Connect with us

Cyber Security

Weaponised Cybercrime: What Organisations Can Learn from the Conflict in Ukraine



Written by Ram Narayanan, Country Manager at Check Point Software Technologies, Middle East

On February 24th, 2022, Russia launched a full-scale military invasion of Ukraine with attacks on land, sea, and air.  What has been less visible but nonetheless a critical element of the conflict is the battle being waged in cyberspace.  Just like the military conflict with its wider consequences in terms of disruption to trade and the tragedy of the refugee crisis, the war in cyberspace has an impact beyond the borders of Ukraine and Russia. While no one can predict how long this war will last, we can say for certain that the cyber aspects of the conflict in Ukraine will continue to resonate long after the guns have been silenced, as highlighted in Check Point’s Mid-Year Security Report 2022.

So, what does the conflict teach us about cyberwarfare and how can organizations prepare themselves for this new world order?

A New Era of Cyberwarfare
One thing we can take away from what’s happening in Ukraine is that cyberwarfare has become an established component of global conflict both in the propaganda battle as well as in the actual conduct of military operations.  From Distributed Denial of Service (DDoS) attacks and website defacements to destructive critical infrastructure attacks, activity on both sides has escalated dramatically since the initial invasion in February.

Just three days into the conflict in late February, Check Point Research (CPR) noted a 196% increase in cyberattacks on Ukraine’s government and military sector. And these attacks have shown no signs of slowing down in the months since. New figures from CPR report that between February and August of this year, cyberattacks on Ukraine’s government and the military sector more than doubled, increasing by a staggering 112%, while Russia’s same sector decreased by 8%.

While Russia has not completely disconnected from the internet as per previous reports, government and military networks and websites have implemented different measures to limit access to their resources from outside of Russia, which makes the execution of some of the attacks more difficult. Indeed, Ukraine has been under constant attack – throughout the conflict, corporate networks have experienced over 1,500 cyberattacks a week on average. This is 25% higher than before the conflict, versus 1,434 weekly cyberattacks on Russian corporate networks.

Russian operations, in particular, have focused on a campaign of disruption and destruction, with government and state-sponsored APT groups conducting sophisticated operations that have ranged from critical infrastructure attacks to espionage missions. For the first time, we’ve also seen coordination between cyberattacks and kinetic military assaults. One notable example took place on March 1st when a Russian missile assault on Kyiv’s TV tower coincided with a simultaneous cyberattack designed to knock out the city’s broadcasting capabilities.

CPR also reported that the most attacked industry In Russia during the conflict was the finance sector, with an average of more than 2600 attacks per organization every week, an increase of 24% compared to before the conflict. The second most attacked industry during the conflict was Communications, with an average of 1928 weekly attacks per organization (8% decrease). This could possibly be due to a heavier focus on the finance industry having greater activity, due to global sanctions implemented on Russia by government and business organizations outside of Russia. Disrupting this sector will also severely disturb the day-to-day normal activities of its citizens, similar to attacks on the Communications sector, where the majority of services provided online such as calls or internet services would push normal activities into disarray.

CPR also reported that the most attacked industry during the conflict in Ukraine was the finance sector, with an average of 1,841 cyberattacks per organization every week, a decrease of 29% compared to the period before the conflict, followed by the government and military sector, with an average of 1,406 weekly attacks per organization, which also saw the highest increase in weekly cyberattacks with a 112% increase compared to before the conflict, which could be due to increased attacks inflicted on them by factions siding with Russia. Manufacturing was the third most heavily attacked sector, with over 400 attacks per organization every week (64% decrease).

Like Russia, the finance sector also saw major attacks, probably as an outcome of the various government and individual financial aid received, as well as cybercriminals who were looking to cash in on known donations being sent to Ukraine for the war and refugee efforts. It was not surprising to see the manufacturing sector also being heavily attacked as this is one of the key critical industries for any country to be sustained, with its global wheat exports contributing heavily to Ukraine’s economy. Such disruptions would now not only impact inflows of funds into Ukraine but negatively impact their exports.

Perhaps the defining aspect of these attacks, however, has been the strength and relative successes of Ukraine’s cyber defenses, something that highlights the importance of ongoing operational security. But continued vigilance is just one of the factors at play here. The other notable impact has come from the army of volunteers who have flocked to support Ukraine, and whose involvement might change the face of cybersecurity as we know it.

A Battleground Without Borders
The cyber battle that’s raged in Ukraine has silently swept up thousands of “volunteer troops” ranging from hacktivists to cybercriminals via technology companies like Elon Musk’s SpaceX. The digital front has also attracted the attention of high-profile collectives with the powerful Conti ransomware group publicly vowing to protect the Kremlin’s interests while Anonymous declared war on Russia itself.

One of the most interesting aspects of the cyber warfare that has raged in Eastern Europe has been Ukraine’s willingness to recruit keyboard warriors from both sides of the law to join its ranks. During the first few days of the war the Ukrainian Minister of Digital Transformation, Mykhailo Fedorov, posted on Twitter a call for “digital talents” to join the country’s newly created IT army, with operational tasks being allocated to them via a designated Telegram channel that attracted hundreds of thousands of members.

The formation of a state-affiliated cyber force is unprecedented and, while the birth of Ukraine’s IT army is an extraordinary achievement, looking forward it could prove to be problematic. Recruiting and engaging members via Telegram is far from secure. How do you vet the people that are coming forward and stop other parties from infiltrating them or using them for their own recruitment? The fact that just about anybody could be serving within Ukraine’s cyber army is a major concern. There are equal concerns on the Russian side where state-backing has given cybercriminal groups both the means and opportunities to step up their activity.

Opening the Floodgates for Future Cyberattacks
When the Russia-Ukraine war does come to an end, it is likely that the cybersecurity space will find itself in a far worse situation than it is today. Whether it’s through the anonymous recruitment of Ukraine’s IT army or the cybercriminals in Russia to whom this conflict has given an opportunity to hone their craft. After the conflict, whatever the outcome, these APT groups, hacktivists, and individuals are not just going to disappear. Instead, they will turn their newfound expertise and tooling toward fresh targets unleashing a tsunami of cyberattacks across the globe. We have already started to see early warning signs of this with attacks on NATO partners, as well as on those countries who have come to Ukraine’s aid, increasing in both frequency and intensity.

But it’s not just government departments in those countries that should be concerned, businesses must also prepare themselves for what will follow in the wake of this war. Cybercriminals need a steady income stream in order to recruit new members and invest in technology, and they will turn their attention towards enterprises to boost their coffers when state support has run dry.

This conflict has seen cyber activity change the face of warfare forever. But it has also had the “collateral damage” effect of raising the threat level for cyber-attacks on government and commercial organizations globally. While we were already in an era of sophisticated fifth-generation cyberattacks, threat actors have raised their game during the war and we know that even more, integrated and sophisticated cyberattacks are coming down the line. Organizations need to ready themselves now. Mitigating attacks won’t be enough, companies must adopt a prevent-first cybersecurity strategy.

And prevention is at the heart of Check Point’s Infinity platform, the first modern, consolidated security platform specifically designed to guard against zero-day vulnerabilities and sophisticated fifth-generation attacks across all networks, cloud deployments, and endpoints. Part of Infinity’s success is its ability to leverage Check Point’s ThreatCloud, a real-time global threat intelligence platform that monitors networks around the world for emerging threats and vulnerabilities.

Cyber Security

Netskope Joins Google Workspace Security Alliance



Netskope has joined the Google Workspace Security Alliance to extend security and data protection for Workspace users. The Netskope One Platform provides a number of advanced security capabilities that protect data, defend against threats, and ensure users have fast and secure access to Google Workspace productivity and collaboration tools, including Gemini for Workspace.

As organizations increasingly adopt cloud technologies to drive innovation and efficiency, they are also challenged to secure sensitive data from a range of cyber risks, including:

  • Ongoing increases in the number of users uploading sensitive data to personal instances of cloud applications
  • New and evolving threat techniques such as abuse of certain applications for critical data access, back doors, and financial gain; compromise of credentials to access critical business data; insider threats; and more
  • Data exposure from the insecure use of both managed and unmanaged AI-based productivity tools

Netskope and Google Workspace empower organizations to embrace modern collaboration and productivity by enabling the secure use of AI-based productivity tools. Netskope provides advanced data loss prevention (DLP) techniques, delivering real-time visibility and control over users, data, and corporate vs. personal cloud instances. In addition, Netskope’s comprehensive threat protection through both API and inline controls detects threats in Google applications and monitors data movement and threat propagation between Google Workspace apps and third-party ecosystem applications.

“Netskope is proud to expand its partnership with Google Workspace by joining the Workspace Security Alliance. There are already thousands of customers using Netskope to safeguard their Google Workspace applications, and this new partnership further enhances the secure usage capabilities for application specific data protection policies,” said Andy Horwitz, VP, Global Partner Ecosystems, Netskope. “Together, Netskope and Google Workspace can help customers modernize their productivity stack. We look forward to helping customers safely optimize their employees’ daily productivity.”

The Netskope and Google Workspace partnership enables organizations to embrace collaboration and productivity while safeguarding critical data. Joint customers can now more effectively:

  1. Support best practice use of Gemini for Google Workspace: Leverage real-time user coaching to help enforce best practices in application usage. Organizations can gain visibility into data movement to minimize sensitive information sharing while achieving data compliance objectives.
  2. Protect sensitive data: Detect and manage access to sensitive data within Google Workspace applications, enforcing policies to prevent unauthorized data movement across platforms, including third-party services like Microsoft OneDrive, Box and Dropbox.
  3. Stop insider threats like data exfiltration: Prevent the download of sensitive data from Google Workspace business instances and then the upload to personal instances, which is one of today’s top reasons for data loss. Additionally, apply this control to unmanaged devices: allow unmanaged or personal device access to a specific cloud app for collaboration, however, do not allow downloading of sensitive data.
  4. Detect and stop elusive threats and malware: Protect against malware and phishing delivered from the cloud. Netskope’s multi-layered advanced threat protection (ATP) enhances security within Google Workspace and across cloud applications.
  5. Maintain compliance in Google Workspace: Ensure that organizations can adhere to regulations and meet compliance needs by enforcing security policies within Google Workspace.

“By partnering with Netskope, a leading SASE vendor, customers can confidently expand their Google Workspace adoption leveraging their existing IT infrastructure investments,” said Nikhil Sinha, Group Product Manager, Google Workspace. “Netskope instance awareness enables fine grained data governance policy differences to both corporate and personal Google Workspace accounts. We are excited to partner with Netskope to provide these advanced security capabilities to our customers.”

Continue Reading

Channel Talk

AmiViz and BitSight Join Forces to Elevate Middle East Risk Management



AmiViz has partnered with Bitsight, a leading provider of cyber risk management solutions. This collaboration marks a significant step forward in bolstering cybersecurity capabilities across the region and facilitating Bitsight’s expansion efforts in the Middle East.

The partnership between AmiViz and Bitsight will enhance the cybersecurity landscape in the Middle East by introducing state-of-the-art solutions designed to tackle the evolving cyber threats confronting regional organizations. With both companies committed to improving cybersecurity awareness and resilience, they are set to pave the way for a safer and more secure digital environment in the region.

Commenting on the partnership with Bitsight, Ilyas Mohammed, COO at AmiViz said, “Our decision to onboard Bitsight demonstrates our commitment towards the evolution of the cybersecurity landscape in the Middle East. As organizations grapple with increasingly sophisticated cyber threats, the partnership between these two industry leaders promises to deliver enhanced value by equipping organizations with the tools and insights needed to effectively manage cyber risks and safeguard their digital assets in an ever-evolving threat landscape.”

Bitsight’s solutions can proactively assess and manage their cyber risk exposure and provide organizations with actionable intelligence to optimize their security investments, streamline vendor risk management processes, and enhance cyber resilience. With a focus on continuous monitoring and data-driven insights, Bitsight empowers organizations to make informed decisions and stay ahead of emerging cyber threats.

The Middle East has often been an attractive target for cyber-attacks, and this partnership will empower companies to address vulnerabilities and protect their digital assets proactively. By combining AmiViz’s deep understanding of the regional market dynamics with Bitsight’s cutting-edge technology and global expertise, the partnership will offer next-generation cybersecurity solutions tailored to the unique challenges and requirements of Middle Eastern organizations.

“We are proud to partner with AmiViz to transform the cyber risk management landscape in the Middle East,” said Xavier Artiguebieille, Senior Vice President, EMEA Sales at Bitsight. “Our combined efforts will equip organizations with the critical tools and intelligence needed to navigate and mitigate the complexities of modern cyber threats, enhancing their overall security and resilience.”

Continue Reading

Artificial Intelligence

ESET’s New AI Assistant Streamlines Threat Detection and Response



ESET has introduced ESET AI Advisor, an innovative generative AI-based cybersecurity assistant that transforms incident response and interactive risk analysis. First showcased at RSA Conference 2024, the new solution is now available as part of the ESET PROTECT MDR Ultimate subscription tier and ESET Threat Intelligence.

Unlike other vendor offerings and typical generative AI assistants that focus on soft features like administration or device management, ESET AI Advisor seamlessly integrates into the day-to-day operations of security analysts, conducting in-depth analysis. Building on over two decades of ESET’s expertise in AI-driven endpoint protection, the offering provides detailed incident data and SOC team-level advisory. This is a game-changer for companies with limited IT resources who want to utilize the advantages of advanced Extended Detection and Response (XDR) solutions and threat intelligence feeds.

“As cybersecurity threats become increasingly sophisticated, ESET remains committed to providing cutting-edge solutions that address these challenges. The ESET AI Advisor module represents a significant leap forward in our mission to close the cybersecurity skills gap and empower organizations to safeguard their digital assets effectively,” said Juraj Malcho, Chief Technology Officer at ESET.

One of the primary benefits of this new solution is closing the cybersecurity skills gap. Security analysts of all skill levels can use ESET AI Advisor to conduct interactive risk identification, analysis, and response capabilities, which are provided in an easily understandable format. The user-friendly interface makes sophisticated threat data actionable even for less experienced IT and security professionals.

The ESET AI Advisor also excels in facilitating faster decision-making for critical incidents. Security analysts can simply consult the ESET AI Advisor to understand the specific threats their environment faces. Leveraging extensive XDR collected data, the ESET AI Advisor identifies and analyzes potential malware threats, providing intuitive insights into their behaviour and impact. It assists in recognizing phishing attempts and advising users on how to avoid falling victim to fraudulent emails or websites. By monitoring network traffic, the ESET AI Advisor can flag unusual or suspicious behaviour, helping security teams take appropriate action. Its ability to automate repetitive tasks is an additional advantage. Managing routine processes such as data collection, extraction, and basic threat detection, allows security teams to focus on more strategic initiatives.

In ESET Threat Intelligence, the new module will help researchers analyze vast quantities of unique APT reports and understand latest developments in world of cyber threats. With its conversational prompts and interactive dialogue, ESET AI Advisor empowers organizations to analyze and mitigate threats effortlessly and fortify their cybersecurity posture.

Continue Reading
Advertisement CCW 2024

Follow Us


Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.