtained, the hackers executed reconnaissance operations using tools like Netscan and deployed Cobalt Strike Beacons before exfiltrating data.
According to CERT-UA, the group had previously revealed that they created Somnia ransomware on Telegram and posted evidence of the attacks they made against Ukrainian targets.
