since russia's invasion of ukraine just about a month ago the threat of a cyber
attack has been looming both here in the u.s and abroad i'm here with cso online
senior writer lucian constantine to discuss the current threat landscape stick around
hey everyone welcome back to today in tech i'm julia pochamp and as i said i am here with cso
online senior writer luchan constantine lucian thank you so much for calling in and chatting
with me today definitely a super important topic hi julia thanks thanks for having me so i mean
my first question for you is just what what does the threat landscape currently look like when it
comes to cyber attacks on you know let's say critical infrastructure things like you know
telecom banking um you know pipelines and how has that changed within the last month or so if at all
right i wouldn't say necessarily that in terms of techniques it has changed like the types of
attacks but the the risk the the risk is obviously higher the likelihood of this attacks happening
is is higher and that is because that is driven by the obviously the economic sanctions against
against russia um the the whole uh you know diplomatic geopolitical and diplomatic tensions
there might be retaliations for the economic sanctions and so on i think people uh have
been surprised that they haven't seen the levels of cyber war that that they were expecting where
not the russian state government agencies take responsibility directly for for some attacks
and and but i think um some some actions have already happened
some of these attacks have already happened they are done much more stealthily and with
you know without attribution to complicate attribution but we know at least in ukraine itself
when the war started we had a sudden attack against viasat satellite network in europe which
took out satellite communications in ukraine but also in poland and germany so kind of collateral
damage uh which while it hasn't yet been directly attributed to russia that that is the suspicion
because the timing and the value on the field of disrupted communications uh is obviously valuable
in war and just today we had an attack against a major ukrainian internet service provider
that also took out their their communications uh and they were serving governments as well as the
population and and uh institutions so this sort of there were some attacks against ukrainian banks
um and against other organizations like data wipers these are destructive malware threats that
uh unlike ransomware which encrypt your files and ask for ransom to decrypt them
uh this threats kind of uh delete files and including the operating system and the boot
sector and all that with the purpose of creating down times and crippling the infrastructure that's
supposed to serve various services right yeah so if and i think you make an interesting point while
obviously you know the war has been very much like boots on the ground there hasn't been like this
like catastrophic necessarily cyber incident that perhaps people were expecting um and i think how
how do like sort of these hacktivist type groups play into this landscape if
some of these attacks are not being you know directly attributed to governments
i think this the taxes by these groups um they can offer the threat here is they
can offer some plausible deniability because because these groups are very
loosely coordinated they don't have a hierarchy of structure like in anonymous there are various
individual teams that do various operations everyone is kind of contributing trying to
contribute their skills because they have you know the motivation the they want to stand with
ukraine and all and all that right so this could offer an opportunity for for government agents
to uh kind of kind of infiltrate and launch more sophisticated attacks uh i'm not saying this
happened but this can be the case or with the ukrainian i.t army which is is a bit different
because it is coordinated by the ukrainian government uh by their ministry of digital
communications or or something like that so it has some direct ties to the ukrainian government
um and again it's it's volunteers it's it's very much like uh the volunteers that joined the
the ukrainian uh foreign legion right that was set up and and took r took up arms and went to
ukraine to fight for ukraine even though they are not ukrainian citizens right so it's kind
of like the same thing and and and russia as they can claim uh for the boot on the ground for these
volunteers that there might be uh serving as cover for uh you know the west to send special
units and special forces disguised as volunteers they can claim the same thing about these groups
right like anonymous or the ukrainian i.t army that are not really volunteers they are the west
western agents launching attacks right so then they can claim
we can strike back if they want to go that that route but i think for the most part it's
it's staying more in the realm of plausible deniability kind of using these groups and
and russia has a history of using cyber criminal groups uh to do their operations or their bidding
and we've seen this in indictments of the official uh u.s department of justice justice indictments
for hacks in the past that were done by cyber criminal groups but directed by
fsb officers or even fsb officers um charged in connections with with those attacks right
right so what you're saying is that because of the nature of these types of groups that they offer
you know relative or almost not even relative complete and an anonymity when it comes to who
has who like the individual is who has carried out this attack it's it's easy for a perhaps a
a government group or individual to sort of jump in and say oh that you know that wasn't
the government that was this that was this goodwill group is that what you're getting at
yes yes i mean the problem with taking responsibility for cyber attacks um are
the policies of the other party like like the u.s i know at least uh they said if if we are attacked
if our infrastructure is attacked uh as part of a you know on on the side of our armed conflict
we can retaliate both in the cyber space but might also retaliate in the physical space i understand
so no one wants that sort of escalation right yeah of course uh you know because
russia can always claim that the u.s intelligence is bad or the department of justice's claims
or indictments of fsb officers is bogus and they didn't really collaborate clearly the
the u.s um you know the fbi they they have their own intelligence otherwise we wouldn't see these
names in this uh indictments uh so so they have some visibility into this collaboration but
russia will probably never say yes yeah you did it right so so
i would think that you know the threat of a cyber incident especially for you know critical
infrastructure the financial services industry um those types of things you know food supply chains
those types of things are i would think sort of like ever present cyber threats um so is that
hard right now to delineate between what is and is not in retaliation for sanctions
um i think it's hard but i think it's it is to be expected so uh the the white house and and
uh csi in the u.s are warning about increased risks against the u.s critical infrastructure
operators or the financial sector or other types of organizations in government organizations
and and for a very good reason right russia is pressured right now because of the economic
sanctions uh which they they they hold the west responsible for right so whether it's cyber
criminal groups hitting western organizations out of uh you know a sense of nationalistic pride or
uh things like that whether they're directed by russian agencies state agencies to launch attacks
whether the russian agencies launch attacks themselves by infiltrating other groups uh
it doesn't really matter the the idea is there is a higher risk of such a tax occurring right now
because of the situation that's that's going on and because of the sanctions
um and i would give here because first of all the cyber criminal groups uh feel the economic
sanctions as well right so they will need more money they need they need money to operate and
they need money for themselves right so that kind of encourages them to launch even more attacks
uh on top of uh you know this this sense of revenge for for what they're being their
country is being put through right uh you know rightfully from the western perspective obviously
uh but there's also the government might try to skirt some of these economic sanctions
with through the means of cyber attacks and moving money around with bitcoin and stuff
like that which we've seen in the past with north korea for example which has its own
cyber threat group called lazarus which is attributed to north korea's
uh government but we've seen lazarus engaging in very attacks that seem very uh cyber crime-like
very financially motivated uh as opposed to just espionage like like state agencies usually do
or sabotage in some cases against south korea because it's the you know there's the situation
there between north korea and south korea but the reason we're seeing those type of financially
motivated attacks is because north korea is under sanction has been under sanctions for a very long
time it's cut off from international trade and it needs money which is happening now with russia
not yet to the same extent but you know in the future we might see attempts to to
try to you know kind of get around some of those sections sure
so what sort of resources are available for an organization that is perhaps you know a part of
critical infrastructure or a government contract or something like that and i mean i'm sure
i'm sure in some cases they probably have plenty of staff on hand but what sort of directives have
there been for these types of organizations that are you know especially looking to
beef up their security protocols i would imagine that because the you know the number of targets
is is so is so high in number i would imagine that like it'd be very difficult to defend everything
yes yes um i mean there is the the u.s government or sisa has the the shields up
effort uh through which they they offer various resources uh in terms of uh
information exchange but also defensive measures that organizations should take a list of tools
free tools and commercial free open source and free commercial tools that can be used
and then there's more specific type of uh mitigation advice or recommendations for the
industrial sector or or critical infrastructure operators last week we've seen the doj
announced indictments or indictments were unsealed against uh in relation to two
two attacks one was the triton malware which was is one of the more sophisticated malware
threats specifically designed to infect industrial controllers in this case system
sorry instrument safety instrumented the systems which are the last line of defense in a in an
um industrial installation when a process goes out of parameters these devices are supposed to
do a clean shutdown or safety shutdown right so if you control these devices and you tell the
operator that everything is going on normally where when it isn't uh you can risk the you can
have risks of explosions uh things like that right very serious very serious damage to human life and
uh to obviously assets so we know these attacks are so we know this was attributed to one of the
research centers affiliated with the russian minister of defense a programmer from there
is uh actually named in the indictments so we know that russia has these capabilities the other
indictment regards a group known as dragonfly and uh three fsp officers are named for that that
is a this is a malware that scans networks for scada supervisory control and data acquisition
these are special applications that monitor industrial control systems
uh plc's uh and and other industrial controllers right so again we know this capability they have
these capabilities right so there are there are very specific there are specific mitigation uh
steps that uh this organizations need to take to separate their mit networks from their authentic
operational technology networks uh and these are in separate advisories that was was released
last one last week by csi in the department of energy and the fbi uh alongside these indictments
uh so there are resources out there that the us government is making this this resources available
great thank you so much i think um there's a lot of
a lot of interesting information here about you know sort of just like this
current state of affairs what things um what types of things organizations enterprises i.t
departments can do if they're concerned about the risk the if if they're concerned about the
risk of a cyber incident so thank you so much lucian i really appreciate your insight here
thank you and thank you all so much for watching this episode today in tech if you found this
helpful or valuable or interesting please do give it a thumbs up you can also subscribe
to our channel and hit the bell icon so you're notified every single time we post a new video
if you have any questions or comments about this topic please do let me know in the comments below
and i will do my best to get back to you thanks again for watching and we'll see you next time