X-Industry

Our friends from the US Department of Homeland Security have provided an open source Threat Assessment for October 2020 - which is Cyber Security Awareness Month.  The following is the Cyber Threat Assessment Section. 

Cyber threats to the Homeland from both nation-states and non-state actors will remain acute. U.S. critical infrastructure faces advanced threats of disruptive or destructive cyber-attacks. Federal, state, local, tribal and territorial governments, as well as the private sector, will experience an array of cyber-enabled threats designed to access sensitive information, steal money, and force ransom payments.

Nation State Threats

Russia—which possesses some of the most sophisticated cyber capabilities in the world— can disrupt or damage U.S. critical infrastructure networks via cyber-attacks. Russian state-affiliated actors will continue targeting U.S. industry and all levels of government with intrusive cyber espionage to access economic, policy, and national

security information to further the Kremlin’s strategic interests.

• Russia probably can conduct cyber-attacks that would result in at least localized effects over hours to days and probably is developing capabilities that would cause more debilitating effects.
• We expect Russian cyber actors to use a range of capabilities including social engineering, publicly known software and hardware vulnerabilities, poorly configured networks, and sophisticated “zero-day” attacks that exploit security weaknesses in software.
• Under Russian law, the Federal Security Service (FSB) can compel Russian firms doing business in the United States—or Russians working with U.S. firms—to comply with FSB information sharing and operational mandates, presenting additional routes for cyber espionage.

China

China already poses a high cyber espionage threat to the Homeland and Beijing’s cyber-attack capabilities will grow. Chinese cyber actors almost certainly will continue to engage in wide-ranging cyber espionage to steal intellectual property2 and personally identifiable information (PII) from U.S. businesses and government agencies to bolster their civil-military industrial development, gain an economic advantage, and support intelligence operations. China possesses an increasing ability to threaten and potentially disrupt U.S. critical infrastructure.

• We expect China’s cyber operations against U.S. companies to focus on the critical manufacturing, defense industrial base, energy, healthcare, and transportation sectors.
• Beijing has targeted information technology and communications firms whose products and services support government and private-sector networks worldwide, while concurrently advocating globally for Chinese information technology companies that could serve as espionage platforms.
• Under China’s 2017 National Intelligence Law, Beijing can compel businesses based in China and Chinese citizens living abroad to provide intelligence to the Chinese government.
• We remain concerned about China’s intent to compromise U.S. critical infrastructure to cause disruption or destruction.
• China’s efforts to dominate the 5G world pose new challenges to U.S. efforts to national security, privacy, resistance to malign influence, and human rights. The exponential increases in speed, connectivity, and productivity could render American systems particularly vulnerable to Chinese cyber threats. While Russia and China are the most capable nation-state cyber adversaries,

Iran and North Korea

Iranian and North Korean cyber actors also pose a threat to U.S. systems, networks, and information.  Iran continues to present a cyber espionage threat and is developing access in the Homeland that could be repurposed for destructive cyber-attacks. North Korean cyber capabilities, while sophisticated, probably will remain confined to criminal threats – ‘The Cyber Threat’ to the US Homeland generation of revenue.  If Pyongyang’s intent changes, however, it probably could quickly build capabilities to conduct broader espionage activity or threaten infrastructure with disruptive cyber-attacks.

Cybercrime

Cybercriminals increasingly will target U.S. critical infrastructure to generate profit, whether through ransomware, e-mail impersonation fraud, social engineering3, or malware. Underground marketplaces that trade in stolen information and cyber tools will continue to thrive and serve as a resource, even for sophisticated foreign adversaries.

• Ransomware attacks—which have at least doubled since 2017—often are directed against critical infrastructure entities at the state and local level by exploiting gaps in cybersecurity.
• Victims of cybercriminal activity in 2018 reported over $2.7 billion in losses—more than twice the amount lost in 2017. This figure does not represent the full scope of loss because some victims do not report incidents.

Cyber Threat to the U.S. Democratic Processes

Some state or non-state actors likely will seek to use cyber means to compromise or disrupt infrastructure used to support the 2020 U.S. Presidential election and the 2020 U.S. Census.  Given the national importance of these events, any related cyber activities—or mere claims of compromise—might fuel influence operations aimed at depressing voter turnout or census participation, misinforming about democratic processes, or shaping perceptions about the integrity or outcome of the election or census.

• Advanced persistent threat or other malicious cyber actors likely will target election-related infrastructure as the 2020 Presidential election approaches, focusing on voter PII, municipal or state networks, or state election officials directly. Operations could occur throughout the 2020 election cycle—through pre-election activities, Election Day, and the post-election period.
• Adversaries’ cyber capabilities vary greatly— as does the cyber defensive posture of electoral boards to stymie such actors. Adversaries could attempt a range of election interference, activities, including efforts to target voter registration systems; to compromise election system supply chains; to exploit poor cybersecurity practices on protected election systems or networks; or to hack official election websites or social media accounts.
• Unidentified cyber actors have engaged in suspicious communications with the U.S. Census public-facing network over at least the last year, including conducting vulnerability scans and attempting unauthorized access. Cyber activity directed at the U.S. Census could include attempts to gain illicit access to census-gathered bulk data; to alter census registration data; to compromise the census infrastructure supply chain; or conducting denial-of-service attacks.

__________________________________________________________________

Red Sky Alliance supports the installation, updating and monitoring of firewalls, cyber security and proper employee training are keys to blocking attacks.  Please feel free to contact our analyst team for research assistance and Cyber Threat Analysis on your organization.

What can you do to better protect your organization today?

• All data in transmission and at rest should be encrypted.
• Proper data back-up and off-site storage policies should be adopted and followed.
• Implement 2-Factor authentication company wide. (Read MFA)
• Join and become active in your local Infragard chapter, there is no charge for membership. infragard.org
• Update disaster recovery plans and emergency procedures with cyber threat recovery procedures. And test them.
• Institute cyber threat and phishing training for all employees, with testing and updating.
• Recommend/require cyber security software, services and devices to be used by all at home working employees and consultants.
• Review and update your cyber threat and information security policies and procedures. Make them a part of all emergency planning and training.
• Ensure that all software updates and patches are installed immediately.
• Enroll your company/organization in RedXray for daily cyber threat notifications are directed at your domains. RedXray service is $500 a month and provides threat intelligence on nine (9) cyber threat categories including Keyloggers, with having to connect to your network. 
• Purchase annual cyber insurance coverage from Red Sky Alliance provided by Cysurance.

Red Sky Alliance has been has analyzing and documenting cyber threats for 9 years and maintains a resource library of malware and cyber actor reports.

Articles about the cyber threat groups mentioned in this report can be found at https://redskyalliance.org    There is no charge for access to these reports.

Our services can help protect with attacks such as these.  We provide both internal monitoring in tandem with RedXray notifications on ‘external’ threats to include, botnet activity, public data breaches, phishing, fraud, and general targeting.

The installation, updating and monitoring of firewalls, cyber security and proper employee training are keys to blocking attacks.  Please feel free to contact our analyst team for research assistance and Cyber Threat Analysis on your organization.  For questions, comments or assistance, please contact the lab directly at 1-844-492-7225, or feedback@wapacklabs.com    

• Reporting: https://www.redskyalliance.org/
• Website: https://www.wapacklabs.com/
• LinkedIn: https://www.linkedin.com/company/64265941