Connect with us

Cyber Security

Weaponised Cybercrime: What Organisations Can Learn from the Conflict in Ukraine



Written by Ram Narayanan, Country Manager at Check Point Software Technologies, Middle East

On February 24th, 2022, Russia launched a full-scale military invasion of Ukraine with attacks on land, sea, and air.  What has been less visible but nonetheless a critical element of the conflict is the battle being waged in cyberspace.  Just like the military conflict with its wider consequences in terms of disruption to trade and the tragedy of the refugee crisis, the war in cyberspace has an impact beyond the borders of Ukraine and Russia. While no one can predict how long this war will last, we can say for certain that the cyber aspects of the conflict in Ukraine will continue to resonate long after the guns have been silenced, as highlighted in Check Point’s Mid-Year Security Report 2022.

So, what does the conflict teach us about cyberwarfare and how can organizations prepare themselves for this new world order?

A New Era of Cyberwarfare
One thing we can take away from what’s happening in Ukraine is that cyberwarfare has become an established component of global conflict both in the propaganda battle as well as in the actual conduct of military operations.  From Distributed Denial of Service (DDoS) attacks and website defacements to destructive critical infrastructure attacks, activity on both sides has escalated dramatically since the initial invasion in February.

Just three days into the conflict in late February, Check Point Research (CPR) noted a 196% increase in cyberattacks on Ukraine’s government and military sector. And these attacks have shown no signs of slowing down in the months since. New figures from CPR report that between February and August of this year, cyberattacks on Ukraine’s government and the military sector more than doubled, increasing by a staggering 112%, while Russia’s same sector decreased by 8%.

While Russia has not completely disconnected from the internet as per previous reports, government and military networks and websites have implemented different measures to limit access to their resources from outside of Russia, which makes the execution of some of the attacks more difficult. Indeed, Ukraine has been under constant attack – throughout the conflict, corporate networks have experienced over 1,500 cyberattacks a week on average. This is 25% higher than before the conflict, versus 1,434 weekly cyberattacks on Russian corporate networks.

Russian operations, in particular, have focused on a campaign of disruption and destruction, with government and state-sponsored APT groups conducting sophisticated operations that have ranged from critical infrastructure attacks to espionage missions. For the first time, we’ve also seen coordination between cyberattacks and kinetic military assaults. One notable example took place on March 1st when a Russian missile assault on Kyiv’s TV tower coincided with a simultaneous cyberattack designed to knock out the city’s broadcasting capabilities.

CPR also reported that the most attacked industry In Russia during the conflict was the finance sector, with an average of more than 2600 attacks per organization every week, an increase of 24% compared to before the conflict. The second most attacked industry during the conflict was Communications, with an average of 1928 weekly attacks per organization (8% decrease). This could possibly be due to a heavier focus on the finance industry having greater activity, due to global sanctions implemented on Russia by government and business organizations outside of Russia. Disrupting this sector will also severely disturb the day-to-day normal activities of its citizens, similar to attacks on the Communications sector, where the majority of services provided online such as calls or internet services would push normal activities into disarray.

CPR also reported that the most attacked industry during the conflict in Ukraine was the finance sector, with an average of 1,841 cyberattacks per organization every week, a decrease of 29% compared to the period before the conflict, followed by the government and military sector, with an average of 1,406 weekly attacks per organization, which also saw the highest increase in weekly cyberattacks with a 112% increase compared to before the conflict, which could be due to increased attacks inflicted on them by factions siding with Russia. Manufacturing was the third most heavily attacked sector, with over 400 attacks per organization every week (64% decrease).

Like Russia, the finance sector also saw major attacks, probably as an outcome of the various government and individual financial aid received, as well as cybercriminals who were looking to cash in on known donations being sent to Ukraine for the war and refugee efforts. It was not surprising to see the manufacturing sector also being heavily attacked as this is one of the key critical industries for any country to be sustained, with its global wheat exports contributing heavily to Ukraine’s economy. Such disruptions would now not only impact inflows of funds into Ukraine but negatively impact their exports.

Perhaps the defining aspect of these attacks, however, has been the strength and relative successes of Ukraine’s cyber defenses, something that highlights the importance of ongoing operational security. But continued vigilance is just one of the factors at play here. The other notable impact has come from the army of volunteers who have flocked to support Ukraine, and whose involvement might change the face of cybersecurity as we know it.

A Battleground Without Borders
The cyber battle that’s raged in Ukraine has silently swept up thousands of “volunteer troops” ranging from hacktivists to cybercriminals via technology companies like Elon Musk’s SpaceX. The digital front has also attracted the attention of high-profile collectives with the powerful Conti ransomware group publicly vowing to protect the Kremlin’s interests while Anonymous declared war on Russia itself.

One of the most interesting aspects of the cyber warfare that has raged in Eastern Europe has been Ukraine’s willingness to recruit keyboard warriors from both sides of the law to join its ranks. During the first few days of the war the Ukrainian Minister of Digital Transformation, Mykhailo Fedorov, posted on Twitter a call for “digital talents” to join the country’s newly created IT army, with operational tasks being allocated to them via a designated Telegram channel that attracted hundreds of thousands of members.

The formation of a state-affiliated cyber force is unprecedented and, while the birth of Ukraine’s IT army is an extraordinary achievement, looking forward it could prove to be problematic. Recruiting and engaging members via Telegram is far from secure. How do you vet the people that are coming forward and stop other parties from infiltrating them or using them for their own recruitment? The fact that just about anybody could be serving within Ukraine’s cyber army is a major concern. There are equal concerns on the Russian side where state-backing has given cybercriminal groups both the means and opportunities to step up their activity.

Opening the Floodgates for Future Cyberattacks
When the Russia-Ukraine war does come to an end, it is likely that the cybersecurity space will find itself in a far worse situation than it is today. Whether it’s through the anonymous recruitment of Ukraine’s IT army or the cybercriminals in Russia to whom this conflict has given an opportunity to hone their craft. After the conflict, whatever the outcome, these APT groups, hacktivists, and individuals are not just going to disappear. Instead, they will turn their newfound expertise and tooling toward fresh targets unleashing a tsunami of cyberattacks across the globe. We have already started to see early warning signs of this with attacks on NATO partners, as well as on those countries who have come to Ukraine’s aid, increasing in both frequency and intensity.

But it’s not just government departments in those countries that should be concerned, businesses must also prepare themselves for what will follow in the wake of this war. Cybercriminals need a steady income stream in order to recruit new members and invest in technology, and they will turn their attention towards enterprises to boost their coffers when state support has run dry.

This conflict has seen cyber activity change the face of warfare forever. But it has also had the “collateral damage” effect of raising the threat level for cyber-attacks on government and commercial organizations globally. While we were already in an era of sophisticated fifth-generation cyberattacks, threat actors have raised their game during the war and we know that even more, integrated and sophisticated cyberattacks are coming down the line. Organizations need to ready themselves now. Mitigating attacks won’t be enough, companies must adopt a prevent-first cybersecurity strategy.

And prevention is at the heart of Check Point’s Infinity platform, the first modern, consolidated security platform specifically designed to guard against zero-day vulnerabilities and sophisticated fifth-generation attacks across all networks, cloud deployments, and endpoints. Part of Infinity’s success is its ability to leverage Check Point’s ThreatCloud, a real-time global threat intelligence platform that monitors networks around the world for emerging threats and vulnerabilities.

Cyber Security

New Hacktivism Model Trends Worldwide



Check Point Research (CPR) outlines a new model of hacktivism now trending worldwide. Five characteristics mark today’s form of hacktivism, according to researchers: political ideology, leadership hierarchy, formal recruiting, advanced tools, and public relations. CPR gives the hacktivist group Killnet an example of the latest model, detailing its attacks by country and attack timeline. CPR warns that hacktivism that originates in conflict-related geographies has the potential to scale worldwide.

  • Before, hacktivism was mostly focused on a few individuals carrying small-scale DDoS and defacement attacks
  • Now, hacktivism is better organized, structured, and sophisticated
  • CPR believes the new model of hacktivism began in conflict areas in the Middle East and Eastern Europe and proliferated to other areas during 2022

Check Point Research outlines a new model of hacktivism now trending worldwide. The hacktivism of the new model is better organized, structured and sophisticated, compared to the past. Hacktivist groups no longer consist of a few random individuals who carry out small DDoS or defacement attacks on low-tier websites. These are coordinated organizations with distinct characteristics previously unseen.

Key Characteristics:

  • Consistent political ideology (manifestos and/or sets of rules)
  • Hierarchy of leadership (Smaller groups relay attack orders to “commanders)
  • Formal recruitment process (Based on minimum requirements)
  • Tools that the groups provide to their members (Advanced tools for notoriety)
  • Robust public relations functions (Presences on major websites)

Why now?
CPR suspects the shift in the hacktivism model began roughly two years ago, with several hacktivist groups like Hackers of Savior, Black Shadow, and Moses Staff that focused exclusively on attacking Israel. CPR believes the Russian-Ukrainian war has proliferated the new model of hacktivism significantly. For example, The IT Army of Ukraine was publicly mobilized by the Ukrainian government to attack Russia. The new hacktivism also saw groups that supported the Russian geopolitical narrative, with groups like Killnet, Xaknet, From Russia with Love (FRwL), NoName057(16), and more.

Case Study: Killnet, from East to West
In April of this year, the group completely shifted its focus to support Russian geopolitical interests all over the world. The group claimed to have executed more than 550 attacks, between late February and September. Only 45 of them were against Ukraine, less than 10% of the total number of attacks.

  1. March: the group executed a DDoS attack on Bradley International Airport in Connecticut (US)
  2. April: websites belonging to the Romanian Government, such as the Ministry of Defense, Border Police, National Railway Transport Company and a commercial bank, were rendered unreachable for several hours.
  3. May: massive DDOS attacks were executed against two major EU countries, Germany and Italy
  4. June: Two very significant waves of attacks were executed against Lithuania and Norway in response to severe geopolitical developments between those countries and Russia
  5. July: Killnet focused their efforts on Poland and caused several government websites to be unavailable.
  6. August: Cyber-attacks were deployed on Latvia, Estonia and USA institutions
  7. September: the group targeted Asia for the first time and focused its efforts on Japan, due to Japan’s support for Ukraine

Sergey Shykevich, Threat Intelligence Group Manager at Check Point Software, said, “Hacktivism now has a whole new meaning. Before, the term meant a few random folks launching small DDoS attacks. Hacktivism is no longer just about social groups with fluid agendas. Now, hacktivism is better organized, structured and more sophisticated. I believe everything changed within the past year, especially with the start of the Ukraine-Russia war.”

“There are some key characteristics that mark the new model of hacktivism, including a consistent political ideology, a clear hierarchy of leadership, formal recruiting processes, sophisticated tool set, and robust PR capabilities. Though the change began in specific conflict-related geographical regions, it has now spread west and even further. Major corporations and governments in Europe and the US are being heavily targeted by this emerging type of hacktivism. All this allows the new hacktivism groups to be mobilized to governmental narratives and achieve strategic and broad-based goals with higher success levels – and much wider public impact – than ever before,” he said.

Continue Reading

Cyber Security

Kaspersky Industrial Cybersecurity Now Delivers EDR



With new EDR functionality in Kaspersky Industrial CyberSecurity, customers can now gain instant visibility on operational technology (OT) security incidents and run response actions. The solution also helps reveal hidden weaknesses in networks, be it vulnerabilities, misconfigurations, or incompliance with policies and regulations. With the new features of active polling and a physical topology map, organizations can see even more of the assets in their OT network and how they interconnect. These new capabilities and the deeper integration of Kaspersky Industrial CyberSecurity for Nodes and Kaspersky Industrial CyberSecurity for Networks greatly enhance the OT visibility and control, compliance, and threat protection.

IT and OT convergence bring a growing number of connections, equipment, and services to industrial organizations. Maintaining control, availability, security, and compliance will require a new generation of dedicated cybersecurity solutions. According to IDC Worldwide IT/OT Convergence 2022 Predictions, by 2024, 30% of industrial enterprises will incorporate centralized security management tools to bridge the IT/OT gap. The renewed Kaspersky Industrial CyberSecurity platform comes alongside this trend.

With EDR in Kaspersky Industrial CyberSecurity for Nodes, a cybersecurity team can track malicious activity, analyze the root cause through attack spread path visualization, and run response actions on SCADA computers and operator workstations. The product provides a wide range of response actions that do not impact the industrial process unless there is explicit operator intervention, including quarantining or removing a malicious object, prohibition running a malicious process in the future, and so on. To ensure the threat does not spread to other machines, security specialists can create indicators of compromise (IoCs) or artifacts to indicate a system has been breached and run a cross-endpoint response based on these IoCs.

The EDR functionality is delivered as part of KICS for Nodes without the need to install additional hardware. It works on any operating system, including Windows XP, and is optimal for industrial networks as it doesn’t overload them with traffic and has no impact on ICS hosts. On top of this, it doesn’t require any specific skills from IT or OT security administrators.

With Kaspersky Industrial CyberSecurity for Networks, customers can implement a risk-oriented approach to cybersecurity. The product can now detect weaknesses that can potentially put OT integrity at risk or cause technology process disruption. The areas covered include vulnerable network architecture (access to external networks, lack of segmentation, multi-homed devices); weak host security settings (open ports, lack of authorization, disabled firewalls); obsolete, vulnerable, unwanted, unencrypted protocols, and anomalies in network protocols; outdated OS; unauthorized devices; and vulnerabilities in the PLCs. All risks are scored for severity in the management console, so security teams can focus on the most critical ones first.

The updated Kaspersky Industrial CyberSecurity for Nodes is able to automatically audit OT hosts or a group of hosts for vulnerabilities in the software, misconfigurations, and compliance with local or international regulations and corporate policies. The product uses open vulnerability and assessment language (OVAL) content to assess hosts. By default, the product provides a SCADA vulnerability database from Kaspersky ICS-CERT in OVAL format. Any OVAL database can be used, be it the NIST, CIS, or other regulations or custom samples.

Network and device visibility is enhanced thanks to active polling and the industrial network physical topology map in Kaspersky Industrial CyberSecurity for Networks. Active polling helps to identify assets in OT systems and their configuration, while a topology map visualizes the network architecture: how assets are physically connected and communicate with each other. With this data, OT operators or security teams can quickly understand elements such as where in the network a problem occurs and to what physical object in the production area it refers, allowing them to fix it faster.

Kaspersky Industrial CyberSecurity for Nodes also gives OT security experts a portable USB scanner to use on machines for which policies restrict the installation of any software, including cybersecurity products. These can be old endpoints with outdated software or those that are too critical to install something on them. Another use case is subcontractors’ equipment, which they may use inside the customer’s OT network. OT security specialists can use a simple USB flash drive to download the scanner from KICS for Nodes and then use it to scan the isolated machine. The scanner doesn’t install anything on the machine but provides information about any threats found on it, so security teams can plan the necessary actions.

As a platform, Kaspersky Industrial CyberSecurity also ensures native integration of all its components, including KICS for Nodes for Windows and Linux, KICS for Networks, and orchestration through a single management platform. Deeper integration of KICS for Nodes and KICS for Networks enables network alerts enriched with data about a host, its processes, and under which user it was launched. IT/OT security teams, SOC analysts, and SCADA operators now have more visibility over suspicious actions as a result and can make informed decisions about response actions.

“With this update, we are empowering our customers with a risk-oriented and compliance-oriented OT security management platform. Kaspersky Industrial CyberSecurity shines the light on incidents and hidden vulnerabilities, misconfigurations, and other weaknesses to minimize the risk of disruption to critical industrial processes. Along with corporate cybersecurity products, Kaspersky Industrial Cybersecurity is a crucial element of the ecosystem for industrial organizations to protect their assets from any threat vector, whether it exploits IT or OT. And through the native integration of all components in the ecosystem, and with a single management platform, we are gradually implementing the extended detection and response (XDR) concept for industrial cybersecurity in our portfolio,” commented Andrey Strelkov, Senior Product Manager at Kaspersky.

Continue Reading

Cyber Security

Global Cyber Security Revenue to Reach $334 Billion in 2026: GlobalData



Cyber security has emerged as a top priority for organizations and consumers alike, especially following the spread of the COVID-19 pandemic, which led to new ways of living and working with a huge reliance on digital infrastructure that remains vulnerable to cyberattacks. Against this backdrop, the global cyber security revenue is expected to register a compound annual growth rate (CAGR) of 8.7% from $220 billion in 2021 to $334 billion in 2026, forecasts GlobalData, a leading data, and analytics company.

The surge in the volume and sophistication of cyber-attacks across organizations is expected to favor the enterprise cyber security market revenue growth over the forecast period. Madhumita Chaudhary, Practice Head at GlobalData, comments: “Despite the continued investments and growth in the cyber security space, the frequency of attacks and breaches have shown no signs of abatement. More than billions of records containing critical information were compromised since the pandemic. As such, enterprise cyber security will continue to dominate the overall cyber security demand in terms of market share, capturing a sizeable revenue share exceeding 90% in 2021.”

GlobalData’s latest report, “Cyber Security Market Size, Share and Trends Analysis Report by Type (Enterprise, Consumer), Product (Security Consulting, Managed Service Providers, Identity and Access Management), Vertical, Enterprise Size, Region, and Segment Forecasts, 2021-2026,” reveals that the consumer cyber security market too will register a healthy CAGR, exceeding 10% during 2021-2026. Chaudhary explains: “The rapid emergence of connected devices and associated security risks with no baseline security upgrades will favor the segment growth over the forecast period.”

In addition to the rising frequency of attacks, ransomware is also gaining prominence, and has been used in several high-profile attacks. It is the most concerning type of cyberattack for business leaders. Chaudhary continues: “Cyber security should be at the forefront of all digital transformation strategies. A lapse in focus could mean hefty repercussions in form of accelerated ransomware attacks.”

Asia-Pacific (APAC) is more vulnerable to cyber threats owing to the critical infrastructure and growing financial sector in the region. Furthermore, an increase in digital transformation initiatives, penetration of internet connectivity, and susceptibility stemming from IoT connectivity is likely to increase the adoption of cyber security solutions.

Chaudhary concludes: “Emerging countries in the APAC region like India, Singapore, Japan, Australia, the Philippines, Thailand, and Taiwan are facing increasing cyber-crimes in terms of ransomware, phishing, and network attacks, and are projected to witness strong demand for cyber security products & services.”

Continue Reading

Follow Us


Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.