Source: ESET WeLiveSecurity

Written by: Phil Muncaster

Hacktivism is nothing new, but the increasingly fuzzy lines between traditional hacktivism and state-backed operations make it a more potent threat.

Hacktivism surged back into mainstream consciousness with Russia’s invasion of Ukraine in February 2022. Less than two years later, politically-motivated groups and individuals were out in force again, this time ostensibly to make their point amid the Israel-Hamas conflict. Worryingly, hacktivists have been spotted using increasingly sophisticated and aggressive tactics to bring their agendas to public attention.

Perhaps even more disconcerting is the likelihood that many groups are, in fact, either backed by, or even consist of, nation-state actors. Indeed, the lines between state-sponsored cyber operations and traditional hacktivism have become fuzzy. In a world increasingly characterized by geopolitical instability and an erosion of the old rules-based order, organizations, especially those operating in critical infrastructure, should consider building the hacktivist threat into their risk modelling.

What’s new in hacktivism?

At its most basic, hacktivism is the act of launching cyberattacks for political or social reasons. As an indication of the seriousness with which it is now viewed, the Red Cross last year issued eight rules for “civilian hackers” operating during wartime, all while noting that hacktivists are increasingly causing disruption to non-military targets such as hospitals, pharmacies and banks.

READ ALSO: ESET APT Activity Report Q4 2023–Q1 2024

Predictably, there’s been little sign of hacktivists adhering to the guidelines issued by the Red Cross. Indeed, with attribution still difficult online, the pros of engaging in hacktivist activity still largely outweigh the cons – especially if attacks are secretly backed by nation states.

The old and the new

The current Israel-Hamas conflict has drawn unprecedented numbers of activists onto streets around the world. And, in lockstep, it has led to a surge in online activity. Much of this is similar to the tactics we’ve seen in previous hacktivist campaigns, including:

• DDoS attacks: According to some sources, hacktivist-driven DDoS activity last year peaked in October at “record levels, following the conflict between Israel and Hamas.” This made Israel the country most targeted by hacktivists; with 1,480 DDoS attacks recorded in 2023, including some big-name organizations.
• Web defacement: Over 100 hacktivists launched over 500 web defacement attacks on Israeli websites in the week following the October 7 raids, according to Cambridge University researchers. Similar low-level web defacements continue to this day.
• Stolen data: Some groups claimed to have stolen and published data from Israel and allied organizations. In other words, hacktivists can infiltrate corporate systems to pilfer sensitive information before releasing it publicly to embarrass or harm the target.

However, there are also signs that hacktivism is becoming more targeted and sophisticated:

• One report suggested hacktivist group AnonGhost exploited an API vulnerability in the “Red Alert” app, which provides real-time missile alerts for Israeli citizens. The group “successfully intercepted requests, exposed vulnerable servers and APIs, and employed Python scripts to send spam messages to some users of the app,” it noted. The group even managed to send fake messages to civilians about a nuclear bomb.
• Other reports noted that hacktivist had posted screenshots indicating they had access to Israeli water systems’ SCADA devices. The researchers were unable to verify these claims, but suggested that hacktivists may have been conducting reconnaissance operations targeting the sector.

When nation states get involved

Hacktivists with more advanced technical know-how and/or access to tools and knowledge on the cybercrime underground may have been behind the latter attacks. However, nation state backing can’t be ruled out. Many countries have geopolitical and ideological reasons to attack other countries and their allies under the camouflage of hacktivism.

RELATED READING: State-sponsored or financially motivated: Is there any difference anymore?

In fact, suspected Russia-affiliated groups seem to have a long history of doing so, including under the Anonymous Sudan moniker, which has taken down many targets in the West. The group claimed the attack on The Jerusalem Post and several others targeting industrial control systems (ICS), including the Israeli Global Navigational Satellite Systems, Building Automation and Control Networks and Modbus ICS. Another pro-Russian group, Killnet, claimed to have taken down an Israeli government website and the website of security agency Shin Bet.

While these attacks are notably high profile, there are hints of more insidious state-backed efforts masquerading as hacktivism. Disinformation efforts include the use of AI-generated images purporting to show missile strikes, tanks rolling through ruined neighborhoods, or families combing through rubble for survivors.

The focus here is to generate images that create a strong emotional reaction – such as one of a baby crying amidst bomb wreckage, which went viral late last year. Fake social media and Telegram accounts amplify the disinformation. In one case, X owner Elon Musk apparently promoted a post from a faked account that was viewed 11 million times before deleting it.

Security researchers have observed suspiciously coordinated activity following the Hamas attack – possibly suggesting state involvement. One study claimed at least 30 hacktivist groups immediately pivoted activity to the conflict within 48 hours.

How organizations can manage hacktivist risks

In many ways, whether the hacktivist threat comes from genuine groups, those aligned with state interests or covert nation state operatives themselves, the threat remains the same. Such groups are increasingly targeting private sector organizations with the audacity to speak out on political sensitive issues. In some cases, they may do so simply if there is a perception that the organization is aligned to one side or another. Or as a smokescreen for more shadowy nation state goals.

Whatever the rationale, organizations can follow these basic high-level steps to mitigate the hacktivist risk:

• Ask the right questions: Are we a target? What assets are at risk? What is the extent of our attack surface? Are existing measures enough to mitigate hacktivist risk? This is where a thorough cyber-risk assessment of externally facing infrastructure can help.
• Plug any gaps revealed by such an assessment, including vulnerabilities or misconfigurations – ideally this should be done in a continuous and automated manner.
• Ensure assets are protected from threats at an email, endpoint, network and hybrid cloud layer and continuously monitor for threats with XDR/MDR tools.
• Use threat intelligence to gather, analyze, and act on information about current and emerging threats.
• Apply robust encryption, both at rest and in transit, to protect sensitive data from being read or modified by unauthorized parties.
• Enhance identity and access management with zero trust architecture and multi-factor authentication (MFA) and and keep an eye out for suspicious data access patterns.
• Run continuous employee education and awareness training programs.
• Partner with a trusted third-party for DDoS mitigation.
• Build and test a comprehensive incident response plan.

Hacktivism is nothing new. But the increasingly blurred lines between ideologically/politically motivated groups and government interests makes it a more potent threat. It may be time to rethink your risk management planning.

Source: welivesecurity by ESET

Author: Phil Muncaster

How backup best practices can help drive resilience and improve cyber-hygiene in your company

Could your company survive if its most critical data stores were suddenly encrypted or wiped out by cybercriminals? This is the worst-case scenario many organizations have been plunged into as a result of ransomware. But there are also many other scenarios that could create serious business risk for companies.

To mark Cybersecurity Awareness Month (CSAM), we looked at how both individuals and companies that fail to prepare are preparing to fail. Today, we’ll dive a little deeper into one particular aspect of how companies can help drive resilience and improve cyber-hygiene.

Having a backed-up copy of that data ready to restore is a safety net that many fail to consider until it’s too late. And even those with backups may manage them in a way that continues to expose the organization to risk. Indeed, backups can be a target too.

Why do you need backups?

Ransomware has perhaps done more for awareness about data backups than any other cyberthreat. The prospect of malware designed to encrypt all corporate data – including connected backups – has driven companies to invest in mitigations en masse. And it appears to be working. According to one estimate, the share of victims who pay their extorters dropped from 85% in Q1 2019 to just 35% in Q4 2022. Given that ransomware remains disproportionally a problem for SMBs, the threat from external hackers remains a major driver for backups.

READ: ESET SMB Digital Security Sentiment Report: The damaging effects of a breach

However, it’s not the only one. Consider the following risks, which backups can help to mitigate:

• Destructive data extortion attacks, partly driven by the cybercrime-as-a-service ecosystem, in which data is exfiltrated and encrypted drives before a ransom is demanded. ESET’s Threat Report for September to December 2022 found the use of increasingly destructive tactics, such as deploying wipers that mimic ransomware and encrypt the victim’s data with no intention of providing the decryption key.
• Accidental data deletion by employees is still a challenge, especially when sensitive data is saved to personal devices which don’t back it up. These devices could also be lost or stolen.
• Physical threats: floods, fires and other natural disasters can knock out offices and data centers, making it doubly important to store a separate copy of sensitive data in another geographical location.
• Compliance and auditing requirements are becoming ever more onerous. Failure to produce the information required of your business could lead to fines and other punitive action.

It’s difficult to put a price on it, but failing to backup in line with best practices could be a costly mistake. The average ransomware payment in Q4 2022 was over $400,000. But there are many other direct and indirect costs to consider, both financial and reputational.

How do I get there?

Best-practice backup strategy doesn’t need to be a black box. Consider the following 10 ways to achieve success:

1. Develop a strategy
   It sounds obvious, but it pays to plan carefully to ensure any backup strategy meets the requirements of the organization. Consider this as part of your disaster recovery/business continuity planning. You’ll need to consider things like the risk and impact of data loss events, and objectives for data restoration.
2. Identify the data you need to backup
   Data discovery and classification are a vital first step in the process. You can’t backup what you can’t see. Not all data may be deemed business critical enough to warrant backing up. It should be classified according to the potential impact on the business if made unavailable, which in turn will be informed by your corporate risk appetite.
3. Follow the 3-2-1 rule
   This posits that you make three copies of the data, on two different media, with one copy stored offsite and offline. The last bit is particularly important, as ransomware often hunts out backed-up data and encrypts that too, if it is on the same network.
4. Encrypt and protect your backups
   Given that threat actors also seek out backed-up copies of data for extortion, it pays to keep them encrypted, so they can’t monetize the data stored within. This will add an extra layer of defence beyond the 3-2-1 mechanism (at least 3 copies, 2 different storage types, 1 copy offsite) if you use it.
5. Don’t forget cloud (SaaS) data
   A great deal of corporate data now resides in software-as-a-service (SaaS) applications. That can provide a false sense of security that it is safe and sound. In reality, it pays to add an extra layer of protection by backing this up too.
6. Test your backups regularly
   It’s pointless having a backed-up copy of your company data if it won’t restore properly when called upon. This is why you should test them regularly to ensure the data is being backed up correctly and can be retrieved as intended.
7. Run backups at regular intervals
   Equally, a backup is of limited use if it restores to a point in time too long ago. Exactly how regularly you should run backups will depend on the time of business you have. A busy online store will require almost continuous backing up, but a small legal practice can get away with something less frequent. Either way, consistency is key.
8. Choose your technology partner carefully
   No two businesses are the same. But there are certain features which are useful to look out for. Compatibility with existing systems, ease of use, flexible scheduling and predictable costs all rank highly. Depending on the size and growth trajectory of your business, scalability may also be important.
9. Don’t forget the endpoint
   Backing up network drives and cloud stores is one thing. But don’t forget the wealth of data that may reside on user devices like laptops and smartphones. All should be included in a corporate backup policy/strategy.
10. Look beyond backups
    Don’t forget, backups are only one piece of the puzzle. You should be complementing them with security tools at the endpoint, network and server/cloud layer, extended detection and response tooling, and more. Also follow other cyber-hygiene best practices like continuous patching, password management and incident response.

Data is your most important asset. Don’t wait until it’s too late to formulate a corporate backup strategy.

FURTHER READING: Small and medium-sized businesses: Big targets for ransomware attacks