Month: October 2021

Russia appears to be getting more aggressive and more successful as the nation’s hackers launch a growing number of cyberattacks against the United States and other nations, according to a new report by Microsoft. 

Microsoft’s 2021 Digital Defense Report warns that what it labels as “Russian nation-state actors” are responsible for 58% of all nation-state cyberattacks, and that they are now successful almost one out of every three times. 

“Russia-based activity groups have solidified their position as acute threats to the global digital ecosystem,” the report said, cautioning that Russian cyber actors have been adaptable, getting better at using open-source tools “that make them increasingly difficult to detect.” 

Microsoft also said Russia’s most frequent target was the United States, followed by Ukraine and Britain, and that the focus seems to be shifting toward intelligence gathering, with more than half of Russian attacks now targeting agencies involved with foreign policy, national security or defense, up from just 3% a year earlier. 

According to Microsoft, after Russia, the greatest number of cyberattacks came from North Korea, Iran and China.

North Korea’s top target was cryptocurrency companies, while Iran quadrupled its attacks on Israel as tensions between the two countries grew steadily. 

China also was active, focusing much of its cyber efforts on intelligence gathering. 

Microsoft said a large part of Beijing’s efforts, through a threat actor called Chromium, focused on gathering social, economic and political intelligence from India, Malaysia, Mongolia, Pakistan and Thailand. 

Another prominent Chinese threat actor, known as Nickel, focused its efforts on foreign ministries in Central and South America. 

The report also said that South Korea, Turkey and Vietnam were increasingly active in cyberspace, though the volume of attacks carried out from those countries paled in comparison with Russia, North Korea, Iran and China. 

Top U.S. officials have shared their concerns about the growing danger from cyberattacks, especially from nation-state adversaries, in recent weeks. And many have voiced support for legislation that would require private companies to notify the U.S. government if their systems were breached. 

“I think we’re at a point, seeing the arc of cybercrimes and the cyberthreats, that really there’s an urgency to it,” U.S. Homeland Security Secretary Alejandro Mayorkas told a virtual cybersecurity conference earlier this week. “We’re optimistic the legislation will pass.” 

Speaking at the same summit Thursday, U.S. Cybersecurity and Infrastructure Security Agency Director Jen Easterly said that while many of the threats are not new, they remain worrisome, given “how vulnerable some of our critical infrastructure sectors are.” 
…

Google plans to invest $1 billion in Africa over the next five years to ensure access to fast and cheaper internet and will back startups to support the continent’s digital transformation, it said on Wednesday.

The unit of U.S. tech company Alphabet Inc made the announcement at a virtual event where it launched an Africa Investment Fund, through which it will invest $50 million in startups, providing them with access to its employees, network and technologies.

Nitin Gajria, managing director for Google in Africa told Reuters in a virtual interview that the company would among others, target startups focusing on fintech, e-commerce and local language content.

“We are looking at areas that may have some strategic overlap with Google and where Google could potentially add value in partnering with some of these startups,” Gajria said.

In collaboration with not-for-profit organization Kiva, Google will also provide $10 million in low interest loans to help small businesses and entrepreneurs in Ghana, Kenya, Nigeria and South Africa so they can get through the economic hardship created by COVID-19.

Small businesses in Africa often struggle to get capital because they lack the necessary collateral required by banks in case they default. When credit is available, interest rates are usually too high.

Google said a program pioneered last year in Kenya in partnership with Safaricom that allows customers to pay for 4G-enabled phones in instalments would be expanded across the continent with mobile operators such as MTN, Orange and Vodacom.

Gajria said an undersea cable being built by Google to link Africa and Europe should come into service in the second half of next year and is expected to increase internet speeds by five times and lower data costs by up to 21% in countries like South Africa and Nigeria.
…

The United States is taking new steps to make sure the country’s air and surface transportation sectors will not be crippled by ransomware or cyberattacks.

Homeland Security Secretary Alejandro Mayorkas announced the measures Tuesday at a virtual cybersecurity conference, warning that recent incidents such as the SolarWinds hack and the Colonial Pipeline ransomware attack showed that “what is at stake is not simply the way we communicate or the way we work, but the way we live.”

The new security directives target what the Department of Homeland Security and the Transportation Security Administration describe as “higher risk” rail companies, “critical” airport operators, and air passenger and air cargo companies.

Cybersecurity coordinators

Mayorkas said that going forward, the rail companies will have to name a cybersecurity coordinator who will report any incidents and create contingency plans in the case of a cyberattack.

The aviation companies will also be required to appoint a cybersecurity coordinator and report incidents to the DHS’s Cybersecurity and Infrastructure Security Agency.

Similar cybersecurity directives are already in place for 2,300 critical maritime companies that, starting this month, will have to submit plans to identify and address cyber vulnerabilities.

The U.S. Coast Guard is also working with the International Maritime Organization to require that passenger and cargo vessels arriving in U.S. ports have plans to deal with cyber emergencies.

“Whether by air, land or sea, our transportation systems are of utmost strategic importance to our national and economic security,” Mayorkas said.

Spike in ransoms paid

Top U.S. officials, including Mayorkas and FBI Director Christopher Wray, have warned that cyberattacks and ransomware attacks, in particular, have become a persistent threat.

“Last year, victims paid an estimated $350 million in ransoms, a 311% increase over the prior year, with the average payment exceeding $300,000,” Mayorkas told U.S. lawmakers at a hearing last month.

“We’re now investigating over 100 different types of ransomware, each with scores of victims,” Wray added.

U.S. officials have blamed Russia for many of the attacks, saying that despite Moscow’s assurances, they have seen few indications the Kremlin is doing anything to address the problem.

Russian officials deny any role in the recent, high-profile ransomware attacks.

Speaking at a separate cybersecurity forum Tuesday, the head of U.S. Cyber Command warned the problem with ransomware is likely to persist.

“Our adversaries are targeting everyone,” General Paul Nakasone told the Mandiant Cyber Defense Summit. “What was once viewed as criminal behavior has become a national security issue.”

To help facilitate the fight against cyberattacks and ransomware attacks, U.S. lawmakers are considering several bills that would require private companies to report intrusions and attacks on the government.

“We’re optimistic the legislation will pass,” Mayorkas said Wednesday at the annual Billington CyberSecurity Summit.

“I think we’re at a point, seeing the arc of cybercrimes and the cyberthreats, that really there’s an urgency to it,” he said.

 
…

Amazon.com Inc.’s livestreaming e-sports platform Twitch said Wednesday that it had been hit by a data breach. It gave no details.

An anonymous hacker claimed to have leaked Twitch data, including information related to the company’s source code, clients and unreleased games, according to Video Games Chronicle, which first reported the news of the hack.

Twitch confirmed the breach and said its “teams are working with urgency to understand the extent of this.”

The company declined to comment further and said ((https://twitter.com/Twitch/status/1445770441176469512)) it would “update the community as soon as additional information is available.” Amazon did not immediately respond to a request for comment.

The hacker’s motive was to “foster more disruption and competition in the online video streaming space,” according to the Video Games Chronicle report.

About 125GB of data was leaked, including information on Twitch’s highest-paid video game streamers since 2019, such as a $9.6 million payout to the voice actors of popular game “Dungeons & Dragons” and $8.4 million to Canadian streamer xQcOW, the report said.

“Twitch leak is real. Includes significant amount of personal data,” cyber security expert Kevin Beaumont tweeted.

Twitch, which has more than 30 million daily visitors on average, has become increasingly popular with musicians and video gamers. They interact with users while live streaming content.

The platform, which was boycotted earlier this year by users for not doing enough to block harassment, previously made a move to ban users for offenses such as hate-group membership and credible threats of mass violence.
…