A year after Russia invaded Ukraine, the war continues — including an ever-evolving digital element that has implications for the future of cybersecurity around the world. Among other things, the war in Ukraine has upended Eastern Europe’s cybercrime ecosystem, according to Google’s cybersecurity experts, upending the way ransomware attacks are played out.
See also: Hyundai and Kia release patch for dangerous security flaw
“Ransomware is still profitable, but financially motivated threat actors are not immune to geopolitical developments,” says a new report, compiled by Google’s Threat Analysis Group (TAG), Mandiant, and Google Trust & Safety.
“The lines are blurred between financially motivated and government-backed attackers in Eastern Europe,” the report states, “with threat actors shifting their targeting to align with regional geopolitical interests and government-backed attackers adopting some of the tactics and services associated with financially motivated actors.”
See also: Hackers use Havoc as an alternative to Cobalt Strike
As alliances shift, it is no longer taboo for cybercriminals to target Russian targets, the report notes. Furthermore, this war has encouraged an increased level of specialization among the various ransomware ecosystems, making it nearly impossible for authorities to properly identify and prosecute perpetrators.
Furthermore, the report states that surprisingly, there was no sudden increase in attacks against critical infrastructure—an unexpected result, given that ransomware threats are so prevalent.
Political divisions
According to the Google report, the war has disrupted Eastern Europe's cybercrime network. Hacking groups have taken sides in political and geopolitical conflicts, while other notable ransomware operations have been forced to shut down.
To demonstrate its allegiance to Russia, the Conti ransomware issued a warning before the war began that it would attack any nation that dared to oppose its leader. This caused a stir in the organization’s internal communications and codebase, Google reports. Surprisingly, instead of carrying out more attacks as it had stated – the group stopped its activities altogether.
Additionally, the Raccoon malware ceased activities when its alleged creator fled Ukraine after being pursued. He was subsequently arrested in the Netherlands and is now awaiting extradition to America.
See also: Emsisoft: Hackers are forging our certificates to compromise networks
Change of tactics
The conflict triggered a dynamic shift in ransomware methods . Initially, both state-backed and financially motivated hackers began using tactics not traditionally associated with their businesses .
Additionally, the report states that ransomware attackers are now specializing in just one part of the attack process and partnering with other businesses for assistance.
Throughout the war, attackers have explored innovative methods, such as new distribution channels and unconventional file. Financially motivated offenders are able to replicate the successful strategies of others, making it difficult to identify the mastermind.
Furthermore, the report comprehensively assesses Russia’s aggressive use of “information operations,” which includes both overt state-backed media outlets and covert platforms/accounts to establish a particular viewpoint regarding this war.
Overall, the report announces that cyberwarfare has become an essential factor in future armed conflicts, alongside more traditional forms. The authors hope that this report serves as a call to action for countries worldwide to prepare for potential upcoming battles.
Information source: zdnet.com
