How have nation-state threats advanced over the years?
The cyber threat landscape has changed considerably as there are now more state and non-state agents with greater capabilities. It’s no secret that China, Iran, Russia and North Korea are the biggest nation-state threat actors in the world today. And with each passing year, the offensive threats they pose have evolved as their cyber capabilities have improved. From stealing research data to disrupting critical infrastructure the stakes are now higher than ever before.
Let’s dive deep and see 5 ways nation-state threats are evolving.
1. Use of advanced never seen before technologies
On December 8, leading U.S. cybersecurity firm FireEye discovered that they had fallen victim to a nation-state attack.
In the course of their investigations, FireEye analysts encountered what they called “some of the best operational security exhibited by a threat actor”.
The sophisticated nature of the malware used in the malicious operations that affected tens of thousands of government agencies, public and private companies including universities and colleges around the world was unlike any that had been seen before.
One key component of the Trojan software that stole the show was a lightweight malware dropper. U.S. developers had never seen anything like it before and nicknamed it TEARDROP.
The purpose of this dropper was to load directly onto the target host’s memory without leaving any traces on the actual disk itself.
This was how Cozy Bear, the quasi-government state-sponsored hacking arm of Russia’s foreign intelligence service was able to penetrate high-level U.S. administrative offices and remain undetected for over eight months.
2. Threat vectors shifting gear to cripple critical infrastructure
Did you know that more than 90% of Microsoft’s 2020 security alerts regarding nation-state attacks focused on the dangers posed to non-governmental agencies?
Previously, state adjacent and state-sponsored hacker groups focused primarily on stealing data for criminal financial gain. Today, however, there is an emphasis on destruction and disruption of the operations of target nations.
Cyberwarfare has escalated with countries levelling espionage and threats against each other for geopolitical impact and or economic benefit.
We are seeing an increase in the distribution of malware that’s designed to cripple manufacturing facilities, interfere with logistics, as well as disrupt even research-oriented activities as was the case when Russian agents were accused of stealing COVID-19 vaccine research in 2020.
The most prolific pathway, however, that nation-states are now exploiting is third party vendor or supply chain infrastructures to gain entry into their victim’s networks as happened to IT distributor in December 2020.
3. Proliferation and commodification of cyber capabilities providing nation-states with more arsenal
There has never been a time in history where there was such a readily available supply of cyber offensive tools as today.
Tools abound for anyone – nation-state or not – to purchase and get into the cybercrime game.
This proliferation and commodification of cyber weaponry has lowered the barrier of entry for many threat vectors allowing for unprecedented surveillance and espionage.
Instead of building tailored tools organically, nation-states that were previously excluded are now finding it possible to purchase and so assemble their own arsenal of cyber tools giving them leverage to leapfrog into the cold cyberwar.
Within a few short months, these new nation-state threat agents can quickly rise from a mere emerging threat to a potentially disruptive established threat.
Such commodification has thrown the door wide open for persistent and more aggressive threats to surface from various quarters.
4. Nation-states engaging independent threat agents to do their work
Nation-state threat agents without the necessary skills and labour force to carry out sophisticated attacks on foreign nations themselves no longer have to wait to train their own people.
The growth of hacker groups – highly skilled and proficient cybercriminals – allows nations to outsource as it were their attack campaigns.
The same way in the physical world, rogue agents or mercenaries can be secretly engaged to carry out covert missions is the same way nation-state threats are evolving in the cyber realm.
Furthermore, the unregulated nature of digital currencies lends itself well to pay for such operations.
5. Nation-state threat vectors are hijacking supply chains
One of the fastest ways to attack a lot of people quickly with minimal effort is to focus on hijacking software that is utilized by a large part of the population.
This is the logic that the majority of nation-state threat agents are now employing. Why target a single company when you can find the common denominator – a shared software they all use and take advantage of a vulnerable backdoor?
This seemingly obvious strategy has been used with astounding success by Cozy Bear as demonstrated in the recent SolarWinds and FireEye incident which left over 18,000 U.S. government agencies, 425 Fortune 500 companies, and scores of public and private institutions compromised in December 2020.
By taking advantage of the trust most people have when updating software, malicious groups are able to easily infiltrate networks through innocuous means and wreak untold damage.
As technology has advanced so too has the nature and sophistication of nation-state cyber attacks. They are becoming more persistent, belligerent, and disruptive.
That’s not all but now threats are becoming increasingly harder to identify as well. State-sponsored hackers are moving at scale, targeting not only foreign governments but business entities as well.
As nation-state threats are evolving so are the type of threats being levelled against governments. It’s no longer just a matter of stealing sensitive data but of also crippling vital infrastructure such as energy grids.
In the face of such calculated attacks, organizations can use all the help they can get. Cybeta provides predictive, pre-emptive, powerful, cybersecurity solutions that can aid in the fight against cyber threats.
Get robust protection from our Threat Beta, Threat Alpha, and Overwatch systems all developed by U.S. Intelligence-trained experts.
Contact us for a consultation or more information.