Who Hates the FINs ??

Companies in Finland are increasingly the target of cyber-attacks, Finnish authorities said last week. Firms are reporting an uptick in cyber-attacks, the Finnish Transport and Communications Agency (Traficom[1]) and the Finnish Security and Intelligence Service (SUPO[2]) said in a joint press conference. But despite the greater frequency of corporate cyber-attacks, the agencies said an event that could paralyze systems in Finland was highly unlikely.

The SUPO chief reported that Russia is increasingly channeling its intelligence gathering efforts into the virtual realm. SUPO has said Russian cyber-espionage targeting Finland exceeded previous levels in the second half of 2022. Russia is seeking to use cyber-espionage to make up for the shortfall in human intelligence, according to the security police.[3]

"The falling number of intelligence officers and restrictions on travel across the Russian border have significantly undermined operating conditions for Russian human intelligence in Finland. Operations under diplomatic cover have been the main instrument of Russian intelligence abroad," SUPO said in a statement last month.

More cross-agency Cooperation

Traficom and SUPO said they were increasingly working together in the face of heightened cyber-threats. "Every day Finland is targeted by a range of cyber-threats—from denial-of-service attacks to data breaches and attempts to spread malware," explained Traficom, noting that these threats are a permanent fixture by now.

Firms including Wärtsilä, Uponor and the Finnish News Agency STT have come under attack, as have government agencies, including some related to critical infrastructure. Traficom and Supo also said that Finland was seeing more hacktivism—that is—groups rallying around specific societal issues. Ransomware attacks are also on the rise now compared to the past two years, the agencies said.

In the last few months, the expulsion of Russian intelligence personnel and the refusal of visas have weakened the intelligence activities of Russians in Finland, according to SUPO. SUPO said that Russian intelligence gathering has traditionally been carried out by operatives on the ground. However, the intelligence agency said it managed to significantly compromise Russian intelligence operations in Finland in 2022. "The Russian intelligence station shrank to about half of its former size last year. The main reason for this decline was the expulsion of intelligence officers and visa refusals on the advice of Supo," SUPO reported.[4]

Supo said a declining number of Russian intelligence officers as well as Finland's eastern border restrictions had "significantly undermined" the gathering of human intelligence by Russians in Finland.

Spying Diplomats

The agency said intelligence gathering by Russians has chiefly been carried out by individuals under diplomatic cover. "While Russia is still seeking to station intelligence officers under diplomatic cover, it will have to find ways of compensating for the human intelligence shortfall, such as by increasingly adopting other forms of covert operation abroad. Establishing human intelligence contacts nevertheless remains a very time-consuming process, and alternative approaches cannot be set up overnight," SUPO said.

The agency noted that Russia is looking to use cyber espionage to make up for the human intelligence shortfall. However, SUPO said cyber espionage is an "incomplete substitute" for intelligence gathering by humans, as it provides a different type of information. It also reported that Russian cyber spying efforts exceeded previous levels by the second half of 2022.

Little change in Terrorism Threat

The intelligence agency said that Finland's terrorism threat level remains at an "elevated" state, which corresponds to the second level of a four-point scale. It said that dangers posed by extreme right-wing terrorism had grown, while the threat of terrorism by radical Islamists was unchanged. "Some extreme right-wing and radical Islamist actors in Finland probably harbor the desire and capacity to mount violent attacks," SUPO stated in the release. It noted that threats from followers of those ideologies are generally as individuals or small groups. "Attacks remain unlikely in the short term. Unlicensed weapons spreading from the Ukrainian war zone are likely to increase the capacity of extremists in Europe for violence," the March SUPO release stated.

Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@wapacklabs.com

Weekly Cyber Intelligence Briefings: