A new threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacks and second only to the notorious Qilin.

Despite only having emerged in July last year, The Gentlemen has quickly evolved into a highly operational RaaS group, according to the NTT, using advanced tooling and proxy infrastructure to accelerate attacks and improve stealth.

With a level of technical maturity that would normally be associated with more established ransomware groups, the researchers believe that the group consists of experienced actors with potential ties to other ransomware ecosystems.

The group's targeting remains focused on industrial organizations, the information technology sector, and some consumer spaces, with notable victims including Synergy France, UK Electronics, and Equity Life.

In terms of target geography, meanwhile, The Gentlemen largely extorts organizations in Europe, with the UK and Germany among the most heavily targeted countries.

Its affiliates are increasingly leveraging SystemBC malware, a proxy and backdoor tool often used in human-operated ransomware attacks, to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments.

The group's rapid growth so far this year, combined with its sophisticated proxy infrastructure and obfuscation techniques, means organizations should expect faster intrusion cycles and reduced dwell times before encryption deployment, NTT said.

"The rise of groups like The Gentlemen demonstrates how affiliates are now combining shared tooling, stealth infrastructure, and repeatable intrusion methods to accelerate attacks at scale," said Matt Hull, VP of cyber intelligence and response at NCC Group.

"Techniques such as covert tunnelling and rapid domain-wide deployment are shrinking the window that defenders have to detect and respond before encryption occurs."

According to NTT, there were 748 ransomware listings worldwide during April, representing a 7% fall from the figure for March. However, ransomware activity in 2026 has been operating at a higher baseline than much of 2025, as the ransomware-as-a-service (RaaS) ecosystem expands and matures.

Claude Mythos – the large language model reportedly capable of autonomously identifying vulnerabilities and developing exploit chains – has yet to make its mark, thanks to restricted access, controlled testing environments, and questions around operational effectiveness at scale.

"Developments around AI models such as Claude Mythos suggest AI-assisted vulnerability discovery and exploitation could further compress attacker timelines in the future," said Hull. "However, the industry should remain cautious about overstating current capabilities, particularly where testing has been limited to controlled environments."

The report also highlighted several geopolitical developments likely to influence cyber activity in the coming months, including China's expanded supply chain security regulations, which consolidate and extend existing controls on import and export activities.

Meanwhile, the strategic significance of NASA's Artemis program is motivating China and other nations to carry out espionage, IP theft activities, and potentially even destructive attacks.

"Numerous other well-resourced countries (and private companies) are pursuing high-stakes interests dependent on the domain of space; including but not exclusive to India, Japan, Israel, South Korea, UAE, Russia, Iran, and North Korea," the researchers warned. "Defenders should avoid being too narrow in their assessments of potential threats."

The EU is being battered by cyberattacks, with government and critical infrastructure the top targets, cybersecurity agency ENISA has warned.

The latest ENISA Threat Landscape report found that state-aligned threat groups have been intensifying their operations towards EU organizations. It's seen such groups carrying out cyberespionage against the public administration sector, while feeding EU audiences with misinformation.

At the top of the target list is public administration, at 38%, mostly hacktivism and state-nexus intrusion to conduct cyberespionage campaigns against diplomatic and governmental bodies.

Next is the transport sector, at 7.5%, followed by digital infrastructure and services at 5%, finance at 4.5% and manufacturing at 3%.

Hacktivism accounted for almost 80% of the total number of incidents, mainly through low-impact DDoS campaigns targeting EU member states organizations' websites. Only 2% of hacktivism incidents resulted in service disruption.

Phishing – including vishing, malspam, and malvertising – is the main method for initial intrusion, accounting for about 60% of cases.

"The recent ENISA report makes it clear that phishing is still the leading entry point for attackers. What's interesting is how the technique is being reshaped by AI," said Mick Leach, field CISO at Abnormal AI.

"As shown in the report, attackers don't need to innovate while they continue to see success with tried-and-true techniques. Instead, they can make these methods more impactful with generative models that allow the creation of highly convincing and context-aware campaigns."

Vulnerability exploitation was the next most common vector.

"Vulnerability exploitation, which accounts for 21.3% of all attacks according to ENISA, is continually seen as a problem for businesses," said Sylvain Cortes, VP strategy, Hackuity.

"The challenge is that organisations often have difficulty with visibility and prioritization; they need both a centralised view to identify vulnerabilities and then the context around these to know where to prioritise remediation efforts. There's an inherent imbalance in the time it can take for organisations to patch critical vulnerabilities and the speed with which attackers can exploit them."

DDoS hacktivism

DDoS attacks were the most common type of incident, accounting for 77%, with most carried out by hacktivists rather than cyber criminals. But, said the researchers, there has been a notable convergence between threat groups. State-aligned actors are showing hacktivist characteristics, while the two groups are using increasingly similar tools.

The report highlighted the abuse of critical dependency points, for example in the digital supply chain. And AI, meanwhile, is being used both as an optimization tool for malicious activities and also as a new point of exposure. LLMs are enhancing phishing and automating social engineering activities.

"The growing role of AI has become an undeniable key trend of the rapidly evolving threat landscape, the researchers said.

And, they warned, "While the focus of threat activities involving AI was the use of consumer-grade AI tools to enhance their existing operations, the emergent malicious AI systems is raising concerns about their capabilities in the future due to the widespread use of AI models."

MORE FROM ITPRO

• What is a DDoS attack
• AI phishing

A newly-discovered threat group linked to China is targeting governments, the military, and other critical bodies across Africa, the Middle East, and Asia for espionage.

Palo Alto Networks said the group, which it has dubbed Phantom Taurus, belongs in the top tier of global threats.

"This is largely due to their targeting of both high-level geopolitical intelligence and entities (embassies, foreign ministries, diplomats) and critical telecommunications infrastructure, making them very much a dual threat," the researchers warned.

Phantom Taurus has been operating for two years, using a distinctive set of tactics, techniques, and procedures (TTPs) that allow it to conduct highly covert operations.

Alongside more common tools, such as China Chopper, the Potato suite, and Impacket, the group uses customized tools, including the Specter malware family and Ntospy. It's also been able to maintain long-term access to critical targets through a custom-built malware suite called NET-STAR.

Since 2023, Phantom Taurus has focused on stealing sensitive and specific emails of interest from email servers – but has more recently shifted to the direct targeting of databases using a script named mssq.bat.

This connects to an SQL Server database with a given server name, a user ID named sa (system administrator), and a password that the attackers previously obtained. It then reads the SQL query provided in the command-line arguments by the group's operators, allowing dynamic searching for tables and specific keywords.

Finally, it executes the provided query and returns the results that match the user's search, exports the results to a CSV file, and closes the database connection.

Perhaps most significantly, the group is using a new and undocumented malware suite, NET-STAR, designed to target Internet Information Services (IIS) web servers.

"The NET-STAR malware suite demonstrates Phantom Taurus' advanced evasion techniques and a deep understanding of .NET architecture, representing a significant threat to internet-facing servers," the researchers said.

The suite consists of three distinct web-based backdoors, each carrying out a specific role in the attack chain, while maintaining persistence within the target's IIS environment.

IIServerCore is a fileless modular backdoor that supports in-memory execution of command-line arguments, arbitrary commands and payloads; AssemblyExecuter V1 loads and executes additional .NET payloads in memory; and AssemblyExecuter V2 is an enhanced version of AssemblyExecuter V1 that's also equipped with Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) bypass capabilities.

Palo Alto Networks has published indicators of compromise here, and has upgraded its Advanced WildFire machine-learning models and Cortex XDR to give better protection. It said it has also shared its findings with fellow Cyber Threat Alliance (CTA) members, and is recommending that they do the same.

MORE FROM ITPRO

• Harrods hit by cyber attack
• Ashai production halted by cyber attack

Business leaders need to stay up to date with geopolitics to keep their cybersecurity strategies up to date and mitigate the risks posed by state-backed hacker groups.

This is the message that Paul Chichester, director of operations at the UK’s National Cyber Security Centre (NCSC), delivered to attendees at a keynote session of Infosecurity Europe 2025.

The call to action from Chichester came as states known to support threat actors and engage in cyber attacks of their own step up efforts to disrupt critical infrastructure

Chichester said Russia’s cyber capabilities in particular have improved in recent years, with its invasion of Ukraine used as an opportunity to hone offensive cyber techniques. Along with Russia, Chichester focused on the threat China-backed groups pose to both public and private organizations.

“I'll come back to this a few times, but states don't do hacking for fun,” Chichester said.

“They do not do things for the sake of it. There is always a reason. We might not know the reason sometimes and that's quite a challenge for us, but we shouldn't assume that they're just doing it because they can.”

Chichester urged businesses who are being targeted by a state APT to carefully consider why and to assess how geopolitics feeds into their defensive strategies.

“At the end of the day, cyber isn't really just, or even, a technical thing. It's a tool that somebody uses, be it a criminal, be it a state. How does that risk manifest itself for you?”

The past few years have seen a number of high-profile attacks by state-sponsored groups on organizations to achieve ideological and military aims. Chichester said Russia is increasingly targeting supply chains which feed into Ukraine, with defense, energy, and logistics companies firmly in its crosshairs.

In 2022, for example, Microsoft warned the Russia-backed group Seashell Blizzard was using the Prestige ransomware strain to target organizations involved in the supply or transport of humanitarian aid and military shipments to Ukraine.

This is also coming from within the GRU military intelligence service, and Chichester cited the example of Unit 29155. This Russian military sabotage unit is known for its role in the 2018 Skripal poisonings, but it is now using cyber attacks to carry out its aims.

“Ultimately, if you want to target something in the real world, you need to understand them in the cyber world. You need to understand how they operate, you need to understand their movements, you need to understand what's going where,” Chichester explained.

“And we're seeing that merger of that real world sabotage being joined with that cyber espionage piece as well – and also cyber sabotage.”

Russia launched a major cyber attack on Viasat, a US communications company, on 24 February 2022, the same day it invaded Ukraine. This triggered a widespread outage, impacting Ukrainian military command and control and causing knock-on outages for several thousand internet-connected German wind turbines.

Chichester said the attack was carefully-timed to hit hardest in the first 24-48 hours of the invasion and “might have been a deciding factor” in the war had events on the ground gone differently.

Despite the apparently unintentional effects on EU-based companies, Chichester used the attack as an example of how states are increasingly targeting private businesses to achieve military or ideological aims.

China is also heavily implicated in attacks on critical national infrastructure, with cyber experts Kevin Mandia and Nicole Perlroth having recently warned the nation state has ramped up its cyber aggression.

Chichester said attacks by Volt Typhoon, an advanced persistent threat (APT) that successfully breached the US electric grid for almost a year, as well as Salt Typhoon which carried out major attacks on US telcos in 2024, show groups ‘pre-positioning’ themselves inside critical infrastructure.

As warned by CISA, this could enable undetected groups to carry out devastating attacks in the event of conventional war in the long-term.

For-profit attacks remain king

Despite the growing threat posed by state-backed groups pursuing ideological and military aims, evidence suggests that businesses will still largely contend with traditional threat actors.

In a separate keynote talk at the event, James Lyne, office of the CEO at the SANS Institute and Ciaran Martin, director of CISO network at the SANS Institute and former head of the NCSC, balanced the real threat of state-backed groups with those of profit-motivated groups.

“Most people are interested in fraud,” said Lyne. “Most of this stuff is about making money, the average obsession of the average criminal gang is far more mundane.”

“I think that's probably largely going to continue to be the case,” he added.

Lyne noted that, like the German wind farm operators inadvertently impacted by Russia’s attack on Viasat, some serious cyber attacks are mere “collateral damage” from campaigns aimed at other targets.

Martin said this was seen in the worst period of his time at the NCSC: the six-week period in 2017 in which North Korea launched the WannaCry ransomware attack, while suspected Russian groups hit Ukrainian banks and other organizations with the NotPetya malware.

“Between them, they [did] north of $10 billion of destruction and in my, sadly, favorite example from NotPetya, they’re attacking Ukrainian tax software and they end up stopping production at Cadbury’s chocolate factory in Tasmania, off the south coast of Australia.”

MORE FROM ITPRO

• The Iran cyber threat: Breaking down attack tactics
• Why government email servers are top targets for state-backed hackers
• State-sponsored cyber crime is officially out of control

The Department of Justice (DoJ) has charged a Russian man over his links to major ransomware groups, offering a $10 million award for information that assists his arrest.

Mikhail Pavlovich Matveev, a 30-year-old Russian national, was charged over intentionally damaging protected computers, as well as conspiracy to damage protected computers and to transmit ransom demands. 

He is alleged to have helped deploy the LockBit, Hive, and Babuk ransomware variants to extort money from US and international organizations.

According to the FBI, Matveev is known to have links to both Kaliningrad and St. Petersburg in Russia, where he is understood to reside.

It has long been established that cyber criminals operating in Russia will escape criminal penalties, providing they don’t attack the Russian government or any organizations operating in the country.

Many ransomware groups operate out of Russia due to these ‘safe harbor’ protections. They often never leave the country due to fears of being arrested in territories that have extradition agreements with major powers in the West, and rarely meet criminal punishments as a result.

The DoJ has alleged that on or around 25 June 2020, Matveev and other LockBit operators used the ransomware strain against a New Jersey-based law enforcement agency.

It additionally linked him to a 2021 Babuk attack on the DC police department

“From his home base in Russia, Matveev allegedly used multiple ransomware variants to attack critical infrastructure around the world, including hospitals, government agencies, and victims in other sectors,” said Assistant Attorney General Kenneth A. Polite, Jr. of the Justice Department’s Criminal Division. 

“These international crimes demand a coordinated response. We will not relent in imposing consequences on the most egregious actors in the cyber crime ecosystem.”

In its official wanted notice for Matveev, the FBI listed his known aliases as ‘Wazawaka’, ‘Boriscelcin’, ‘m1x’, and ‘Uhodiransomwar’.

Any individual in possession of information that leads to Matveev’s arrest or conviction has been urged to submit a tip to the FBI. 

The FBI’s Newark Field Office Cyber Crimes Task Force has been put in charge of the case in coordination with a number of European agencies, including the UK’s National Crime Agency.

What are LockBit, Hive, and Babuk?

Both LockBit and Hive are ransomware as a service (RaaS) groups are known for following a double extortion method and are among the most notorious in operation.

The Babuk group is now believed to have retired, but at its peak was linked to attacks such as one on NHS outsourcing firm Serco, and received up to $13 million in paid ransoms.

The DoJ has estimated that victims have paid the three groups a combined $200 million in ransom over the years.

LockBit made headlines in recent months for an attack against Royal Mail International, for which it initially demanded and $81 million  (£65 million) ransom.

Following talks, LockBit leaked 44GB of the firm’s data including salary information, contracts, and vaccine records, and lowered its ransom to $41 million (£33 million).

It has targeted firms such as digital transformation company Orion Innovation and in December attacked a Canadian children’s hospital, an act for which it issued a rare apology and provided a free decryptor.

After falling prey to DDoS attacks, the group had pledged to be ‘more aggressive’ and its strain LockBit 3.0 accounted for 35% of all ransomware activity in Q3 2022.

Hive has been linked to a range of high-profile security incidents in the last year, including an attack on French telco giant Altice, the encryption of systems at Indian energy leader Tata Power, and a widespread assault on Costa Rican healthcare systems. 

Microsoft warned in July 2022 that Hive’s new variant was more sophisticated, having adopted the programming language Rust in its payload executable for improved memory safety and efficiency.

In January, the FBI confirmed a takedown of Hive ransomware operations, though this was deemed unlikely to have lasting effects.

Transportation Security Administration (TSA), an agency of the United States Department of Homeland Security (DHS), has announced its collaboration with Pangiam to improve threat detection‌ ‌at‌ ‌airports.

TSA’s Innovation Task Force (ITF) had previously issued a Broad Agency Announcement (BAA) in December 2021 to identify innovative transport security solutions that are rigorously vetted and demonstrated in a live operational setting.

Per the new deal, TSA will trial Pangiam’s artificial intelligence (AI)-powered accessible screening solution, built on open architecture standards.

The move furthers Project DARTMOUTH, a concord between Pangiam and Google Cloud, that couples artificial intelligence (AI) and pattern analysis technologies ‌to‌ ‌identify possible prohibited items within carry-on luggage in real-time.

According to reports, ‌the‌ ‌first‌ ‌phase of Project Dartmouth‌ ‌trials is set to commence at TSA’s 128,000-square-foot System Integration Facility in Arlington.

“As TSA and other security agencies adopt 3D Computed Tomography (CT), this application of AI represents a potentially transformative leap in aviation security, making air travel safer and more consistent, while allowing TSA’s highly trained officers to focus on bags that pose the greatest risk,” said Alexis Long, product director at Pangiam.

“Our aim is to utilize AI and computer vision technologies to enhance security by providing TSA and security officers with powerful tools to detect prohibitive items that may pose a threat to aviation security is a significant step toward setting a new security standard with worldwide implications,” added Long.

Pangiam is also partnering with AGS Airports Group to carry out trials at Aberdeen, Glasgow, and Southampton airports in the UK in addition to TSA debuting Project Dartmouth in North America.

CISA has published two playbooks for federal civilian agencies to plan and conduct cyber security vulnerability and incident response.

The Federal Government Cybersecurity Incident and Vulnerability Response Playbooks follow an executive order from President Biden in May urging the US to improve its cyber security measures following a series of data breaches in critical infrastructure and federal agencies, including the SolarWinds supply chain attack and the ransomware attacks on the Colonial pipeline.

The order from Biden urged better lines of communication between law enforcement and service providers to enhance investigations.

CISA said the playbooks should provide federal civilian agencies with a standard set of procedures to respond to vulnerabilities and incidents impacting Federal Civilian Executive Branch networks.

“The playbooks we are releasing today are intended to improve and standardize the approaches used by federal agencies to identify, remediate, and recover from vulnerabilities and incidents affecting their systems,” said Matt Hartman, deputy executive assistant director for Cybersecurity.

“This important step, set in motion by President Biden’s Cyber Executive Order, will enable more comprehensive analysis and mitigation of vulnerabilities and incidents across the civilian enterprise. We encourage our public and private sector partners to review the playbooks to take stock of their own vulnerability and incident response practices.”

Two playbooks outlined by CIS are for incident and vulnerability response. They should give agencies a standard set of procedures to identify, coordinate, remediate, recover, and track successful mitigations from incidents and vulnerabilities affecting systems, data, and networks. They also contain checklists for incident response, incident response preparation, and vulnerability response that can be adapted to any organization to track necessary activities to completion.

CISA said the “Incident Response Playbook” applies to incidents involving confirmed malicious cyber activity and for which a major incident has been declared or not yet been reasonably ruled out. The “Vulnerability Response Playbook” applies to any vulnerability observed to be used by adversaries to gain unauthorized entry into computing resources.

“Agencies should use these playbooks to help shape overall defensive cyber operations to ensure consistent and effective response and coordinated communication of response activities,” CISA said.

The playbooks also cover response activities, such as malicious activity detection or vulnerability discovery initiated by federal agencies, CISA, or third parties. CISA warned the playbooks don’t cover threats to classified data or national security systems.

When Joe Biden met Vladimir Putin in Geneva in June 2021, he took the opportunity to remind his Russian counterpart that the US has “significant cyber capability”. With a nudge and a wink, he was warning Russia that enough was enough.

It’s not surprising that the US felt the need to make a point. From alleged interference in the 2016 American election to the attack last year on networking firm SolarWinds, which compromised software used by the US and UK governments, the United States has long been a target of Russian’s sophisticated hacking capabilities.

But what can Biden actually do in the event of an online attack?

Pointing fingers

“If Country A flies its aeroplane into the airspace of Country B without permission, it’s violated its sovereignty,” said Michael Schmitt, professor of public international law at the University of Reading and a scholar at the US military college West Point.

“But what if it doesn’t do that? What if it conducts cyber operations? Under what circumstances would we call that a violation of sovereignty? We’re taking rules that were not meant for cyber. And we’re saying, in international law, rules apply to new phenomena and new technologies,” he said.

The first question to ask, he points out, is at what point a systems incursion even becomes an attack. “When does a remotely conducted cyber operation violate sovereignty?” asked Schmitt. “You hurt someone? Sure. You physically damaged cyber infrastructure? Sure. What if you caused the system to work in a manner it wasn’t intended to work? What if you’re simply sitting inside their system with malware that you haven’t activated yet?”

“What if you’re engaging in espionage, and you’re just scooping up mountains of data on people?”

Unfortunately, there’s no clear definition of what constitutes an attack. But even if the lawyers do agree an attack has occurred, and a response is justified, there’s another important step: figuring out who is responsible.

“To factually attribute conduct in [cyberspace] is very tricky because of the use of VPNs and stuff like that,” said Dr Talita Dias, a research fellow at the Oxford Institute for Ethics, Law and Armed Conflict. “It’s difficult forensically to identify the source of an attack.”

Another potential complication is not just the technical attribution, but also the question of whether hackers are working on behalf of a particular country, or just happen to be based there.

“[Imagine] you have an attack coming from Italy,” said Dr Antonio Coco from the University of Essex’s School of Law. “You may have evidence that the attack comes from a hacker group that operates from Italy, but no evidence that Italy has sponsored or directed this attack at all.” That doesn’t necessarily mean Italy is off the hook, however: “If you can demonstrate that Italy has failed to exercise due diligence in preventing that attack, then the responsibility of Italy may be implicated” – meaning it could still be lawful to respond with countermeasures.

Fighting back

“Countermeasures” are presumably what Biden had in mind when he spoke to Putin. “That is clearly what Biden is threatening,” said Schmitt. “I think he’s saying no, no, no, the gloves are off now. If you keep this up, then we’re going to start shooting back.”

That doesn’t mean the US can literally resort to military measures. Legally, any response must be proportionate and targeted. “International law does not recognise tit for tat, ever,” said Schmitt. “International law is designed to return a situation to one of peacefulness. So, the striking back must always be to make the other side stop.”

Even so, retaliatory cyber attacks are tempting, simply because they’re cheaper and subtler than real-world action. “When you have two countries confronting each other in the offline world, usually they do it with their armies. This is costly. It’s resource intensive, and it’s also very difficult to conceal,” said Coco. “In cyber dealings, it’s very cost effective to empower hacker groups.”

Retaliation can also lead to de-escalation, too. “If you can hack back and shut the system down, great, but you may not get into that system,” said Schmitt. “So what you’re trying to do is impose a bit of pain on the other side, so the other side says, ‘I don’t know if this is worth it any more. Let’s knock this off’.”

This is one reason why we might be seeing an increase in states grabbing cryptocurrency caches. “If we can’t [hack back], let’s block the resources that these malicious actors are using,” said Dias. “For example, in the context of ransomware, can we seize crypto assets? We could do that as a proportionate response.”

Sparking real confrontations

That’s not to say countermeasures have to be “cyber” in nature. Under the current legal understanding, other types of responses are legal.

Schmitt gives the example of Estonia. In 2007, the country came under a sustained cyber attack from Russia, which launched DDoS blitzes, ping floods and other attacks on a range of Estonian websites and organisations – including the country’s Parliament. This experience, and the questions over how the Tallin government should respond, inspired the naming of the Tallinn Manual – an influential study edited by Schmitt and originally published in 2013 which aims to figure out the laws of cyber conflict.

The problem is that Estonia is a tiny country of 1.3 million people, with nothing like Russia’s cyber resources. But in Schmitt’s view, under international law it would be legal for the country to respond another way, such as by blocking Russian ships from passing through its territorial waters in the Baltic Sea – a crucial strategic pinch point for Russia.

“Estonia could impose pressure by doing something that would normally be illegal... but now it’s okay to get the other side to knock it off,” said Schmitt.

Schmitt suggests that in extreme circumstances it could even be lawful for a country to respond to a cyber attack using military force, if that is the only countermeasure available. Thus, even online conflicts could eventually have very serious consequences.

Do we need a digital Geneva Convention?

To help prevent major escalations, some have suggested that major states should agree a “digital Geneva Convention”, which sets out the rules of cyber conflict. One of them is Microsoft’s chief legal officer, Brad Smith.

The experts we spoke to are sceptical that such a treaty will ever happen, however. “Strictly speaking, we don’t need a treaty,” said Dias. “We already have rules that apply by default to cyber. It’s a matter of fleshing them out and understanding how they apply.”

Dias argues that the cyber rules of the road could be more clearly established by patching together existing law, as it has evolved over time. And this is a process that is already ongoing: in recent years, governments around the world have released position statements, essentially outlining their view of the “rules” of cyber-conflict. While no one is forging formal agreements, these statements help other governments understand each other, and how hostile cyber actions may be received.

At the same time, the United Nations has convened a group of governmental experts to consult on the legal issues around cyber conflict, while legal academics are hard at work on a new edition of the Tallinn Manual, which will go further in defining how existing international law works in the cyber arena. “If you start with a treaty, you may be forgetting the fact that there already is law,” said Schmitt. “It may actually be a step backwards.”

President Biden has said his administration is committed to hardening our critical infrastructure against cyber attacks, disrupting ransomware networks, and “working to establish and promote clear rules of the road for all nations in cyberspace”, as Cybersecurity Awareness Month kicks off.

In a White House statement, President Biden said "cyber threats can affect every American, every business - regardless of size - and every community. That's why my administration is marshaling a whole-of-nation effort to confront cyber threats."

Last Thursday, the president signed a proclamation declaring October Cybersecurity Awareness Month. The proclamation said as the nation got to grips with ransomware attacks disrupting hospitals, schools, police departments, fuel pipelines, food suppliers, and small businesses, the public needed to “take action to better protect yourselves against cyber threats.”

Biden said that in May he issued an executive order to modernize defenses and position the Federal government to “lead, rather than lag, in its own cybersecurity.” This meant using its substantial buying power to improve security software for all Americans.

He also cited a 100-day action plan to improve the electricity sector’s cyber security. This, he added, has already resulted in more than 150 utilities serving 90 million Americans committing to deploy cyber security technologies. Biden said his administration was working to deploy action plans for additional critical infrastructure sectors.

He also pointed out that a National Security Memorandum was issued outlining the cyber security practices that owners and operators of critical infrastructure should put in place.

Biden also lauded efforts to bring 30 countries around the world to speed up cooperation in combating cyber crime, improving law enforcement collaboration, stemming the illicit use of cryptocurrency, and engaging on these issues diplomatically.

“We are building a coalition of nations to advocate for and invest in trusted 5G technology and to better secure our supply chains. And, we are bringing the full strength of our capabilities to disrupt malicious cyber activity, including managing both the risks and opportunities of emerging technologies like quantum computing and artificial intelligence,” said Biden.

"This October, even as we recognize how much work remains to be done and that maintaining strong cybersecurity practices is ongoing work, I am confident that the advancements we have put in place during the first months of my administration will enable us to build back better,” he added.

The government of Bahrain has once again used spyware from Israeli surveillance company NSO to target activists' smartphones, according to a Citizen Lab report,

The spyware employed two exploits targeting Apple's iMessage system, including a new one first spotted in June.

The report tracked the targeting of nine Bahraini activists using the NSO software. The investigation ties the infection servers to NSO's Pegasus spyware, and tracked the spyware's use of multiple vulnerabilities in iMessage.

Citizen Lab researchers noted that a Bahrain government operator codenamed LULU compromised iPhones using Pegasus via a zero-click iMessage exploit known as KISMET between July and September 2020. This simply required the phone to receive a message, enabling the spyware to compromise the operating system and monitor its internet traffic.

KISMET compromised iOS versions until at least version 13.7, according to the Citizen Lab. At that point, Apple updated iOS with the BlastDoor security feature that defended against zero-click iMessage attacks. NSO's Pegasus spyware then resorted to a single-click attack, requiring victims to follow a link in an iMessage.

Pegasus returned to zero-click attacks from February 2021 with a more recent exploit Citizen Lab called FORCEDENTRY.

FORCEDENTRY appears to be the same as Megalodon, an attack Amnesty International identified in June. It is a zero-click attack that could compromise phones without any user interaction. Amnesty confirmed it had compromised iPhones running iOS 14.6 in June, and Apple told the organization it was investigating the issue. At the time of writing, the latest version of iOS is 14.7.

Freedom House, a non-profit that promotes democracy worldwide, classified Bahrain as “Not Free,” and gives it a freedom score of 29% due to heavy restrictions on internet use and strong censorship practices. The country arrests internet users for discussing forbidden topics online and engages in online surveillance practices, including spyware.

Citizen Lab first documented Bahrain Pegasus use in 2018 via a government operator that it called PEARL. It posited that LULU may be the same state surveillance team.

NSO continues to face challenges as it sells spyware to countries with oppressive histories, including Bahrain. Amazon Web Services shut down NSO infrastructure running on its servers last month, and United Nations human rights experts renewed calls for an international moratorium on the sale of spyware.

The Citizen Lab cited tools from other companies the Bahrain government used for online surveillance, including Cellebrite, FinFisher, Netsweeper, Trovicor, and Verint.

Hackers recently hit the Department of State with a cyber attack, according to Fox News and Reuters reports, The Department of Defense Cyber Command also reportedly released notifications of a potentially serious data breach.

According to a tweet by a Fox News reporter on Saturday, the breach is believed to have happened a couple of weeks ago. In a later tweet, the reporter said the extent of the breach, the investigation into the suspected entity behind it, efforts taken to mitigate it, and any ongoing risk to operations remain unclear.

However, a source told Reuters that the State Department has not experienced significant disruptions and has not had its operations impeded in any way.

"The Department takes seriously its responsibility to safeguard its information and continuously takes steps to ensure information is protected. For security reasons, we are not in a position to discuss the nature or scope of any alleged cybersecurity incidents at this time," a State Department spokesperson said in a statement to Reuters.

Steven Hope, CEO and co-founder of Authlogics, told IT Pro the State Department is a juicier target for hackers than the shop around the corner.

“While we don’t know what was breached, and we may never know in this case, the fact it is listed as ‘serious’ indicates that there could be a lot behind this, either in terms of the volume of data accessed or importance of it. It would be very interesting to know how the bad guys got in to affect the breach,” Hope said.

“By far the most common way into a network is via weak authentication, e.g. breached passwords or poor MFA. After all, we do have over 12 thousand breached U.S. State Department credentials in our database alone, but again, in this case, we may never know."

Sam Curry, chief security officer at Cybereason, told IT Pro that while the State Department isn’t likely to disclose any further details of this attack, given the chaos in Afghanistan, and lingering tensions with Russia over the Colonial and JBS attacks and China for the Microsoft Exchange Server attacks, public and private sector security teams should be on high alert.

“Also, allies of the U.S. across Europe, Asia-Pacific, and Africa should also be on high alert. Let's hope the perception by some that the U.S. is distracted doesn't lead to more attacks and chaos,” he said.

“The State Department attack is one of the reasons for the EDR mandate for the US Federal government agencies in the recent White House Executive Order. Having a means of finding the attacks like the one on the State Department as threat actors move in the slow, subtle, stealthy way through networks is the only option in returning defenders to higher ground above threat actors.

"Advanced prevention, building resilience, ensuring that the blast radius of payloads is minimized and generally using peacetime to foster antifragility is achievable. Today, it’s not about who we hire or what we buy. It’s about how we adapt and improve every day."

The federal government has launched new regulations requiring owners of critical pipelines that transport hazardous liquids and natural gas to implement “urgently needed protections against cyber intrusions.”

This was the second time since May that the Department of Homeland Security (DHS) issued a cyber security directive aimed at US pipeline operators. It comes in the wake of the Colonial Pipeline hack that disrupted fuel supplies across the southeastern US for days.

DHS said Tuesday’s move was in response to “the ongoing cybersecurity threat to pipeline systems,” Reuters reported.

“The lives and livelihoods of the American people depend on our collective ability to protect our nation’s critical infrastructure from evolving threats,” DHS Secretary Alejandro Mayorkas said.

The security directive requires critical pipelines to take defensive measures to protect themselves from ransomware attacks and other known threats to IT systems. Pipeline owners must also have a cyber security contingency and recovery plan in place.

In an earlier security directive in late May, immediately following the Colonial Pipeline cyber attack, the DHS began requiring US pipeline operators to conduct a cyber security assessment. Until then, American pipeline companies operated under purely voluntary cyber security guidelines.

That late-May directive required pipeline owners and operators to report any cyber incidents to the federal government. They also needed a designated cyber security coordinator available 24/7 to work with authorities in an attack.

When DarkSide hackers attacked Colonial Pipeline, they forced it to shut down 5,500 miles of pipeline between Texas and New York for several days, disrupting the fuel supply to large swaths of the East Coast. The hackers also took 100GB of data from the network before locking computers and extorting the company for a ransom payment.

Colonial’s CEO has confirmed the pipeline company paid $4.4 million to cyber criminals who hit it with the ransomware attack.

The head of the UK’s domestic counter-intelligence and security agency, MI5, will today deliver a warning to the general public about the threats posed by cyber espionage.

Ken McCallum, who last year succeeded Sir Andrew Parker as Director General, will emphasise the importance of vigilance among regular people in the UK, who are being increasingly approached by foreign intelligence agencies.

The MI5 has recorded more than 10,000 cyber espionage incidents in the last five years, with many taking place on networking social media platform LinkedIn.

McCallum is expected to say that “UK victims of state espionage range way wider than just government”, in a speech scheduled for today at MI5’s Thames House headquarters.

“We see the UK’s brilliant universities and researchers having their discoveries stolen or copied; we see businesses hollowed out by the loss of advantage they’ve worked painstakingly to build. Given half a chance, hostile actors will short-circuit years of patient British research or investment. This is happening at scale. And it affects us all. UK jobs, UK public services, UK futures,” he will say.

McCallum will also urge businesses engaged in export, scientific research, and the high-tech sector to be aware of the potential risks of falling victim to cyber espionage. These could include "frustration and inconvenience”, but also “loss of livelihood, potentially up to loss of life".

However, McCallum is to add that these companies “don’t have to be scared; but be switched on”.

McCallum will also appeal for action across the government as well as the general public: "We must, over time, build the same public awareness and resilience to state threats that we have done over the years on terrorism," he will say.

The warning comes three months after the Centre for the Protection of National Infrastructure (CPNI) launched the Think Before You Link campaign, which aims to increase awareness of foreign agents targeting officials with access to sensitive information.

The project shares concerns that once a request has been accepted, the victim's colleagues will be more likely to accept a follow-up request as it looks like they share a mutual acquaintance. Nearly all government departments and some key industries are thought to have been targeted by fake LinkedIn accounts.

Microsoft has confirmed that some of its customers have been targeted by the Russian state-backed hacking group responsible for last year’s SolarWinds cyber attack after successfully compromising an employees' computer.

Known as Nobelium, the group was found to have engaged in “password spray and brute-force attacks” on the tech giant’s customers.

The hackers implanted “information-stealing malware” on a device belonging to a Microsoft customer support agent, through which they obtained “basic account information for a small number of [Microsoft’s] customers”, according to the firm.

They then “used this information in some cases to launch highly-targeted attacks as part of their broader campaign”.

“We responded quickly, removed the access and secured the device,” said Microsoft, adding that while the attacks were “mostly unsuccessful”, hackers managed to compromise three of its customers.

"This recent activity was mostly unsuccessful, and the majority of targets were not successfully compromised – we are aware of three compromised entities to date," the Microsoft Security Response Center team announced in a blog post. "All customers that were compromised or targeted are being contacted through our nation-state notification process.

Around 10% of the targeted customers were UK-based, with the hackers mostly focusing on “US interests”. The majority of the targets were “IT companies (57%), followed by government (20%), and smaller percentages for non-governmental organisations and think tanks, as well as financial services”.

Overall, the hackers targeted organisations from 36 countries, the tech giant stated, adding that it recommends that customers enable multi-factor authentication in order “to protect their environments from this and similar attacks”.

The news comes weeks after Nobelium launched a wave of attacks on more than 150 government agencies, think tanks, consultants, and NGOs from 24 countries, targeting an estimated 3,000 email accounts.

Microsoft's corporate VP of Customer Security & Trust, Tom Burt, said at the time said that Nobelium's main objective is to "gain access to trusted technology providers and infect their customers". The hacking group’s activities also tend to coincide with the "issues of concern to the country from which they are operating", according to the cyber security expert.

"This is yet another example of how cyber attacks have become the tool of choice for a growing number of nation-states to accomplish a wide variety of political objectives, with the focus of these attacks by Nobelium on human rights and humanitarian organisations," Burt added.

A hacker accessed systems belonging to a water treatment plant in the San Francisco Bay area and deleted applications the plant used to treat drinking water.

The incident happened in January but only came to light this week. According to reports by NBC News, the hackers used the username and password from a former employee's TeamViewer account to gain access to the plant and delete programs.

There is no indication who the hacker was or what their motivations were, according to a private report compiled by the Northern California Regional Intelligence Center in February.

The breach went undetected until the next day. Once plant staff noticed the breach, it reinstalled all the deleted programs and reset all employee passwords.

"No failures were reported as a result of this incident, and no individuals in the city reported illness from water-related failures," the report said.

According to some reports, the hacker "tried to poison" the area's water, but Michael Sena, executive director of the Northern California Regional Intelligence Center, told the San Francisco Chronicle there was no attempt to poison the water supply.

“No one tried to poison any of our water,” he told the newspaper. “That is not accurate”.

“It takes a lot to influence a water supply chain,” he said. “For a large impact, there has to be a large change in the chemicals in the system. The amount of chemicals it would take to cause harm to people...the numbers are astronomical.”

Joseph Carson, chief security scientist at ThycoticCentrify, told IT Pro that this highlights and reminds us how bad password hygiene is getting and how important it is for organizations to priorities password security and management.

“Organizations must help employees move passwords into the background, so they do not have to choose, remember or store passwords, using privileged access security solutions helps organizations reduces the risk of weak passwords which is a common cause of many security incidents and data breaches moving passwords into the background at the same time reducing cyber fatigue,” Carson said.

Carson added that organizations must have a solid provisioning and deprovisioning process for privileged access, especially for employees with remote access to sensitive systems.

“Companies should demand multi-factor authentication by default and integrate it into privileged access management security solutions, as this breach shows the importance of not letting a password be your only security control,” he said.

The operators behind the ransomware attack that took down the Colonial Pipeline last week claim their infrastructure has been taken offline, and that they will cease their ransomware as a service (RaaS) programme.

Last week, DarkSide hackers attacked Colonial Pipeline, forcing the operator to suspend 5,500 miles of pipeline between Texas and New York and disrupting the fuel supply to large swathes of the US east coast. They also took 100GB of data from the network before locking computers and demanding payment in a double extortion attempt.

Amid reports that Colonial Pipeline paid the hackers $5 million (roughly £3.5 million) to restore data and services, DarkSide released a statement rowing back on the attack, expressing regret, and insisting the only motive was financial, not geopolitical.

The operators have now claimed they would immediately cease operations of their RaaS scheme, issuing decryptors to all targets they attacked, alongside the promise of compensation, according to Intel 471.

The group also shared a message with their affiliates claiming that a public portion of their infrastructure had been disrupted by an unnamed law enforcement agency. DarkSide’s name-and-shame blog, ransom collection site and breach data delivery network were all seized, while funds from their cryptocurrency wallet were siphoned away.

The backlash against the Colonial Pipeline attack has spread, with another prominent group, Babuk, also stepping down from ransomware. The group handed its ransomware source code to “another team” with the aim of continuing this work under a new brand, while Babuk would continue to run a name-and-shame blog.

Meanwhile, the administrators for XSS, a widely-used Russian cyber crime forum, have announced an immediate ban of all ransomware advertising and activity, with the promotion of services or related discussions also prohibited.

An admin explained the decision by claiming there’s “too much PR”, and that the forum had “accumulated a critical mass of nonsense”, according to DataBreaches.net.

Almost immediately after, another popular cyber crime site, Exploit.in, followed suit and announced that ransomware-related chatter and activity would be banned.

Several other highly prominent groups have reacted to the fallout by announcing rule changes to their organisation, effectively clamping down on the free reign that affiliates have had in the organisation they target.

REvil, for example, has banned affiliates from targeting government, healthcare, educational and charitable organisations. All targets must also be pre-approved by the ransomware operators prior to deployment.

“Intel 471 believes that all of these actions can be tied directly to the reaction related to the high-profile ransomware attacks covered by the media this week,” the firm said in a blog post. “However, a strong caveat should be applied to these developments: it’s likely that these ransomware operators are trying to retreat from the spotlight more than suddenly discovering the error of their ways.

“A number of the operators will most likely operate in their own close-knit groups, resurfacing under new names and updated ransomware variants. Additionally, the operators will have to find a new way to “wash” the cryptocurrency they earn from ransoms.”

The FBI has used a search warrant to access Exchange servers vulnerable to the ProxyLogon exploit, copy the offending web shells for evidence, and then remove them.

According to the Department of Justice, though many infected system owners successfully removed the web shells from thousands of computers, the Feds moved to close down the shells because “others appeared unable to do so, and hundreds of such web shells persisted unmitigated.”

The FBI said the operation removed one early hacking group’s remaining web shells, which hackers could have used to maintain and escalate continued, unauthorized access to US networks.

The FBI conducted the removal by issuing a command to the server through the web shell that caused the server to delete only the web shell. Because the web shells the FBI removed each had a unique file path and name, they may have been more challenging for individual server owners to detect and eliminate than other web shells, according to the FBI.

Assistant Attorney General John Demers of the Justice Department’s National Security Division said the the malicious web shells’ court-authorized removal “demonstrates the Department’s commitment to disrupt hacking activity using all of our legal tools, not just prosecution”.

“There’s no doubt that more work remains to be done but let there also be no doubt that the Department is committed to playing its integral and necessary role in such efforts,” Demers added.

Ilia Kolochenko CEO, founder, and chief architect at ImmuniWeb, told ITPro this was a wise move given exposed web shells indicate server owners are unaware of the server or grossly negligent by having unpatched and compromised system exposed to the internet.

“Hacked servers are actively used in sophisticated attacks against other systems, amplify phishing campaigns and hinder investigation of other intrusions by using the breached servers as chained proxies,” Kolochenko said.

“Thus, arguably, such preventive removal may be considered a legitimate self-defense in cyberspace. In any case, neither hackers nor server owners will probably complain or file a lawsuit for unwarranted intrusion. What is interesting, is whether the FBI later transfers the list of sanitized servers to FTC or state attorney generals for investigation of bad data protection practices in violation of state and federal laws.”

In related news, the Cybersecurity and Infrastructure Security Agency (CISA) has ordered agencies to apply new security patches for vulnerable exchange servers. The updates mitigate significant vulnerabilities that affect on-premises Exchange Servers 2013, 2016, and 2019.

According to CISA, hackers could use these vulnerabilities to access and maintain persistence on the target host. It added the flaws are different from the ones disclosed and fixed in March 2021.

“CISA has determined that these vulnerabilities pose an unacceptable risk to the Federal enterprise and require an immediate and emergency action. This determination is based on the likelihood of the vulnerabilities being weaponized, combined with the widespread use of the affected software across the Executive Branch and high potential for a compromise of integrity and confidentiality of agency information,” a statement read.

Robert Hannigan, the former head of GCHQ, has said that there is very little evidence of artificial intelligence (AI) being used in cyber crime or terrorism.

Hannigan was speaking at an event hosted by the London Office For Rapid Cybersecurity Advancement (LORCA), where he delivered a keynote on the so-called 'myths' and 'buzzwords' around AI in cyber security.

In his opinion, while AI has transformed many aspects of modern life, it is yet to prove all that useful to state-sponsored hackers. He suggested there were not enough benefits to outweigh the "trouble" of investing in the technology for malicious purposes.

"The cyber industry is great at scare stories, and I've read lots and lots of scare stories about criminal groups and even terrorists using AI, and to be honest, I've seen virtually no evidence for this at all, with a couple of exceptions," Hannigan said. "I would say that I think it's again a confusion with automation."

He added that AI would likely form a part of a hackers arsenal in the near future, but right now it simply presented too much "risk". As an example, he cited the SolarWinds hack, which he said was sophisticated but also appeared to be "hand-curated".

"You can understand why the attackers might have wanted to do that, in order to hide themselves," Hannigan said. "And doing it at the scale, and going to the trouble of doing it through AI would probably be at high risk for them."

From there the subject of AI in cyber security flipped, with Hannigan expressing concerns about the security of AI. He said the issue was "high on everyone's list" because technologies such as driverless cars and automated medical diagnostics were rapidly becoming the norm.

"The data is a huge vulnerability, and there have been lots of studies on so-called data poisoning, adversarial models, which basically say, we can trick the machine into misdiagnosing, for example, an MIT study on chest X rays," he said.

"And if you have a malicious actor, or even an accidental actor, it is perfectly possible to see how data poisoning or incorrectly categorised data can lead the machine to do something completely wrong with potentially very serious consequences."

Prime minister Boris Johnson is set to announce a cyber security hub headquartered in the North of England.

The National Cyber Force (NCF) will be formally announced later in the week, along with the strategy behind it, as part of an 'Integrated Review' .

The review will lay out the government's approach to cyber security and will include a 'cyber corridor' across the North of England that aims to create and "sustain" thousands of jobs in defence and intelligence services.

The location of the NCF is a key element of the plans with the government hoping to drive further growth in the digital tech and defence sectors outside of London and foster wider government partnerships within the industry and universities around the region.

The NCF was first touted by the government last year and is part of its "full-spectrum approach" to cyber security. Specifically, the hub will carry out operations for interfering with terrorist mobile phone networks, monitoring cyber space for serious crimes, and keeping military aircraft safe from targeted weapon systems. It will also pull together experts from both defence and intelligence agencies under one unified command line.

"Cyber power is revolutionising the way we live our lives and fight our wars, just as airpower did 100 years ago," the PM said. "We need to build up our cyber capability so we can grasp the opportunities it presents while ensuring those who seek to use its powers to attack us and our way of life are thwarted at every turn."

The North of England already has a strong record within the defence sector, and it currently sustains more than 35,000 jobs in the north-west alone, according to the government.

Manchester, for example, has a rapidly growing tech community that's said to be one of the fastest-growing in Europe, and the city is also home to GCHQ. The government estimates that 15% of Manchester's population is employed by the digital tech sector.

Using malware as a deterrent, disrupting extremist networks and remotely disabling devices are just some of the ways the UK is fighting on the cyber front lines, the head of the country's strategic command has revealed.

General Sir Patrick Sanders discussed the UK's cyber offensive capabilities on the Sky News podcast Into The Grey Zone, which also featured insight from Jeremy Fleming, the director of GCHQ.

The key theme of the discussion was the Islamic State (Isis) with Sanders speaking in detail about the cyber offensive strategies used against the organisation. Along with the US and other allies, visible military tech has been deployed against Isis, such as warplanes and drones, but there has also been a more covert use of online attacks.

The UK's military has previously suggested the use of 'cyber offensives', but this is the first time it has publicly discussed it.

"I think it sends a really strong signal that we and our allies were not going to leave cyberspace as an uncontested place," Fleming said to Sky News.

"We have to defend it. We have to make sure it's as secure as possible. We have to make sure that it is still underpinning our commerce, our economy, our society and our communities. But equally, when adversaries like Daesh (Islamic State) overstep the line, then they need to expect us to contest it, too."

As part of its cyber campaign, the UK military targeted mobile phones and laptops, devices that Isis extremists used to communicate with their contacts on the ground. The attacks were thought to be successful by stopping senior Isis officers from sending instructions, altering the content of the messages and confusing ground troops. In some cases, the attacks lead foot soldiers into the path of UK and allied troops.

The UK also launched malware against computer servers in various countries around the world to shut down Isis accounts, delete and distort information on their files, and also to remove online posts and videos. It is thought that US cyber operators were also involved in these efforts.

The 'Friendly' use of malware by the UK military should come as no surprise to anyone, according to Chris Sedgwick, director of security operations at Sy4 Security.

"The files Edward Snowden released in 2013 highlight the immense capability that GCHQ and other countries within Five Eyes have in relation to hacking personal devices and access to our sensitive data," Sedgwick told IT Pro. "Since then the UK Military has established "77th Brigade" which aims to tackle online disinformation. However, the launching of actual malware should follow very clear legal frameworks and justifications much the same as a physical military attack."

Similarly, malware attacks have the potential for severe collateral damage, according to Mike Beck, global CISO for Darktrace.

"We saw how malware can bleed from initial targets to cause widespread destruction with WannaCry, NotPetya, and Stuxnet" Beck explained. "Cyber conflict is asymmetrical and it is much easier to attack than to defend. The rules of conventional warfare do not apply to cyber and states must strive for good defence, not just good offence."

President Joe Biden's nominations for top defense, intelligence, and homeland security positions committed to reviewing and refining cyber security operations under the new government in hearings yesterday. They testified as senators slammed the government's performance in dealing with the recent SolarWinds attack that affected numerous agencies.

Senators held confirmation hearings for Alejandro Mayorkas, nominee for Secretary of Homeland Security; Avril Haines, who Biden has chosen as his Director of National Intelligence; and Lloyd Austin, who testified for his appointment as Secretary of Defense. Between them, they addressed various issues, including the SolarWinds hack, the need to bolster internal cyber security operations, and the structure of US military cyber space operations.

Mayorkas, who was Deputy Secretary of Homeland Security in the Obama administration before returning to private legal practice during the Trump years, said the US had to do "a much better job" on cyber security.

The Department of Homeland Defense's Cybersecurity and Infrastructure Security Agency (CISA) would need to shoulder a lot of that work, Mayorkas added. He would explore two programs to see if they could stop future cyber attacks: the Einstein network security program, and the Continuous Diagnostic and Mitigation program.

Haines, former Deputy Director of the CIA under Obama, also called for strong action to shore up cybersecurity defenses in the US.

"Here at home, we must strengthen our cybersecurity, safeguard our critical infrastructure, and turn the ongoing technological revolution from a threat to an advantage by integrating new technologies to improve the capacity and superiority of our intelligence into the future," Haines said during prepared remarks.

Haines said she was committed to recruiting more people into the intelligence community, following work completed on a Trusted Workforce 2.0 initiative to reform security clearances.

Austin, who has served as head of US Central Command, said he would continue to support an offensive cyber security policy that the US government has already implemented. The Department of Defense formalized this policy, known as “defend forward,” in October 2018 as a way to disrupt enemy engagement in cyber space before they happen.

"Having an offensive capability that we're able to use is really important," he said, highlighting the need for fast action in cyberspace. "Speed matters, so anything we can do to facilitate the work of the operators is goodness." He also said that Russia needed to be held accountable for its role in the SolarWinds hack.

Austin and Haynes separately said they would review the relationship between the National Security Agency (NSA) and US Cyber Command, which have shared leadership since the latter’s creation. The idea of placing the two under different leadership has been a recurring theme among defense and intelligence officials for several years. The Trump administration proposed doing so during its final days.

Senators expressed dissatisfaction with the government's current cyber security capabilities during the hearings. Republican Senator Roy Blunt complained Congress hadn't received a report on the SolarWinds attack. Senate Intelligence Committee Vice Chairman Mark Warner said the government had to rely on a private-sector company to find out about it. "One part of the government doesn't seem to know what the other is doing," Warner said.

The EU’s law enforcement agency has spearheaded an operation taking down DarkMarket, the world’s largest illegal marketplace, and put a stop to trade worth more than €140 million (roughly £125 million).

Cooperating with the UK’s National Crime Agency (NCA) and several US law enforcement agencies, the operation led officers to switch off servers and seize the criminal infrastructure, comprising more than 20 servers in Moldova and Ukraine.

This has put an end to one of the busiest platforms for illegal trade over the dark web.

DarkMarket boasted almost 500,000 users, more than 2,400 sellers, 320,000 transactions, and more than 4,650 Bitcoin and 12,800 Monero transferred. DarkMarket mostly traded drugs, counterfeit money, credit card details, anonymous SIM cards and malware.

Europol facilitated international information exchange, provided specialist operational support, and offered advanced analytics that assisted primarily German authorities in tracking down the alleged administrator.

The takedown is made even more significant because of research published in December 2020 by cryptocurrency forensics firm Chainalysis that showed fewer dark web markets were competing for illicit online revenues.

Revenues across the wider dark web hit more than $1.5 billion (approximately £1.1 billion) as of November 2020, across nine million transactions. There were also just 37 active markets as of November, down from an all-time peak of almost 60 in February.

The dismantling of DarkMarket represents a major step for European law enforcement in its aim to foster a coordinated approach to tackling crime on the dark web. To achieve this, Europol’s cybercrime division established a dedicated Dark Web Team to work together with EU member states and law enforcement agencies across the globe to break down the underground illegal economy.

Europol has previously played a key role in taking down criminal networks, having only recently dismantled the EncroChat site, which supplied encrypted mobile phones to drug dealers and criminal syndicates. Working with the NCA, hacking the website was deemed the law enforcement equivalent of breaking the Enigma code, according to officers involved.

“Darkweb Market Places remain the primary route to buy illicit commodities such as drugs and guns online, and have continued to operate with criminals exploiting anonymising technologies and virtual currencies to avoid law enforcement," an NCA spokesperson told IT Pro.

“The NCA’s Darkweb Intelligence, Collection and Exploitation (DICE) unit supported the EUROPOL led international Darkmarket operation with specialist investigative capabilities, and will continue to work with its regional policing partners to co-ordinate the ongoing UK response.

“The Darkweb provides organised criminals a place to conduct their business using military grade encryption on a global basis. This operation demonstrates the capabilities of the NCA, UK policing and international partners to tackle this growing threat”

President-elect Joe Biden has taken a stance on the recently discovered hack of US government and private sector systems, promising to hold adversaries accountable. In a statement issued by his transition team, Biden said he had already been briefed by government officials on the attack and would make dealing with it a priority when it took office.

Biden promised to strengthen partnerships with the private sector and expand investments in cyber security infrastructure, but he also hinted at a more hawkish cyber security approach.

"A good defense isn’t enough; we need to disrupt and deter our adversaries from undertaking significant cyber attacks in the first place," Biden said. "We will do that by, among other things, imposing substantial costs on those responsible for such malicious attacks, including in coordination with our allies and partners. Our adversaries should know that, as President, I will not stand idly by in the face of cyber assaults on our nation."

In the last few days, government officials and private sector companies have discovered the scope of a massive cyber attack on US government and private sector systems. The attack, delivered via malicious code injected into SolarWinds' IT monitoring software, is ongoing, officials warned. In an update, Microsoft president Brad Smith called the incident, believed now to have been engineered by Russia, "an attack on the United States and its government and other critical institutions."

Biden has a tough job ahead of him. "This is big," said Sue Gordon, who served as principal deputy director of national intelligence in the Office of the Director of National Intelligence (DNI) until resigning from the position in August 2019, likening it to the Office of Personnel Management hack revealed in 2015. "Even bigger than that because this is public and private, and global," Gordon said, pointing out that the problem is ongoing. "This is not only problematic in terms of the information, but problematic in terms of getting rid of it."

President Trump remained silent on the hack this week. During his term as president, more than a third of his National Infrastructure Advisory Council members quit, citing "insufficient attention to the growing threats to the cybersecurity of the critical systems upon which all Americans depend."

Trump appointed Bush-era security advisor Tom Bossert to head up the administration's cyber security efforts, but the White House's John Bolton removed him in April 2018, leaving the position vacant.

In 2018, senators announced the bipartisan Cyber Deterrence and Response Act that would have forced the president to act against overseas hackers found targeting the US or explain why he hadn't. However, lawmakers failed to pass the bill.

Donald Trump’s presidential campaign website was briefly hijacked last night with attackers using the platform to claim “the world has had enough of the fake news”.

The culprits pinned a messaged to the website posing as the US Department of Justice, claiming “this site was seized” and that it was time to allow the world to know the truth, according to NBC News.

This is the second time this month that a platform belonging to the US President was compromised. Trump’s Twitter account was also breached by a Dutch researcher who correctly guessed the president’s password.

Security expert Victor Gevers claims he gained access to Trump’s direct messages, could post tweets in his name and change aspects of his profile after guessing his password as “maga2020!”, de Volkskrant reported.

In the latest security breach, hackers claimed to have information that discredited the president, as well as his family, and demanded cryptocurrency payment under the threat of releasing the material publicly. They also claimed multiple devices were compromised giving full access to Trump and his relatives, as well as internal conversations and classified intel. There's no confirming the veracity of these claims, however.

The site soon went offline before being fully restored as normal without the spoofed message. A Trump campaign spokesperson told NBC News the “website was defaced and we are working with law enforcement authorities to investigate the source of the attack”.

President Trump previously claimed “nobody gets hacked”, and that you “need somebody with 197 IQ” in order to get hacked.

Details as to how the attackers infiltrated Trump’s campaign website are scarce at the moment, although the ease with which they’ve defaced the President’s platform should raise national security alarm bells.

It’s not unusual for prominent politicians or even entire government agencies to suffer the consequences of a cyber intrusion, with attackers claiming to have compromised a NASA IT contractor earlier this year, for example.

Closer to home, the personal email account of the UK’s former international trade secretary Dr Liam Fox was compromised last year in a spear-phishing exercise, wth hackers making away with sensitive trade documents.

Critical US national security systems running Linux are being targeted with malware as part of cyber espionage campaign spearheaded by a division of the Russian military, also known as Fancy Bear or ATP28.

The Drovorub malware is targeting Linux systems operated by US national security agencies, the Department of Defense, and the US government’s industrial assets directly relevant to producing equipment for armed forces.

The malware is being deployed by the division of the GRU, also publicly known as Strontium, as part of the organisation’s cyber espionage operations, according to an advisory published by the FBI and the NSA.

The jointly-published advisory offers detailed technical information on Drovorub, guidance on how to detect the malware on infected systems, and mitigation recommendations. The malware itself compromises an implant coupled with a kernel module rootkit, a file transfer and port forwarding tool, and a command and control (C2) server.

When deployed on a Linux machine, the Drovorub client paves the way for direct communication with the C2 infrastructure, allowing for file download and upload capabilities, execution of arbitrary commands as "root", and port forwarding of network traffic to other hosts on the network. The malware also implements hiding techniques to evade detection.

"This Cybersecurity Advisory represents an important dimension of our cybersecurity mission, the release of extensive, technical analysis on specific threats," said NSA cybersecurity director Anne Neuberger.

"By deconstructing this capability and providing attribution, analysis, and mitigations, we hope to empower our customers, partners, and allies to take action," she said. "Our deep partnership with FBI is reflected in our releasing this comprehensive guidance together."

The advisory suggests that organisations running Linux systems to apply any system updates immediately, by continually checking for the latest version of vendor-supplied software. Specifically, system administrators should update to Linux Kernel 3.7 or later in order to take advantage of kernel signing enforcement.

System owners are also being advised to configure their systems to load only modules with a valid digital signature, making it more difficult for a hacker to introduce a malicious kernel module into the system.

System administrators should also activate UEFI-Secure Boot to ensure only signed kernel modules can be loaded. This would, of course, require a UEFI-compliant platform configured in UEFI native mode in Thorough or Full enforcement mode.

"For the FBI, one of our priorities in cyberspace is not only to impose risk and consequences on cyber adversaries but also to empower our private sector, governmental, and international partners through the timely, proactive sharing of information," said FBI assistant director, Matt Gorham.

"This joint advisory with our partners at NSA is an outstanding example of just that type of sharing," he added. "We remain committed to sharing information that helps businesses and the public protect themselves from malicious cyber actors."

Research from Blackberry outlined earlier this year previously identified Chinese-sponsored hackers as targeting Linux servers in order to steal intellectual property. Compromising Linux web servers in this way that these hackers had done allowed them to steal massive amounts of data disguised as conventional web traffic.

The EU has issued sanctions against individuals and organisations associated with the world’s most notorious hacks for the first time, with the aim of restricting resources and deterring them from future attacks.

Individuals highlighted by a European Council legal document face asset freezes and travel bans as part of a package of measures that comprise a fightback against some of the most dangerous cyber threats facing European countries.

This is in addition to a ban on any other individuals or companies from conducting business with or providing funds to those mentioned in the report. So far six individuals and three organisations are listed.

Those included are said to be behind the devastating WannaCry, NotPetya and Operation Cloud Hopper campaigns.

“Sanctions are one of the options available in the EU’s cyber diplomacy toolbox to prevent, deter and respond to malicious cyber activities directed against the EU or its member states, and today is the first time the EU has used this tool,” the European Council said.

“In recent years, the EU has scaled up its resilience and its ability to prevent, discourage, deter and respond to cyber threats and malicious cyber activities in order to safeguard European security and interests.”

The sanctions aim to deter cyber criminals from carrying out malicious campaigns, and follows the establishment of a framework in June 2017, giving EU member states the power to use such measures against organisations and individuals.

Gao Qiang and Zhang Shilong, as well as the Huaying Haitai Science and Technology Development Co Ltd, have been identified as being behind Operation Cloud Hopper which targeted businesses in December 2018.

IBM and HPE were reportedly among those targeted by the cyber campaign which mainly arose through a malware known as Quasar RAT, with the aim being to steal corporate secrets for competitive advantage. Huaying Haitai is charged with providing financial, technical or material support for Operation Cloud Hopper.

The special technologies branch of the GRU, the Russian armed forces, is also included in the report and has been implicated in several cyber attacks, including the NotPetya campaign. Individuals listed in the legal document, who are also members of the GRU, include Alexey Minin, Aleksei Morenets, Evgenii Serebriakov and Oleg Sotnikov.

These attacks rendered data inaccessible for a number of companies by targeting machines with ransomware in June 2017. The infamous attacks against the Ukrainian power grid in 2015 and 2016 were also as a result of NotPetya.

The WannaCry attack, which inadvertently devastated the NHS, was facilitated in-part by Chosun Expo, which provided financial, technical or material support to the hackers, according to the European Council.

The cyber crime outfit known as the Lazarus Group, or APT38, has been associated with the North Korean-linked Chosun Group by European officials.

Six former senior eBay employees have been charged with launching a campaign to intimidate and terrorise the owners of a website that was critical of the e-commerce website.

The ex-employees sent sinister items, such as a funeral wreath and a bloody mask of a pigs head, to the door of a Massachusetts couple that edited and published the online newsletter, according to a federal court.

The group targeted the couple after eBay executives became upset by the newsletters' coverage of the platform. They sent a number of strange items, including live spiders and cockroaches, and attempted to smear the couple by putting their names on pornographic material which they then sent to their neighbours.

According to officials, they also attempted to break into the couple's garage to install a GPS device on their car.

"This was a determined, systematic effort by senior employees of a major company to destroy the lives of a couple in Natick all because they published content that company executives didn't like. For a while they succeeded, psychologically devastating these victims for weeks as they desperately tried to figure out what was going on and stop it," Massachusetts US attorney, Andrew Lelling, told reporters.

James Baugh, former senior director of safety & security at eBay, and David Harville, the company's director of global resiliency, have been charged with conspiracy to commit cyber stalking and conspiracy to tamper with witnesses.

The other former employees charged are Stephanie Popp, Brian Gilbert, Stephanie Stockwell and Veronica Zea.

According to court documents, two members of the group orchestrated the plot to go after the couple because the newsletter published an article about litigation that involved eBay. It cites an unnamed executive that directed Baugh to "take her down", allegedly referring to the newsletter's editor.

The employees also set up fake social media accounts to send threatening messages to the couple and posted their names and address online to encourage people to knock on their door.

According to a company statement, eBay launched an internal investigation in August after it was notified by the police of suspicions actions by its security personnel. The employees were fired a month later.

CEO Devin Wenig also stepped down in September, citing differences with the board of directors at the time. The company didn't clarify whether its investigation played a role in his departure.

At least five critical Indian government agencies have been reportedly targeted by North Korean hackers in recent months, including its atomic regulatory board and space agency.

The Indian Space Research Organisation (ISRO) was alerted by a US cyber security company to a potential malware breach in early September, according to the Indian Express. The alert suggested that cyber criminals had infiltrated master 'domain controllers' at the Kudankulam nuclear power plant and the ISRO using the same malware strain.

The incident also may have had an effect on a failed lunar landing mission, Chandrayaan 2, which was due to touch down approximately 100 hours after the attack struck, sources who spoke with the newspaper said.

This mission was due to make a soft-landing on the Moon's South Pole on 7 September but lost contact with the earth station.

India's National Cyber Coordination Centre, similar in nature to the UK's National Cyber Security Centre (NCSC), was tipped off on 3 September about the attacks, with the power plant breach becoming public knowledge just last week.

The attackers were among at least five launched against India's critical national infrastructure, according to the founder of cyber security firm Security Brigade Yash Kadakia, speaking with the FT.

The malware strain itself was identified as Dtrak, which could allow cyber criminals to gain control over any and all infected devices. The 'domain controllers' targeted were server computers that responded to security authentication requests.

The Kudankulam plant initially said no cyber attack on its systems were possible, but the Nuclear Power Corporation of India which runs the plant conceded later that an infection had spread into the administrative network.

People within the respective agencies are reported to have opened phishing emails that were sent by the hackers, which led to the malware infiltrating agency systems.

Dtrack has been associated with activity by the Lazarus group, Kaspersky's SecureList platform suggests. The Lazarus Group has, in turn, been previously associated with the North Korean state.

A variation of the strain was last used on a widespread scale in 2018 in the form of a banking malware that targeted Indian banks. Analysis by Kaspersky showed the malware was designed to be planted on ATMs, where it could read and store information from cards inserted into the individual machines.

This attack may have been part of its 'FASTCash' scheme, identified by Symantec, through which Lazarus aimed to steal millions of dollars from ATMs across the world.

Senior government and military officials in US-allied countries were the target of a WhatsApp video hack earlier this year, it has emerged.

The hack allegedly enabled attackers to take over a users smartphone through the Facebook-owned messenger app simply by ringing the target's device, according to Reuters.

On Tuesday, Facebook launched legal action against an Israeli-based spyware firm NSO Group also known as Q Cyber Technologies which is part-owned by Novalpina Capital, a European private equity firm.

The social network accused it of providing tools to government agencies to target individuals through WhatsApp video calling.

It's alleged that the group developed Pegasus, a tool that exploited a vulnerability in the messaging app to track users. WhatsApp fixed this issue in May and began an investigation with the University of Toronto's Citizen's Lab.

"As part of our investigation into the incident, Citizen Lab has identified over 100 cases of abusive targeting of human rights defenders and journalists in at least 20 countries across the globe, ranging from Africa, Asia, Europe, the Middle East, and North America that took place after Novalpina Capital acquired NSO Group and began an ongoing public relations campaign to promote the narrative that the new ownership would curb abuses," the Lab said in a blog post.

NSO Group has said it sells spyware exclusively to government customers, however, in a statement to Reuters it said it was "not able to disclose who is or is not a client or discuss specific uses of its technology". Initially, the firm had denied any wrongdoing, saying that its products are for governments to catch terrorists.

However, it has been used to target high profile government and military officials, spread across 20 countries on five continents, according to Reuters, which cites sources familiar with WhatsApp's internal investigation. What's more, these sources said many of these nations are US allies.

WhatsApp claimed that approximately 1,400 individuals were effected by attacks launched between April and May, but these were initially thought to be just journalists and human rights activists.

30/10/2019: WhatsApp sues NSO Group for Pegasus spyware attack

Facebook has launched legal action against an Israeli spyware firm after accusing the company of providing the tools for government agencies to target individuals through WhatsApp video calling.

Pegasus, allegedly developed by NSO Group, was used between April May to attack a litany of users by exploiting a WhatsApp vulnerability in order to track their communications and even their location. WhatsApp, which is owned by Facebook, claims approximately 1,400 individuals were impacted by the attack, including a raft of journalists and human rights activists, according to court filings.

NSO Group is known for developing spyware technology for national governments and public sector agencies. WhatsApp, with the help of CitizenLab, claims NSO Group and similar companies do not have strict enough controls in place to ensure their products aren't complicit in cyber attacks.

"Some of your most personal moments are shared on WhatsApp, which is why we provide end-to-end encryption for all messages and calls by default," WhatsApp said in a blog post.

"This attack was developed to access messages after they were decrypted on an infected device, abusing in-app vulnerabilities and the operating systems that power our mobile phones."

CitizenLab claims the sophisticated Pegasus attack involved malware being installed on users phones through a number of tactics, ranging from zero-day exploits to deception. Once installed, it contacted the operator's command and control (C&C) servers to retrieve commands, and exfiltrate users' personal data.

WhatsApp claims that clients of NSO, which vary from government agencies and secret services to private companies, could at this stage retrieve any personal data harvested from targeted users.

The lawsuit claims NSO Group violated several federal acts that prohibit computer misuse, as well as violating WhatsApp's property. Facebook is seeking "reasonable damages" as a result of the claim.

"In the strongest possible terms, we dispute today's allegations and will vigorously fight them," a spokesperson from NSO said.

"The sole purpose of NSO is to provide technology to licensed government intelligence and law enforcement agencies to help them fight terrorism and serious crime. Our technology is not designed or licensed for use against human rights activists and journalists."

"The truth is that strongly encrypted platforms are often used by paedophile rings, drug kingpins and terrorists to shield their criminal activity.

"Without sophisticated technologies, the law enforcement agencies meant to keep us all safe face insurmountable hurdles. NSO's technologies provide proportionate, lawful solutions to this issue."

The company's firm stance against encryption chimes with that persistently expressed by several national governments, including the UK government.

Security agencies have long-railed against end-to-end encryption, used in WhatsApp and other platforms, as it prevents agents from accessing the private communications data of those suspected of crimes.

The Australian government even passed a controversial law against encryption in 2018, which would allow law enforcement to compel tech and telecoms firms to break their own encryption.

The long-standing request for social media firms to insert backdoors into their products, however, has been roundly rejected by developers due to risks that it would also allow cyber criminals to exploit them.

The largely unknown but somewhat predictable future of cyber threats is both fascinating and terrifying perhaps in equal measure. With Industry 4.0 on the horizon and all the new technology that's going to come with it, a brand new state of affairs is likely to greet cyber security practitioners.

There's technology emerging right now that will eventually lend its hand to the dark side of cyber; deepfake technology may well join ransomware campaigns and 5G is still scaring the pants off networking professionals. Ten years down the line, however, we can indeed expect previously fantastical ideas of cyber security threats to become reality. With Virgin Galactic planning its first trips to the surface of space next year, you can bet good money that hackers are also going to want to head to the stratosphere and beyond. So, what do the next ten years of cyber security really look like?

The space tourism opportunity

Cyber attacks will soon expand their targets to include systems located in space and the increasingly automated maritime sector, according to a according to Tony Cole, (ISC)2 board member and cyber security expert.

Virgin Galactic's recent landmark IPO may have roused the interest of every stockbroker across the pond, but it could indicate a step change in the cyber security landscape, particularly where hackers direct their nefarious attentions in years to come.

"Ten years from now, we may have somebody on Mars," said Cole to IT Pro, and thanks to the low Earth orbit technology being pioneered by Virgin Galactic, internet services are going to be beamed to those who take part in space tourism. Where there's internet, there's the possibility to hack something.

Thinking further in the future, "somebody may be FaceTiming their kids and live streaming to YouTube from Mars," said Cole. NASA TV already broadcasts numerous livestreams and interviews from the International Space Station back to Earth via the internet, so Cole thinks "we're going to see a lot of expansion in that area". He added that he thought the main opportunity for space-based cyber attacks involves disruption of services.

However, as we start to send more humans space-bound with new technology, other innovations arise to accompany it. Laser-based quantum communication, which is inherently secure, has been proven possible for years now and it's one area of research which could aim to prevent nefarious hackers from intercepting, altering or deleting data transmitted from Earth to space.

For now, speculating about the possibility of space-based cyber attacks is just that speculation. There's too much left to learn about what that world will look like to make any accurate predictions, but it's undeniably a logical next-step for hackers looking to make their CV stand out from the crowd.

Less 'up in the air'

We can better predict other methods of cyber attacks that will proliferate over the coming years and one area of concern is the maritime sector, which is digitising at a rapid rate, such as the addition of sensors to shipping containers. As the digitisation process matures, it will naturally invite unwanted attention from hackers.

"You're going to see the impact in maritime where we have crews that are much, much smaller because almost everything's going to be automated, all the containers are going to be centralised that's going to be very, very interesting," said Cole.

"Going to back to the space piece, you're going to have blanket satellites around the globe that are also able to track other ships ... then you're going to see jamming for some of these satellites, potentially." Hacking ships, the containers they carry and the databases that control where they go can result in sabotaged shipments, resulting in the downfall in the shipping company through reputational damage.

No consensus

Of course, when you ask different experts about the same questions, you're almost definitely going to get different answers, especially when it's guesswork. That's no different here and after speaking to such experts recently, IT Pro has predictably received different responses.

One of the more compelling answers relates to AI-driven malware and AI-driven defences, technology that's still far away from widespread deployment, but one of the more likely answers to the question.

For example, British universities are currently testing the idea of creating an AI that can think differently to human hackers and find new exploits in systems using methods that wouldn't come naturally to the way we think about things.

At the moment, AI-driven attacks and defences are embryonic and experimental at best "just have a conversation with Alexa, Siri or Google and [you'll see] it's not that advanced yet [and] there are billions poured in just those three," said Cole.

He also said that it's possible these kinds of attacks are currently only being used by nation-states and are in the early stages of development. But, it's "only a matter of time" before the code starts to leak underground and businesses start to feel to the wrath of malware designed to outfox AI-driven defences.

We also heard earlier this week at (ISC)2 Security Congress that IoT botnets are on the rise and are showing no signs of slowing down. This is partly due to manufacturers competing in races to get new features to market before competitors, usually at the cost of security provisions.

Others even go far as to say that politicians may start commissioning hackers to develop deepfake ransomware to tarnish the reputation of the opposition campaigners. Whatever the future of cyber security looks like, it's probably going to be a lot wilder than it is currently.

Russian hackers hijacked Iranian cyber espionage infrastructure to attack government and industry organisations in dozens of countries while pretending to be Iranian cyber attackers.

The Turla group, also known as VENOMOUS BEAR, infiltrated the systems of Iranian cyber criminals to launch attacks on Western targets, according to a joint report by the National Cyber Security Centre (NCSC) and National Security Agency (NSA).

Analysis by the two agencies revealed the Russian-linked group acquired a pair of tools associated with Iranian hackers, namely Neuron and Nautilus, as well as the data linked with it.

Turla then tested these tools against victims it had already compromised, before turning its attention towards new victims. Hackers scanned target organisations for backdoors planted by Iranian cyber criminals in order to exploit them and gain a foothold.

"The behaviour of Turla in scanning for backdoor shells indicates that whilst they had a significant amount of insight into the Iranian tools, they did not have full knowledge of where they were deployed," the NCSC said in an advisory.

"While attribution of attacks and proving authorship of tools can be very difficult particularly in the space of incident response on a victim network the weight of evidence demonstrates that Turla had access to Iranian tools and the ability to identify and exploit them to further Turla's own aims."

The volume of cyber attacks emanating from both Russia and Iran have risen substantially in recent months and years, as geopolitical tensions with the US have escalated.

Microsoft, for example, disclosed data in July suggesting that approximately 10,000 of its customers were targeted by state-sponsored attacks during the 12 months. Further analysis showed these attackers were predominately launched by five groups divided between three nations; Iran, Russia, and North Korea.

Analysis by the NCSC and NSA shows that the Neuron and Nautilus tools, deployed by Turla, were first seen deployed with the Snake rootkit on a range of victims. Followup investigations have shown inconsistencies, however, with these tools also deployed on a large cluster of victims in the Middle East, but not all in conjunction with the Snake implant.

Breaking this down further, it became clear to investigators that these victims were targeted by cyber criminals using virtual private server (IP) addresses linked with Iranian hackers. Furthermore, Iranian cyber criminals were actually the first to deploy these tools, with Turla piggybacking off them subsequently.

Turla, moreover, accessed and used the command and control (C2) infrastructure of Iranian hacking groups to launch its own attacks. The group also deployed its own implants against the infrastructure used by Iranian groups, using this to further their own access into the global operational infrastructure and to exfiltrate data.

The world has changed markedly since the widespread uptake of technology - there isn’t a single industry that has been left unaffected by the world’s transition to a more tech-assisted life.

While not an industry itself, the statement also rings true for international conflict where the days of traditional, or 'kinetic', warfare that purely takes place on land, air, and sea, are now far behind us.

The value of technology is lost on no-one and certainly not on the finest hackers on the planet who are often courted by nation-states in their ambition to build a battalion of front-line cyber security experts. This is because cyber warfare is on the rise - taking out a country’s Internet systems remotely, perhaps via a DDoS attack, is more time and resource-efficient than sending a squadron to blow up the physical infrastructure, for example.

Since technology has value everywhere, it doesn’t take a military mind to understand that the same level of disruption can be caused more easily and with less risk to life from behind a keyboard, nowadays, than it sometimes can on the battlefield.

Is anyone currently engaged in cyber warfare?

The blunt answer to this question is ‘yes’. The ongoing conflict in Ukraine, instigated by Russia’s invasion earlier this year has led to one of the most visceral examples of concurrent kinetic and open cyber warfare seen to date.

We’ve seen a string of remarkable incidents happen on the cyber side that would each in themselves merit consideration for a ‘story of the year’ award in any other, more normal and historically insignificant year.

For example, the Ukrainian government has assembled a cross-border ‘IT army’ to help fight against Russian cyber attacks - of which there have been many. We’ve also seen underground criminal outfits pledge allegiance to Russia, dedicating their nefarious services to assist the aggressors in cyber space, while foot soldiers continue to fight the war on the ground.

The situation in Ukraine aside, just about every developed country has robust capabilities in cyber space and there are a number of countries actively developing digital weapons to use in future conflicts. Russia and China are the main focal points there, but other countries that are just as active include the US, France, and Israel.

This isn't to say that these countries are using these capabilities, although we know they possess the cyber weapons themselves and have used them in the past. For example, Stuxnet was a joint venture between the US and Israel to destroy Iran's nuclear programme capability.

What weapons are used in cyber war?

The tools of destruction used in cyber attacks do bear some resemblance to weapons commonly used in other criminal attacks, in that they incur the same effect.

For example, botnets that exist to launch distributed denial of service (DDoS) attacks can target critical services and cripple entities digitally or may even serve as a diversion from other malicious cyber activities, such as attempts to infiltrate the network. Spear phishing and social engineering, too, are techniques also deployed to get cyber criminals closer to the targeted systems. Threats from the inside pose a significant risk for organisations hoping to safeguard their systems against intruders, though are highly potent as far as hackers are concerned, allowing hackers to directly expose a network to a threat, or allow a group to steal sensitive data.

One useful example of how multiple layers of attack can be used to great effect is Stuxnet, which was first encountered ten years ago. An employee situated inside an Iranian nuclear power site inserted a USB stick embedded with the Stuxnet worm, either knowingly or unknowingly, into an air-gapped system. Exploiting multiple zero-day exploits, this malware searched for specific software running centrifuges, and commanded them to spin dangerously fast and then slow for a period of months without being detected. These centrifuges eventually broke and more than 1,000 machines were rendered useless.

The attack was never successfully blamed on any known party, although it's thought that this cyber weapon was created jointly between the US and Israeli military entities. While neither nation has denied the charge, it's also alleged Stuxnet was played as part of a showreel at the retirement party of the head of the Israeli Defence Force (IDF).

However, cyber warfare can also take a more subtle form. In April 2021, MI5 issued a warning of foreign agents using LinkedIn to steal information, with more than 10,000 British nationals, including government employees, having been approached by fake LinkedIn profiles associated with hostile states. However, public sector workers aren’t the only targets: in July, the MI5’s director general warned that businesses engaged in export, scientific research, and the high-tech sector should also be aware of the potential risks of falling victim to cyber espionage. These attacks have prompted the Centre for the Protection of National Infrastructure (CPNI) to launch the Think Before You Link campaign, which warns people against accepting messages or connection requests from unknown accounts.

Other examples of cyber warfare

While Stuxnet is one of the best examples of cyber warfare in action, there are other significant events that can be attributed to state-level attacks.

The most recent example, and perhaps the most prominent in recent history, is Russian aggression towards Ukraine, which has included a sophisticated hacking element. This includes the NotPetya malware attack that masqueraded as typical ransomware but was in fact designed to destroy the systems it infected, or the BlackEnergy attack in 2015, which cut the power to 700,000 homes across Ukraine.

The UK, US, and EU have all blamed Russia for cyber attacks on Ukrainian infrastructure in the early stages of the Ukraine war, after a lengthy attribution process. This included attacks on Ukrainian government websites on 13 January 2022, which involved the deployment of the Whispergate destructive malware, as well as a 24 February attack on global communications company Viasat, which was attributed to the Russian military intelligence service (GRU).

Another nation that has been fairly active in the cyber warfare space is North Korea. Researchers have linked the country in the past to a hacking organisation Lazarus Group, which was behind the Sony hack of 2014 as well as a Bangladeshi bank in 2016.

In September 2022, the US government even managed to confiscate $30 million worth of cryptocurrency from the threat group. Lazarus had originally managed to steal the money from the token-based play-to-earn game Axie Infinity earlier in the year. This was reportedly the first time that cryptocurrency stolen by a North Korean hacking group had been seized.

During the pandemic, threat actors were also mobilising by focusing their efforts on public health providers and research facilities. This sector became a tempting target for state-sponsored cyber criminals considering how important healthcare and medical research became during the pandemic.

For example, the US Cybersecurity and Infrastructure Security Agency (CISA) and UK’s National Cyber Security Centre (NCSC) told organisations to be wary of password spraying attacks from state-backed hacking groups. The groups were reportedly focusing their efforts on pharmaceutical companies or healthcare bodies.

Even though the advisory the cyber security agencies published didn’t specifically name any threat actors, Microsoft discovered months later that healthcare companies carrying out vaccine research were being targeted by Russian and North Korean state-sponsored hackers. The groups launching the attacks were called Cerium, Zinc, and Strontium, and they targeted seven organisations, including a clinical research organisation.

Although ransomware attacks on healthcare providers can be traced back to long before the pandemic, the last year has magnified these attacks, proving that no target is off-limits for cyber criminals. Attacks on key infrastructure may severely impact the functioning of a state, but attacking hospitals can lead to much more than just financial loss. An example of such was the March 2020 attack on one of the largest coronavirus testing facilities in Czechia, which was forced to temporarily cancel surgeries and transfer new patients to other facilities as it became a target of cyber criminals. In two days after the cyber attack took place, the number of confirmed coronavirus cases in the country more than doubled to 298.

Cyber attacks and hybrid warfare

Increasingly, cyber attacks are being seen as an aspect of what's known as hybrid warfare. As explained by The Conversation, the term hybrid warfare is ill-defined and has changed in meaning over the past ten years or so since it came into use. Increasingly, however, it's used to describe the typical cyber warfare practices laid out here with efforts to disrupt democratic processes.

For example, in the run-up to an election, "Group A" may engage in efforts to alter sentiment through channels like social media while simultaneously targeting the websites of its main competitors, "Group B" and "Group C", with DDoS attacks or cyber vandalism.

Often, it won't be Group A itself that engages in these activities, but instead, it will outsource to companies that specialise in the spreading of disinformation and hackers for hire. This makes it more difficult to trace back.

This is a tactic also seen in state-sponsored cyber attacks, where countries claim an attack originates from "patriotic hackers" acting on their own terms without any persuasion or reward from the state.

Indeed, when it comes to nation-states, we can see another aspect of hybrid cyber warfare when cyber attacks are carried out alongside "kinetic attacks", which is to say traditional warfare tactics like bombs. This is similar to when, in the past, saboteurs would target critical infrastructure ahead of an invasion, only now the attacks can happen remotely.

However, the presence of cyber warfare doesn’t rule out armed conflict in the “real” world. President Joe Biden recently warned that the US could end up in a “shooting war” with a major power as a result of a cyber attack. During a visit to the Office of the Director of National Intelligence in late July 2021, Biden said that he believes that if the US gets involved in “a real shooting war with a major power, it’s going to be as a consequence of a cyber breach of great consequence”. He also went on to describe Russian president Vladimir Putin as “dangerous”, with Russia being previously accused of being behind last year’s SolarWinds cyber attack which saw hackers infiltrate the networks of hundreds of companies as well as nine US governmental agencies.

This was denied by the head of the Russian Foreign Intelligence Service (SVR), who told the BBC that he is "flattered" by the accusations from US and UK authorities, yet added that he could not "claim the creative achievements of others as his own". Nevertheless, the US responded by imposing trade restrictions on four Russian IT firms as well as two other entities over “aggressive and harmful” activities.

False flags

The only cyber weapon that is perhaps even more dangerous and disruptive than the zero-day is the false flag. We know that, for example, the attack by the so-called 'Cyber Caliphate' claiming to be affiliated to ISIS on a US military database was a false flag operation by the Russian state-sponsored hacking group APT 28. Why does this matter? Because the US retaliated with kinetic attacks on cyber communication channels and drone strikes against human targets in Syria.

Development platform GitHub is being sued for allegedly failing to prevent 100 million people's personal information from being disseminated online following the Capital One data breach.

The class action complaint, filed in California, has accused theMicrosoftsubsidiary of negligence after a dump of hacked personal data, including bank account numbers and social security numbers, was hosted on its platform for three months. It's alleged that GitHub didn't remove this "obviously hacked" data in a timely way, nor alert victims their information was posted online.

The Capital One hack, in which the details for approximately 106 million customers were stolen, was disclosed in late July, although the incident itself took place in April. The stolen information, approximately 50GB worth of data, was posted onto GitHub on 21 April, according to the filings, and remained on the platform until mid-July.

GitHub's alleged failings also extend to the enforcement of its own terms-of-service, as it did not revoke the hacker's access to the site, let alone suspend their user account, the claim states.

"GitHub knew or should have known that obviously hacked data had been posted toGitHub.com," the lawsuit claims. "Indeed, GitHub actively encourages (at least) friendly hacking as evidenced by, inter alia, GitHub.com's "Awesome Hacking" page.

"GitHub had an obligation, under California law, to keep off (or to remove from) its site Social Security numbers and other Personal Information."

The claimants' arguments also centre on comparisons with the way similar tech platforms, like Facebook and YouTube, approach content moderation. These sites often dedicate resources and staff to monitoring and removing offensive and illegal content, or content which breaches their term-of-service.

Because social security numbers are readily identifiable, generally following a nine-digit sequence, GitHub should have, but chose not to, dedicate time and resource into scanning its platform for such information, it has been argued.

Following the beach disclosure, further research by Israeli firm CyberInt revealed a host of other large organisations could have been struck by the same hacker. These businesses include Vodafone and Ford.

"GitHub promptly investigates content, once it's reported to us, and removes anything that violates our Terms of Service," a spokesperson toldIT Pro.

"The file posted on GitHub in this incident did not contain any Social Security numbers, bank account information, or any other reportedly stolen personal information.

"We received a request from Capital One to remove content containing information about the methods used to steal the data, which we took down promptly after receiving their request."

The USA's National Security Agency (NSA) is setting up a cyber security division with a specific focus on guarding the country against attacks from foreign adversaries like North Korea and Iran.

The organisation, which is tasked with overseeing America's cyber security operations, will establish a group dubbed the Cybersecurity Directorate with the aim of unifying foreign intelligence and cyber defence missions, according to CNN.

This new directorate, which has an exclusive focus on defence, is being formed amid rising geopolitical tensions with countries like Iran, against which the US was widely reported to have launched a cyber attack in June.

The group will be led by the NSA's lead investigator on election fraud, Ann Neuberger, and will become operational from 1 October.

"This new approach to cyber security will better position NSA to collaborate with key partners across the US government like US Cyber Command, Department of Homeland Security, and Federal Bureau of Investigation," the NSA said.

"It will also enable us to better share information with our customers so they are equipped to defend against malicious cyber activity."

The NSA is renowned for its focus on offensive cyber capabilities and also gained notoriety for its role in devising a series of programmes to orchestrate mass data gathering, as revealed by the Edward Snowden leaks.

Most recently the organisation was indirectly linked with a devastating hack on the government of Baltimore. Researchers learned the tool used to shut down the government and lock people out of essential services, dubbed EternalBlue, was developed by the NSA and used by cyber criminals.

This additional focus on defence reflects a time of heightened tensions across borders, not just between the US and Iran, but with China too.

Both nations, as well as North Korea, have been linked with a handful of known cyber gangs. The NSA's decision to create a defence-centric unit comes as the scale and severity of cyber attacks continue to rise.

Microsoft has revealed that approximately 10,000 of its customers were the target of a state-sponsored attack, or even compromised by a foreign power, over the last 12 months.

As organisations and politicians gear up for the US presidential race in 2020, the firm published data showing that enterprise customers make up 84% of those targeted. The vast majority of these groups are based in America, while the remaining 16% are consumer personal email accounts.

Those targeted are mostly connected with the essential functions of democracy, like think tanks or non-governmental organisations (NGOs), and tend not to have the resources to defend against cyber threats of this scale, the firm added.

Data has also revealed that attacks are being launched by five main groups spread across Iran, Russia, and North Korea, according to Microsoft's Threat Intelligence Centre. Holmium and Mercury operate from Iran, while Yttrium and Strontium run campaigns from Russia. The most prominent North Korean group on the company's radar is dubbed Thallium.

"While many of these attacks are unrelated to the democratic process, this data demonstrates the significant extent to which nation-states continue to rely on cyberattacks as a tool to gain intelligence, influence geopolitics or achieve other objectives," said Microsoft's corporate vice president for customer security and trust Tom Burt.

"Many of the democracy-focused attacks we've seen recently target NGOs and think tanks, and reflect a pattern that we also observed in the early stages of some previous elections.

"In this pattern, a spike in attacks on NGOs and think tanks that work closely with candidates and political parties, or work on issues central to their campaigns, serve as a precursor to direct attacks on campaigns and election systems themselves."

Cyber attacks have become a preferred method for spreading economic disruption in recent years compared to traditional tools like economic sanctions or deploying military units, particularly as an attack can be launched with relative ease and without necessarily exposing the attacking country to immediate international attention. This has been highlighted most recently by rising tensions between the US and Iran.

Russia, meanwhile, was found to have interfered with the 2016 US election, and subsequent public votes, like the 2018 US mid-terms or even the French parliamentary elections in 2017 were shrouded in fears of meddling with electronic ballots.

Microsoft showcased its new ElectionGuard technology at the Aspen Security Forum this week, a secure voting machine that the company hopes will prevent manipulation of voting records in future elections.

The system works by giving voters a tracking code when they cast their ballot, which they then enter into an election website to verify their identity, and confirm whether or not their vote has been tampered with.

Encryption will be deployed, moreover, to allow the counting of votes without revealing to any user what those votes are. The machines will also print physical copies of voters' ballots to drop into traditional voting boxes.

The company is planning to release the software behind the technology as open-source on GitHub later in 2019, rather than commercially release its own voting machines.

Law enforcement agencies will soon have access to a tool that can breach a raft of the latest flagship smartphones including the most recently-launched iPhone models.

Using a newly launched tool, developed by data extraction firm Cellebrite, organisations like the FBI and MI5 will be able to breach any iOS device and a host of high-end Android handsets.

At a time where tech manufacturers are placing a greater emphasis on user privacy, the UFED Premium tool can be used to perform full file system extractions on their flagship devices.

Law enforcement agencies can then gain access to third-party app data, chat conversations, downloaded emails and email attachments, as well as deleted content. Moreover, the tool's developers promise to "increase your chances of finding the incriminating evidence and bringing your case to a resolution".

Smartphones vulnerable to UFED Premium include the Samsung Galaxy S6 through to S9 models, as well as "popular device models" from Motorola, Huawei, LG and Xiaomi. The tool also supports all Apple devices running iOS 7 to iOS 12.3.

With UFED Premium, law enforcement agencies can determine passcodes and perform unlocks for all Apple devices, as well as make use of sophisticated algorithms to minimise unlock attempts. Android devices, similarly, can be bypassed with ease, with users then accessing unallocated data to maximise the chances of recovering deleted items.

As an 'on-premise' tool, law enforcement officers can use the UFED Premium to extract data and infer results without the need to use any additional Cellebrite services, meaning it can be deployed at their discretion.

But the company has given clients the option of using in-house services, provided by certified forensic experts, to gain access to evidence from locked, encrypted or damaged devices using in-lab only techniques.

Apple and other smartphone manufacturers have begun placing a much greater emphasis on user privacy and information security in their marketing to consumers. This has come at a time where the EU's General Data Protection Regulation (GDPR) hit mainstream consciousness, and large-scale data breaches regularly populate newspaper headlines.

The likes of Facebook and Google, for example, have also come under heavy public scrutiny for allegations of disregarding user privacy, the former in particular given the scale of the Cambridge Analytica scandal.

Manufacturers, therefore, are unlikely to approve of a tool that can be harnessed to break a fundamental component of their sell to the market. The conflict this could spark between tech giants and governments bears similarity to that which exists over end-to-end encryption.

The UK government, in particular, has been especially vocal about the need for tech giants to compromise the absolute privacy that end-to-end encryption offers. This is because, as politicians and law enforcement agencies argue, this allows criminals to organise freely through social networks, such as WhatsApp, that use encryption.

AMC's Mr. Robot is a modern Robin Hood tale about a gang of hacktivists taking on a morally reprehensible multinational corporation. The show has garnered particular attention for the authenticity with which it portrays hacking and cybersecurity, and showrunner Sam Esmail went to great pains to make sure all of the hacks shown in the series were plausible and realistic up to a point.

James Plouffe, a strategic technologist at MobileIron, was one of many cybersecurity industry practitioners that Esmail brought in to advise the writers on the technical elements of fsociety's hacks and exploits. According to Plouffe, there was some debate among the show's writers and technical experts as to exactly how true to life the fictional anarcho-hacker collective's exploits should be.

"You wanted to get it right, but not right enough that someone could copy," he explained in an interview with IT Pro. "And I don't want to spoil it for folks who haven't seen some of the things that take place in season three, but I remember kicking around some of the ideas to make certain things happen. And there was this debate between those of us who are working as tech consultants about whether or not it was technically feasible, and a little bit of research suggested that it was."

"There were some folks on the side of 'we want to make this hyper accurate'. And my position was, for the safety of total strangers, let's maybe fudge the math a little bit, so that it doesn't become a public safety issue."

It's hard to argue Mr. Robot hasn't had a huge impact in the cybersecurity industry in the years since it first hit screens; various hackers (including black, white and grey hat varieties) have already begun adopting the show's iconography as part of their public personas.

For Plouffe, it's gratifying he gets to be a part of something that resonates so deeply with the cyber security community: "I appreciate it, in the sense that it was great to be part of something that I would have wanted to watch."

He also hopes that seeing the reality of cyber attacks as portrayed in Mr. Robot has helped contextualise cyber security issues for members of the general public, and raise awareness of threats.

"All the things that happened in Mr. Robot are practical, are based on real things. When you see them log into a firewall console, that's actually a piece of Cisco hardware that's been mocked up. So if anything, I hope that people see that the issues are real," said Plouffe.

"A lot of the activities in Mr. Robot hinge on pretty basic stuff, like getting people to do something dumb; pick up a USB drive in a parking lot, take a free CD from a musician, you know, social engineering stuff. Stuff that we're all susceptible to, potentially. I think people can understand those. And hopefully, it also underscored the ease with which some of that can happen and makes people think twice."

Despite myriad benefits businesses have accrued from technological leaps, bad actors are finding it easier and cheaper than ever before to abuse the internet by stealing trade secrets and spread disinformation.

Collaboration between the institutions we rely on and private sector organisations is critical, according to former US secretary of state Dr Madeleine Albright, because non-state actors now own swathes of the physical infrastructure the internet is built on.

If private sector tech firms and non-governmental organisations (NGOs) aren't let in on conversations around how to combat emerging cyber threats at a state-to-state level, they will begin to crumble as cyber threats continue to evolve, she argued.

"Of course the technological revolution has been an incredible gift in several ways," Albright told delegates during a special address at this year's Citrix Synergy, "but we still don't know whether information technology is simply the latest in a line of advances that have helped to modernise the world without doing much to civilise it.

"I hardly need to describe for this audience how bad actors, whether governments or criminal groups, have taken advantage of the internet to pilfer trade secrets, surveille critical infrastructure and cause economic or even physical damage."

As a means of showing how quickly the world has changed in a short space of time, Albright revealed that she didn't even have a computer on her desk, let alone an email address, when in office.

Emerging cyber threats, like state-sponsored disinformation campaigns, were quite simply not something Albright had to concern herself in her role as secretary of state.

"The cyber threat that has continued to evolve is something we need to keep looking at," she continued.

"For all the warnings that were issued for a cyber Pearl Harbour, it appears now that the most immediate threat are attacks that are harder to deter because they stop short of what we would consider an act of war."

In recent years, enemies have become skilled at abusing social media platforms to pollute users' feeds with rumours and disinformation, as well as anti-democratic propaganda. She also cited Russian television adverts that warn viewers that 5G wireless technology could kill you.

This form of cyber warfare is running rampant among forces not just within Russia, but the likes of China, North Korea, Venezuela and Turkey, as well as extremist groups littered across the world.

To fight this global issue, which is akin to "assembling an airplane while already in the air", businesses must follow the lead of firms like Microsoft, which has spearheaded joint-efforts with NGOs and other companies to create 'rules of the road' to protect digital society.

"Of course I'm not saying that we should put non-state actors at every decision table," she added. "But the international system needs to adjust to the impact of these agents of change and they need to be there at the beginning of decision-making and not just to pick up the pieces."

Any such efforts to engage in discussions and share best practice, led by businesses in the international interest, would be crucial to preventing a cyber arms race between nations.

Researchers have discovered that LoJax, the malware that formed the foundation for devastating Fancy Bear attacks in 2018, has been silently active for years.

Use of this infrastructure by the Russian-linked hacking group was exposed in September 2018, just a few months after the LoJax servers were first discovered by security researchers in May.

LoJax was last year found to be incorporated as part of a Fancy Bear Unified Extensible Firmware Interface (UEFI)-based rootkit, which meant LoJax was resistant to hard drive replacements and operating system re-installs.

But a NETSCOUT team of ASERT security researchers have found that LoJax may have been alive in the wild since 2016, by tracing its fingerprint, also learning there still remains two active command and control (C2) servers.

"Continued diligence in tracking activity related to LoJax proved that the actors still maintain live C2 servers," the researchers summarised in a blog post.

"They may also have additional ongoing operations outside the 'in the wild' use reported by ESET activity. Even with all of the publicity around Lojax, Fancy Bear operations did not take the publicly disclosed servers offline.

"Because these C2 servers have a long shelf life, organizations should ensure they incorporate the IOCs [indicators of compromise] into their defensive posture. This longevity underscores the importance that LoJax C2s remain in active defense postures for longer periods of time."

The team used intelligence gathered from a known LoJax C2 server to build a network-scanning fingerprint. They used this to search for additional LoJax servers, and discovered seven in late-2018. Of these seven, two were subsequently deemed to still be active.

The researchers used DNS records to cross-reference the servers with known LoJax samples, and found the LoJax C2 server had ties to two domains, regvirt.com and elaxo.org.

NETSCOUT determined when LoJax first became active by examining domain registration information for when confirmed and suspected domains first came online. Beyond a minor flurry in 2004 and 2006, the cyber security firm detected a massive spike in late 2016.

The findings raise questions as to what the LoJax infrastructure was used to accomplish, and how successful it was before it was first publicly-exposed in 2018. Moreover, NETSCOUT says the rootkit doesn't look like an isolated incident or one-off attack aimed at a specific group of targets.

An ASERT security researcher told IT Pro the LoJax domain names were likely picked to blend in as best they can with a target organisation's network traffic, and were not necessarily mapped to an organisation's sector.

"Why an organization might be targeted varies as the priorities may shift during the course of an operation, but in general Lojax makes for a good beacon for device tracking along with executing code sent by the command and control server," they said.

"Fancy Bear remains highly active in the cyber landscape. Regardless, if the business is the primary target of the actor or not, the business may still be targeted due to their connections. Businesses should remain vigilant against cyber-attacks and in particular phishing attempts which account for the majority of network compromises."

The infamous Russian hacking group previously used the LoJax rootkit to breach and seize control of government systems in September last year. The same rootkit is also claimed to be part of a campaign run by the Sednit group against high-profile targets in Central and Eastern Europe.

There's no such thing as a quiet year when it comes to security, but 2018 has been particularly eventful. From systemic CPU vulnerabilities to hacks affecting hundreds of millions of people, the last twelve months have been a seemingly non-stop parade of cyber gaffes and security blunders. Here's our pick of the year's biggest and most embarrassing security snafus.

Meltdown & Spectre

The hardware world was rocked at the start of the year by the discovery of a series of major vulnerabilities affecting virtually every Intel processor produced in the last twenty years, as well as AMD and ARM chips. The flaws allow for data exfiltration and snooping, making them a particular concern for businesses.

It's currently unknown whether or not Meltdown and Spectre are being exploited in the wild to target victims, but the widespread impact of the issues make it likely that it will play an ongoing role in future breaches as unpatched systems inevitably fall victim to Meltdown and Spectre-based exploits.

Google Plus unceremoniously axed

Google Plus, the company's oft-derided rival to the likes of Twitter and Facebook, met an early (although arguably not untimely) demise towards the end of the year, after Google discovered a massive data leak in the service's APIs that affected the personal data of up to 500,000 users.

To add insult to injury, a second security flaw was discovered earlier this month this time affecting more than 52 million users and forcing Google to shutter the platform four months earlier than it had originally intended to. An ignominious end for one of Google's least successful projects.

Marriott's unexpected Chinese visitors

The Marriott hotel chain found itself with some unexpected guests this year, after it discovered that hackers had been squatting on its network for at least four years. To be specific, it was the hotels in Marriott's Starwood Group which were affected, including prestigious chains like the Sheraton, Westin and W Hotels.

Hackers may have accessed the information of up to 500 million guests, including passport numbers, phone numbers and email addresses. According to investigators, the hack may haveeven been part of a Chinese espionage operation.

British Airways flies into trouble

Towards the end of this year, British Airways announced two separate hacks on their systems, resulting in a total of 565,000 customers having their data stolen, including payment data and personal information. Given the sensitive nature of the data handled by airlines, this breach was a particularly egregious one.

It was made all the more egregious by the possibility that BA itself may have inadvertently introduced the vulnerability that led to the hack. As Barry Collins revealed, BA's rush to address the complaints about its data gathering raised by security researcher Mustafa Al-Bassam may have accidentally led them to introduce a flawed script. Oops...

Equifax pays the piper

It's remarkable how quickly we all seem to have forgotten about Equifax, the company that let the personal data of 146 million users across the globe get stolen out from under its nose. Although US citizens were the worst affected, brits also fell victim to the breach, with some 15 million UK users affected.

Although the breach was disclosed last year, the company has only started to feel the full ramifications of its failing relatively recently. It was slapped with a top-level 500,000 fine by the ICO, and the US government pointed the finger of blame squarely at ex-CEO Richard Smith, claiming it was his aggressive expansion strategy that led to the breach in the first place.

Apple's blunder down under

It's one thing to get hacked, but getting hacked by a bored Aussie teenager is something else entirely. That's the fate that befell Apple, after a Melbourne private schoolboy exfiltrated 90GB of secret data from the company's servers. A rather embarrassing gaffe for a company that prides itself on the security of its products.

This breach feels comfortably nostalgic, harking back to the teenage hackers of the 90s, rather than the Russian gangsters and state-funded cybercriminals that we're more familiar with today. The young hacker told courts that he hacked the company because he's such a big fan, and he stored all his custom-built intrusion tools in a folder labelled 'hacky hack hack'. That's faintly charming somehow.

Reddit? Hackedit.

Social media platform Reddit is no stranger to controversy, and it made headlines yet again this year after announcing that an attack on its SMS-based two-factor authentication system (which the company admitted was "not nearly as secure as we would hope") led to hackers making off with a huge cache of data from between 2005 and 2007.

The attackers gained access to among other things current email addresses, old salted and hashed passwords and internal Reddit data such as config files, logs, source code and more. A relatively minor breach as far as the impact on users goes, it was another setback for an embattled company that has weathered more than its share of storms.

Dixons Carphone phones in its security

Dixons Carphone has had a rough year. The parent company behind Carphone Warehouse and Currys PC World has recently announced a 440 million loss, and back in June the company announced that it had been the victim of a breach which saw 10 million customers' records stolen.

Dixons Carphone should be bracing itself for another fine from the ICO at some point in the future; it was hit with a 400,000 fine in January this year for a breach that occured in 2015. That breach only affected three million people, though, and occured before the advent of GDPR. The fine for this year's incident could well be significantly higher.

Government's counter-terror Trello leak

It's commonly said that the only things that are certain in life are death and taxes, but there's a strong argument for adding 'government IT blunders' to that list. In one of the most embarrassing screw-ups of the year, the government accidentally leaked sensitive information via project management tool Trello.

In yet another case of a lack of authentication coming back to bite a forgetful admin, a Trello board including anti-terror tools, contact details for top civil servants and guides for accessing government buildings was left publicly accessible via Google search. An even more concerning detail is that this information may have been accessible for up to four years.

Zuckerberg gets egg on his Facebook

Between the Cambridge Analytica scandal, Russian information warfare and a series of painfully awkward congressional hearings, Facebook has finally started attracting the attention of lawmakers, and not in a good way. It seems the company has a slight problem with preventing exploitation of its platform, which was highlighted by the theft of 30 million users' access tokens a few months ago.

These tokens allowed attackers to access a range of personal information from victims' Facebook profiles, including contact details and, in some cases, location information and search history. Three million EU users were affected in the breach, so it's a virtual certainty that the company will have a rather hefty GDPR fine to deal with at some point.

Hardware manufacturer Supermicro has released the findings of an audit showing no evidence that malicious chips have been inserted into its widely-used motherboards.

Concerns were sparked after a Bloomberg report in October alleged Chinese operatives had been conducting covert surveillance on major firms such as Apple and Amazon by inserting spy chips' onto Supermicro's motherboards.

But the firm has now shared the results of a "thorough investigation" of its hardware conducted via a third-party investigations firm and has concluded its chips have not been infiltrated by any threat actors.

"After thorough examination and a range of functional tests, the investigations firm found absolutely no evidence of malicious hardware on our motherboards," Supermicro's president and CEO Charles Liang said in a letter to customers.

"These findings were no surprise to us. As we have stated repeatedly, our process is designed to protect the integrity and reliability of our products."

After the allegations first emerged, both the US Department for Homeland Security (DHS) and the UK's National Cyber Security Centre (NCSC) backed up Supermicro's statements, each suggesting there were no reasons to doubt the denials.

But the statements came after no official investigation had taken place, with the findings of the newly published security audit, conducted by a third-party company, the only examination of Supermicro's hardware since the reports emerged.

"As we have stated repeatedly since these allegations were reported, no government agency has ever informed us that it has found malicious hardware on our products," Laing continued.

"No customer has ever informed us that it found malicious hardware on our products, and we have never seen any evidence of malicious hardware on our products.

"Today's announcement should lay to rest the unwarranted accusations made about Supermicro's motherboards. We know that many of you are also addressing these issues with your own customers."

The investigations firm tested a representative sample of Supermicro's motherboards, including the specific motherboard Bloomerberg referenced in its initial report, motherboards bought by companies referenced in the article, and more recently manufactured hardware.

Supermicro has also said there is a range of safeguards in place to ensure it's difficult as possible to release motherboards that have been tampered with or infiltrated by threat actors, Chinese or otherwise.

A new version of the infamous Stuxnet worm has been used to attack Iranian government networks, according to reports.

The famous malware has apparently re-emerged, with Israeli news programme Hadashot stating that Iran "has admitted in the past few days that it is again facing a similar attack, from a more violent, more advanced and more sophisticated virus than before, that has hit infrastructure and strategic networks".

Iranian General Gholam Reza Jalali also confessed that "recently we discovered a new generation of Stuxnet which consisted of several parts... and was trying to enter our systems," according to the Islamic Society of North America.

Iran has not specified which networks were attacked, or how successful the attack was. It has also not named any suspects as to who orchestrated the attack.

Stuxnet first made headlines in 2010, when the malware was used to target Iran's nascent nuclear sector. It marked one of the earliest uses of malware in nation-state attacks, and was widely-hailed as the first example of malware specifically designed to attack industrial control systems.

The first Stuxnet attack is widely believed to have been carried out as a joint operation by US and Israeli intelligence agencies, with the goal of derailing the development of Iran's nuclear weapons programme. The Israeli government has, according to Hadashot, remained silent on its potential involvement in the latest attack.

Stuxnet used no less than four zero-day exploits in its original form, and was used as a basis for creating further strains of malware than have been used by cybercriminals for the past eight years, including Duqu, Flame and Gauss.

"Now, over 22 million pieces of malware use that blueprint to attack organisations and states alike across the world," said Broderick Perelli-Harris, senior director of professional services at security firm Venafi.

"It's easy for organisations and governments to ignore when it's used against an adversarial state, but the blueprint remains 'in the wild' for cybercriminals to exploit. The new Stuxnet reminds us that governments need to think very carefully when they are creating cyber-arms, so that they do not escalate the problem. Cyber weapons are much more prone to proliferation and almost impossible to control, it's nave to think we can."

The National Cyber Security Centre (NCSC) has been thwarting more than 10 cyber threats per day, on average, according to its annual review, but it's still warning that something bigger is looming.

Despite preventing over 1,000 cyber attacks in its two-year history, the NCSC's CEO Ciaran Martin said that the UK will face a real test of its security infrastructure soon enough.

"Although the UK is making significant progress in improving our cybersecurity, that does not mean that we are getting everything right, or that the threat is abating," Martin said.

"Proof of that, if it were needed, is that in the two years of our existence the NCSC has dealt with well over 1,000 cyber security incidents.

"The majority of these incidents were, we believe, perpetrated from within nation states in some way hostile to the UK. They were undertaken by groups of computer hackers directed, sponsored or tolerated by the governments of those countries."

These groups constitute the most acute and direct cyber threat to the UK's national security, according to Martin.

"I remain in little doubt we will be tested to the full, as a centre, and as a nation, by a major incident at some point in the years ahead, what we would call a Category 1 attack."

A category one attack is the most serious of six-levels of cyber attack classification, which is defined as an attack that causes sustained disruption of essential services or affects national security to the extent that it results in severe economic or social consequences or even loss of life. A category one attack is the only classification ministers and cabinet members must be strategically involved in.

According to the NCSC, there have been several very significant incidents, but the UK has avoided a Category one. However, some of its foremost international partners have not. A known example of a category one incident is the alleged assault on the US national elections in 2016 by Russian state-sponsored agents.

Earlier this year the NCSC published evidence of Russian pre-positioning on some of the UK's critical sectors, along with detailed technical guidance for business, but according to Martin, it's not just Russia the UK needs to worry about.

"These attacks have come from a range of states, as well as many non-state sources. There is much, much more to the cybersecurity threat to the UK than just Russia," he said.

The UK, US and the Netherlands have accused Russia of being responsible for a spate of global cyber attacks, with seven people being charged by the US.

The charges against the seven include conspiracy to commit computer fraud, conspiracy to commit wire fraud, aggravated identity theft and conspiracy to commit money laundering.

Four the seven were the men expelled from the Netherlands having after being caught attempting a cyber-attack on the headquarters of the international chemical weapons watchdog, which was disrupted by Dutch military intelligence.

The hack was thwarted with the aid of British intelligence officials and on Thursday the UK government accused the Kremlin of violating international laws with "indiscriminate and reckless cyber attacks".

The NCSC said it has assessed with high confidence that the GRU has almost certainly been conducting attacks under various aliases, such as Fancy Bear, Sednit and APT 28.

The NCSC has blamed the GRU for attacks such as the 2017 WADA email leak, which saw the identities of 28 football players who had received a Therapeutic Use Exemptions (TUEs) released online.

The Kremlin has also been accused of the 2017 'Bad Rabbit' ransomware that encrypted hard drives and rendered IT inoperable, resulting in mass disruption to services including the Kyiv metro, Odessa airport, Russia's central bank and two Russian media outlets.

The NCSC also said, with high confidence, that the Kremlin was also responsible for hacking the Democratic National Committee (DNC) in 2016, which also affected the US presidential election of the same year.

Now, Seven Russian government operatives have been charged by the FBI with hacking into the computer networks. According to the indictment, starting in 2014, the defendants, who worked in for the GRU, engaged in "persistent and sophisticated criminal cyber intrusions".

The seven men appear on a wanted poster released by the FBI

In the past week, the Fancy Bear group has been implicated as being responsible for a series of attacks on government entities using the 'LoJax' malware, a new strain that exploits the Unified Extensible Firmware Interface (UEFI) on modern computers and is almost impossible to remove.

SonicWall CEO Bill Conner, has previously advised both the UK and US governments on cybersecurity, has called for global cooperation to fight the growing threat of international cyber attacks.

"Whether it's elections, tariffs or natural disasters, countries currently tend to operate independently. However, the cyber landscape, with its non-existent borders and limitless boundaries, is forcing us to work together in new ways.

"The announcement by the UK government highlights a growing need for public and private sectors around the world to work together to detect, defend and dissipate the rising volume and ferocity of cyber attacks."

GCHQ will create an offensive cyber unit to fight the growing wave of national security threats Britain faces from around the world.

A partnership between the Ministry of Defence (Mod) and the UK's intelligence organisation will see the government committing more than 250 million with 2,000 individuals deployed to orchestrate offensive actions.

According to The Times, the rising cyber threat from nations such as Russia and Iran, as well as terrorist groups like ISIS, will see experts brought in from the military, security services, and the cyber security industry.

"The MoD and GCHQ have a long and proud history of working together," a government spokesperson told IT Pro. "We are both committed to continuing to invest in this area, given the real threats the UK faces."

The new force, expected to be announced soon, will represent a step change in cyber strategy from a more defensive outlook to an offensive one. Targets on the list include rogue nations, extremist groups, and people-traffickers as well as paedophile rings.

The formation of this unit follows a review ordered by defence secretary Gavin Williamson, and has been given the working name "joint cyber-force". It'll see a quadrupling in manpower allocated towards offensive actions - and comes just five months after GCHQ revealed it had conducted its first successful cyber attack on ISIS.

In his first speech as GCHQ director in April, Jeremy Fleming confirmed the massive offensive action which was orchestrated last year systematically degraded the extremist group's online infrastructure.

"Daesh's ability to inspire, direct and enable attacks, and the simple tactics they use make stopping attacks much, much harder," Fleming said. "But the UK's CT team - led by MI5 and the Police, supported by GCHQ, MI6 and the Military - is evolving fast to match this threat."

He continued: "These operations have made a significant contribution to coalition efforts to suppress Daesh propaganda, hindered their ability to coordinate attacks, and protected coalition forces on the battlefield.

"But cyber is only one part of the wider international response. This is the first time the UK has systematically and persistently degraded an adversary's online efforts as part of a wider military campaign. Did it work? I think it did."

The threat faced by nations such as Russia not only manifest as incidents such as the Salisbury poisoning but a number of aggressive cyber events like the alleged hacking of the 2016 US presidential election.

The nation has also been accused of polluting public discourse in the West after research last month revealed the rise in anti-vaxx conspiracy theories circulating online can be pinned on Russian-originating botnets.

Unlike conventional botnets, used to spread malware, these networks served as 'content polluters' to disseminate fake news and erode public trust in the scientific establishment.

"This announcement highlights the growing need for more cyber-savvy workers in the UK, to secure our future at a national, organisational and personal level," said CEO of Cyber Security Challenge UK Colin Lobley.

"While many people are still unsure of what a career in cyber security would look like, the reality is that many of these jobs require similar skills and knowledge to more known careers.

"For example, we need architects to build secure networks, lawyers to process cybercrime cases, psychologists to assess how human behaviour influences security, as well as military roles to act against national threats."

IT Pro approached GCHQ for comment but did not get a response at the time of writing.

The US Department of Justice has formally charged a North Korean government hacker with a series of major cyber attacks, including the Sony Pictures hack, the theft of $81 million from the Bangladesh Bank and the WannaCry ransomware.

The charges have been filed against North Korean programmer Park Jin Hyok, who the US claims was working as part of a North Korean government-backed hacking operation known commonly as Lazarus Group.

Park, who was educated at a North Korean university, spent a number of years employed by Chosun Expo Joint Venture, a company that is used as a front by the North Korean government and is allegedly used to fund a government cyber espionage division known as 'Lab 110'.

Through an elaborate network of dummy email addresses and social media accounts, network infrastructure paths and IP addresses, investigators say they have managed to link Park and a number of unnamed co-conspirators to key hacks - most notably, the WannaCry ransomware that temporarily crippled the NHS and caused global chaos.

Park and his colleagues were also linked to the 2014 attack on Sony Pictures, which saw caches of internal emails - as well as whole unreleased films - leaked online in retaliation for the release of Seth Rogen and James Franco's film The Interview, which mocks North Korean 'Supreme Leader' Kim Jong Un.

"The scope and damage of the computer intrusions perpetrated [by Park and his allies] is virtually unparalleled," said FBI Special Agent Nathan Shields as part of a sworn affidavit. "The attacks and intrusions described...would have each required the efforts of a well-resourced team of persons working in concert, each performing different tasks.

"The technical evidence... shows that those attacks and intrusions were carried out by a group of persons with access to the same email and social media accounts, computer infrastructure, and source code. Tracing connections back through the operational infrastructure reveals numerous connections between Park, his true-name email and social media accounts and the operational accounts used to conduct the cyber attacks."

While both the UK and the US have publicly blamed North Korea for unleashing WannaCry, this marks the first time that the US government has formally charged an operative of the Democratic People's Republic of Korea for hacking. It follows similar charges which have been levelled at Russian, Iranian and Chinese hackers over the last few years.

While it has no bearing on his own legal battle, the news has been greeted warmly by British malware researcher Marcus Hutchins. Hutchins was the one who discovered the 'kill-switch' that was built into WannaCry, effectively halting the malware's devastating spread.

Although the US government has not charged him with any involvement in the creation of WannaCry, the allegations that he was involved with the Kronos banking Trojan has led some to accuse him of being part of WannaCry as well.

"Law enforcement agencies and government officials around the world are challenged by the internet's invisible borders and its nameless perpetrators when it comes to pursuing or charging cybercriminals," said SonicWall CEO Bill Conner.

"While almost four years have passed since the communications giant sent notifications of its attacks, the U.S. Justice Department's actions are commendable and should serve as a reminder for consumers and organizations alike to remain vigilant."

The 'Five Eyes' governments of the UK, US, Canada, Australia, and New Zealand have challenged tech companies to voluntarily create backdoor access to their systems, or be compelled to by law.

Encryption, deployed by companies such as WhatsApp and Google to guarantee user privacy, poses a significant challenge to combating serious crimes and terrorism, the five nations' interior ministers agreed at a two-day summit on Australia's Gold Coast last week.

"Encryption is vital to the digital economy and a secure cyberspace, and to the protection of personal, commercial and government information," the five ministers, including the UK's home secretary Sajid Javid, said in a joint statement.

"However, the increasing use and sophistication of certain encryption designs present challenges for nations in combating serious crimes and threats to national and global security.

"Many of the same means of encryption that are being used to protect personal, commercial and government information are also being used by criminals, including child sex offenders, terrorists and organized crime groups to frustrate investigations and avoid detection and prosecution."

If the industry does not "voluntarily establish lawful access solutions to their products" the statement continued, "we may pursue technological, enforcement, legislative or other measures" to guarantee entry.

The Five Country Ministerial (FCM), which concluded this weekend, also saw the five nations discuss intelligence sharing, and how to most-effectively remove illegal and harmful content from the internet.

Despite being spurned by tech companies for consultations over how best to manage online spaces, the ministers agreed to another joint statement reiterating their commitment to ridding the internet of "child predators, terrorists, violent extremists and other illicit actors".

They called for the industry to implement functions that prevent illicit content from being uploaded in the first place, and build user safety into the design of all online platforms, among a host of other demands.

This tougher stance, on both encryption and illicit online content, follows the European Union's (EU's) soundings in August that it would draw up new laws to fine companies like YouTube and Facebook for failing to remove extremist material within an hour.

"We cannot afford to relax or become complacent in the face of such a shadowy and destructive phenomenon," said European commissioner for the security union Julian King.

The principles agreed at the FCM, particularly around encryption, have reignited a debate centring on privacy versus security - with law enforcement agencies increasingly frustrated at being unable to access communications seized as part of their investigations.

The UK's National Crime Agency (NCA) said in its annual assessment of serious crime earlier this year that encryption impacts how effective law enforcement organisations can be in gathering intelligence and collecting evidence.

But former home secretary Amber Rudd, as with her successor Sajid Javid, had gone one step further to suggest tech companies should insert backdoor access into their products - undermining the principles of encryption entirely.

Russian bots are engaged in a campaign to spread health-related myths on Twitter - by promoting the views of vaccine sceptics and posing as users concerned with public health.

Unlike conventional botnets, which are used to spread malware, "content polluters" - likely originating in Russia - use similar methods to promote conspiracy theories and myths around vaccination, according to a study in the American Journal of Public Health (AJPH).

Researchers examined the frequency of anti-vaxx messages posted by humans and suspected bots between 2014 and 2017, and analysed the content posted on Twitter hashtags associated with Russian troll activity.

The study, titled 'Weaponised Health Communication', found that by confronting vaccine sceptics directly, bots were able to legitimise their position in the public discourse - and artificially inflate the anti-vaccine debate.

"Unlike troll accounts, content polluters (ie, disseminators of malware, unsolicited commercial content, and other disruptive material that typically violates Twitter's terms of service) post anti-vaccine messages 75% more often than does the average non-bot Twitter user," the researchers concluded.

"Thus, it is unclear to what extent their promotion of vaccine-related content is driven by true anti-vaccine sentiment or is used as a tactic designed to drive up click-through rates by propagating motivational content ("clickbait")."

Vaccines have long been considered safe and risk-free according to the overwhelming medical and scientific consensus. But myths and scare campaigns around vaccine usage at different points in time have led to the needless spread of disease and public health issues.

A recent resurgence of Measles across Europe, for instance, with 41,000 cases recorded in the six first months of 2018 - more than double the whole of last year - has been tied with false claims around vaccinations which have hindered parents from immunising their children.

The study found that Russian trolls and Twitter bots post content about vaccinations, both positive and negative, at significantly higher rates than the average user, indicating the aim was not to promote either side of the debate - but t raise the prominence of the debate itself.

Examples of myths propagated include the idea that vaccines can cause fatal side effects, that a secret government database of vaccine-damaged children exists, and that most diseases vaccines target are relatively harmless - making vaccines a needless risk.

"The highest proportion of anti-vaccine content is generated by accounts with unknown or intermediate bot scores," the researchers continued.

"Although we speculate that this set of accounts contains more sophisticated bots, trolls, and cyborgs, their provenance is ultimately unknown.

"Therefore, beyond attempting to prevent bots from spreading messages over social media, public health practitioners should focus on combating the messages themselves while not feeding the trolls."

Botnets are conventionally deployed to spread malware, and are becoming increasingly sophisticated as cyber security specialists attempt to combat them. Duo Security, for instance, earlier this month revealed the existence of a 15,000-strong botnet structured in a three-tiered hierarchy which promoted a fake cryptocurrency giveaway; evolving over time to remain undetected.

The often offensive form of cyber activism, hacktivism, is just as curious a concept as its analogue counterpart. Doing things that skirt the line between good and bad, all for a higher cause - worthy or not - is always guaranteed to divide onlookers. But, whatever your views are on hackers, it’s worth holding your judgement until you understand what hacktivism is and how it plays into the wider cyber security industry.

Hackers who carry out cyber attacks are the ones most associated with the concept of hacking. Cyber criminals have enjoyed a rewarding threat landscape over the past few years, especially since the advent of ransomware, which continues to be a scourge on the wider tech industry. Indeed, the business model for black hats is nuanced and successful. It’s no wonder there are so many of them.

But for every bad egg, there are a dozen good ones that stay on the right side of the moral line. Ethical hackers and penetration testers are two of the most well-known types of hacking experts that use their skills for good, to keep the bad guys at bay.

Hacktivists commonly fall somewhere in between these two groups, arguably leaning more into the nefarious side of the equation. The methods hacktivists use to complete their goals are often illegal ones, but whether you think their cause is for good or bad, they believe what they’re doing is right. Hacktivists can certainly operate on both sides of the good-bad gamut - we’ve seen it in play during Russia’s invasion of Ukraine. The latter’s ‘IT Army of Ukraine conducts daily attacks against Russian targets, and Russia-aligned hacking groups do the same right back. Then, of course, who could forget Anonymous - perhaps the most famous hacktivist collective of them all?

The history of hacktivism

Hacktivism has its roots in the early days of the internet when hackers primarily congregated on Usenet and message boards. Many of these early hackers were motivated by idealism, with a general tendency towards left-wing, anti-capitalist, and anti-corporate viewpoints. This, combined with a sense of anarchic mischief and a love of messing with people and systems, spurred numerous hacks protesting various social and political issues.

Hackers deployed various forms of malware against targets to disrupt their operations, hindering progress by rendering computer systems and networks unusable. An early example was the hilariously named Worms Against Nuclear Killers malware, which was released into NASA's networks in 1989 to protest the launch of the nuclear-powered rocket carrying the Galileo probe into orbit. The attack reportedly cost the project half a million dollars in lost time and resources, according to officials.

Who are the Anonymous hacking group?

Modern hacktivism, however, has been defined mainly by the group known as Anonymous. First emerging in the early 2000s, Anonymous was originally the collective name given to groups of users from the 4chan message boards, who would frequently band together to attack targets based on little more than an idle whim. These attacks ranged from relatively harmless pranks, such as ordering numerous pizzas to someone's house, to more vicious attacks such as carrying out DDoS strikes against websites or doxxing people.

What makes Anonymous unique is that it has no formal membership, controlling body or internal structure. Anyone can participate in its operations at will, and the targets and attack vectors it picks are determined by popular consensus amongst its members and fans. In its early days, Anonymous wasn't overly focused on political or ideological issues, preferring instead to target internet personalities that its members felt needed to be taken down a peg or two.

The group's first real foray into hacktivism came in 2008 when the group began a campaign of attacks against the church of Scientology. Operation Chanology, as it was known, included a week-long DDoS against the church's website, along with physical protests outside various Scientologist properties. The adoption by protestors of the Guy Fawkes mask from cult graphic novel V for Vendetta, incidentally, is what led to its now-iconic status as a symbol of hacktivism.

Following Project Chanology, Anonymous has also been heavily involved in various campaigns to foil attacks on internet freedoms. The group mounted significant efforts to fight the Stop Online Piracy Act (SOPA) and the Protect Intellectual Property Act (PIPA), both of which were accused of being efforts to censor the web. In more recent years, the group has been carrying out persistent attacks against the online arms of the terrorist group ISIS, targeting websites and social media accounts used to spread propaganda.

Most recently the group formed a stand against Putin’s invasion of Ukraine and has shouted loud and proud about its efforts in cyber space so far. Most notably, the group claimed it was able to replace the disinformation broadcast to the Russian public through state-affiliated media with genuine images and messages from inside Ukraine.

Hacktivism is often controversial. While many decry the use of objectively illegal cyber attacks, no matter how noble the cause, many applaud vigilante hackers like Anonymous and others for taking the law into their own hands.

Recent cases of hacktivism

The number of large-scale, international hacking operations most commonly associated with hacktivism has declined dramatically over the last 10 years, with IBM reporting a 95% drop in the number of hacktivist attacks between 2015 and 2019. According to Recorded Future, this could be due to the fact that, while corporate defences have improved over the years, the attack vectors, tools, and techniques used by hacktivist groups have remained largely unchanged since 2010.

However, this doesn’t mean that hacktivists have given up their efforts. In fact, multiple events from earlier this year have been considered to be symptoms of a resurgence of hacktivism, one of them being the storming of the US Capitol on 6 January 2021, videos of which were taken and uploaded onto right-wing social media site Parler by the rioters themselves. One hacker, known online as donk_enby, launched a collective action to gather the evidence of the Capitol lootings so that the perpetrators could be identified and prosecuted. Weeks later, donk_enby was asked by protesters in Myanmar to use her skills and platform to help identify numerous military contractors involved in the coup. According to Reuters, this ultimately led to the military leaders having their Google accounts suspended and sanctions imposed on them.

The new wave of hacktivism can be traced to May 2020, specifically after the murder of George Floyd at the hands of police officer Derek Chauvin. The event reportedly prompted Anonymous to shut down the website belonging to the Minneapolis Police Department, which is where Chauvin was stationed prior to his arrest and trial. When the site was finally restored, users were asked to complete a captcha in order to ensure they were not automated bots orchestrating a DDoS attack.

Two months later, hackers managed to breach the server of a major contractor working on behalf of the Russian intelligence service. They obtained 7.5TB of sensitive data and shared it freely with other hackers and journalists. Much of this included detailed information about sensitive government IT projects commissioned by the Federal Security Service of the Russian Federation (FSB).

Of course, the most recent high-profile example of activism at play is the conflict between Russia and Ukraine. The hacktivist efforts began even before the invasion as unknown hackers targeted the Belarusian railway network in a bid to stop Russian troops from mobilising near Ukraine's borders.

What followed was genuine cyber warfare, with forces from both sides attacking telecoms infrastructure, broadcast networks, government websites, and more. The war is thought to be the first ever to be fought across both kinetic and cyber space and even saw a Ukrainian government official assemble an online 'cyber army' from the early days of the war, known most commonly as the IT Army of Ukraine.

//