The attacks start quietly.
Someone clicks on a link in an email — and at first, nothing seems to happen.
But that one click opens the door for intruders.
And once the time is right, they strike, creating chaos and confusion.
But what if that system is needed to run an entire country?
And what can be done to protect it?
From DW, this is Techtopia, and in this episode, we are looking at how digital technology has
become critical for running our societies – and how this allows hackers to paralyze
them in milliseconds.
We explain how the attacks work.
We have insights into a global network of criminals who make billions by taking computers
hostage.
“It’s a booming industry.”
And we show how governments can use similar methods as a political weapon.
And if you want to know what it’s like to be in the middle of such an attack – listen
to this: This is Sabine Griebsch — and in the summer
of 2021, her small hometown in central Germany was hit by a form of cybercrime that rages
in the shadows of
the internet.
But the calls kept coming in, with employees from
across the district complaining that their computers were dead.
Alarmed, the IT professionals combed through the system — and came across a ransom note
that made their blood curdle: “Landkreis Anhalt – Bitterfeld, you are f***d.
That’s when it started to dawn on them: This wasn’t just another cyber attack.
This was more serious.
So: Who were the intruders?
What did they want?
And how did the district get out of this?
We’ll have some answers.
But first, let’s take a step back: In many ways, our advanced societies today
are like our human bodies, where thousands of different processes take place simultaneously.
And just like some organs are critical for our survival, some infrastructure is so vital
that everything would collapse without it.
Traditionally, such “critical infrastructure” is built so that it can run autonomously.
But over the last two decades, a lot of it was
connected to the internet, and now depends on access to digital technology — as if
a human body were connected to an artificial external brain millions of times more powerful.
This has quietly created an additional, invisible layer of digital technology connecting our
critical infrastructure.
This helps make it run more efficiently than ever — but it also makes it increasingly
interdependent: Windmills in Germany, for example, might need to be connected to American
satellites to work properly.
That’s why whenever this invisible layer is disrupted, it can cause cascading effects
and — in the worst-case scenario — spiral out of control and knock out the critical
infrastructure of an entire society.
Entire offices, from social welfare to immigration services, had to shut down — and as news
about the blackout spread across the district, so did residents’ fears.
What happened?
Within hours, authorities realized that they had fallen victim to organized cybercrime,
and what’s known as a “ransomware attack.”
But how do these attacks work?
They often follow a similar playbook: First, intruders gain access to a computer network.
Just as a virus finds different ways to enter our bodies, hackers have an arsenal of tricks
to get into the systems.
Often, they disguise themselves as trusted contacts and lure people into revealing their
login data.
Once inside, hackers can spend weeks or even months snooping around – looking for information
so valuable people would pay money to get it back.
When they find what they’re looking for, they encrypt the data – and send a message
to their victims, offering a decryption key in return for a ransom.
Victims are left with two options: to pay up and trust that they get their data back
— or to refuse, and hope that they can recover some of the hijacked data.
And slowly, they realized the extent of what had happened:
But how did the intruders manage to break into the system?
Where was the loophole they used to get in?
Months earlier, an employee had clicked on an infected link in an email and entered their
password.
That, from all appearances, was when the attackers got into the system.
“Ransomware attacks like in Anhalt-Bitterfeld have become common in the last years, and
it gets worse every year.
It’s organized crime.”
Here in Germany alone, we know of more than one hundred communities and public institutions
that have had their systems taken hostage in the last years.
“It’s a booming industry, and it’s an industry that has managers, planners, developers.
Criminal groups took advantage of the Covid pandemic and the changes to all our lives
to attack health care institutions, public institutions, local authorities.”
So what about the attack in Anhalt-Bitterfeld – who was behind it, and what did they want
That meant the district would have to cover all costs for the recovery itself.
We know that there are communities that have paid a ransom to get their data back.
But what if you’re unwilling to strike such a deal, and do business with criminals, what
else can you do?
In Anhalt-Bitterfeld, officials went through all the options they had — and then, they
decided to do something no one else had ever done before:
For the first time in German history, authorities declared a state of emergency because of
a cyber attack.
This meant, among other things, that Germany’s armed forces could send in their cyber experts
to help officials regain control over the system.
And yet, their fight was far from over.
We’ll get back to that – but first, let’s take a look at the larger picture: What if
attackers managed to bring down not just a small community but the critical infrastructure
of an entire country?
Hackers have tried it before: In 2019, attackers broke into the network of India’s largest
nuclear power station.
In 2021, an attack on a pipeline provider led to panic buying and gas shortages in the
US.
And in 2022, hackers crippled the computer systems of the government of Costa Rica.
“Each of these incidents had an impact locally, in the country or region where it happened.
However, should an adversary, a cyber attack group, decide to launch several attacks at
the same time simultaneously in many different countries around the world, the impact of
that would be potentially devastating.”
And what if attackers aren’t only in it for the money: Could state actors use similar
methods as a political weapon, to sow chaos and weaken their enemy?
“Well definitely.
That is really a problem, because if criminals cooperate with secret services, that is a
kind of explosive combination.”
To be clear: It’s incredibly difficult to say with one hundred percent accuracy who’s
behind a cyber attack.
But the experts we talked to said that during the early days of the war in Ukraine, there
were incidents that could be examples for a cooperation between state actors and criminals:
“Literally, as Russian tanks were rolling into Ukraine, we also saw digital components
to the attacks — including an attack on a satellite network, one that is even used
by wind turbines in Germany.”
And the war in Ukraine has also triggered conflict within the criminal ransomware ecosystem.
Confused?
What’s key to understand is that before the invasion, Russian ransomware groups often
had operatives working in Ukraine.
“As the conflict rolled out, these Ukrainian operatives were not happy with what the cyber
ransomware gangs were doing.
So they decided to leak information, to publish details, and these details will eventually
help law enforcement in Europe and around the world to track down and stop these gangs.”
And those attacks can have an impact on every one of us.
Which brings us back from the stage of world politics to the German district of Anhalt-Bitterfeld.
Remember that authorities decided not to pay a ransom?
In the days that followed that decision, they started to feel
the consequences: The files included sensitive information such
as bank account details or the employment status of over 90 individuals.
We tried to contact some of them — but none of them wanted to appear on camera because
of concerns over what happened to their data.
Meanwhile, the administration’s standstill sent unexpected ripple effects across
the district: That’s why after the attack knocked out
the administration, his car dealership couldn’t deliver any more vehicles to their new owners.
After that, business slowly resumed — but almost one year later, he is still feeling
the consequences.
To prevent damages like that, how can communities get better at protecting their systems?
The experts we talked to agreed that it’s time to move on from some outdated ideas about
cyber security: “The classic model would be almost like
a castle with a moat.
Everything inside would be precious and everything outside would be malicious.
This is a model that doesn’t work in the post-Covid age, where we are all connecting
from everywhere.
“The question is no more, will an attacker get in, because everyone knows: An attacker
will get in.
You have to protect yourself by finding out when someone gets in and, in the best case,
finding that out at a very early stage Cyber protection today is less about protecting
the wall of your castle — rather, it’s about having guards inside of it, who stand
ready to fight intruders and kick them out.
That’s how you can retain some control, even when you’re under attack.
And this matters.
Because those who experienced losing complete control over their systems say that it leaves
its marks: It took the district almost a year to get
everything running again.
And something else was damaged during the attack — something that is even harder to
fix: The trust people have in their administration and the confidence that the state will be
there when they need it.
And what if Anhalt-Bitterfeld is only the canary in the coal mine?
What if what happened here only foreshadows what’s yet to come for others?
As technology is becoming ever more sophisticated, cyber attackers will find ever more ways of
taking computer systems hostage.
That is why, to prevent the worst-case scenario — an attack that would paralyze an entire
country — governments must tackle the problem at its root: Critical infrastructure must
be protected by state-of-the-art safeguards.
For criminals, it must become harder to profit from hacking.
And, perhaps most importantly: Countries need to invest in training a new generation of
cybersecurity experts.
This will take time, money and patience.
But it’s worth it: Because the threat of cyber attacks is here to stay.