The stories dribble in weekly, sometimes more frequently; tales of yet another company crippled by ransomware: the servers and desktops of a law firm, a shipping company, a steel mill or a forensic test centre rendered unusable, because malware has found its way into their network and spawned – shutting down systems with a simple message: your money or your network’s life.
It’s not so much a kidnapping as a twenty-first century highway robbery, and bandits scan the virtual highways of the internet like never before, shaking down organisations for ransoms payable in flavours of cryptocurrency that business leaders have sometimes never heard of, but which cost them real money: in forced downtime, credibility, and sometimes in the ransom itself.
Ransomware Hit on Honda a Reminder: Nobody’s Immune
Among the prominent companies hit in recent months: Honda, one of the world’s biggest car manufacturers; Cognizant, a major IT services company; Finastra, a prominent banking services provider; MaxLinear, a NYSE-listed semiconductor specialist: the list goes on. (By one estimate, a business will fall victim to a ransomware attack every 11 seconds this year.)
Executives are often publicly pugnacious on their refusal to pay up: MaxLinear said in an SEC filing this month, for example, that it has “no plans to satisfy the attacker’s monetary demands”, despite their release of stolen material, and threats to release further proprietary information harvested in the attack.
Often however, as many security experts will tell you, business leaders swallow their pride and cough up; the ransom blinking through a string of wallets and disappearing, like the culprits, into a world in which both criminal and loot are just binary code, waving thanks and bye; no pursuing police officers waving handcuffs anywhere in sight; or even imaginable.
Ransomware may be nearly as old as the internet, but it is, in short, having a storming revival. And while it might be just one tool in the cybercrime armoury, it is one that for visceral, frustrating impact has few equals — all while netting cybercriminals an estimated $1 billion a year, according to a 2018 report commissioned from a leading academic by security firm Bromium.
A look at some cryptocurrency wallets certainly shows that there’s no shortage of liquidity. A recent Europol intelligence report, for example, notes that over an 18 month period the equivalent to €500 million (£444 million) flowed through one Bitcoin mixer: a wallet designed to obfuscate the source of funds. (Thirty percent of this came from the Dark Web, Europol said).
It is hugely challenging to track the precise source and volume of ransoms (more on that anon), but one thing is increasingly clear: ransomware is among the fastest growing [pdf] games in town for cybercriminals.
As Mike Hulett, head of technology and capabilities in the National Cybercrime Unit of the National Crime Agency (NCA) emphasises to Computer Business Review: “From a law enforcement perspective, if you’d asked us three years ago, I would say ransomware was seen as a bit of an annoyance.
“It wasn’t the issue that it is now, and it certainly wasn’t as sophisticated. It was a little bit of a spray-and-pray; the demands were pretty low.
“Now, by far, ransomware is the biggest problem that we face.”
So is anybody actually trying to catch these bastards?
“A pesky little IT problem”
As Hulett tells it, law enforcement agencies are taking a range of reactive and proactive measures to take on cybercriminals, but the blistering speed at which the playing field is evolving makes this no small task.
“The massive changes that we’ve seen in the last 10 years are probably exponentially different to any other 10 years in law enforcement history.
“What really changed between 1950 and 1970? We had the explosion of motorways across the country, so criminals started travelling.
“What really changed between 1970 and 1980? Not a lot. Between 1980-1990: people travelling more, a few more computers. The nineties to noughties: an explosion of mobile phones. But there’s been a massive rise in different things in the last 10 years that we simply couldn’t have conceived of.
He adds: “We’re having to move faster; traditional training paths, etc. in law enforcement are having to change to try and keep up.”
And, he notes, just in the past two years attackers have got significantly more sophisticated, not just in terms of the code base of their malware, but their broader sense of when to strike: “The attack often happens when maybe there’s a big acquisition about to be announced, a new product about to be launched, or a share offering which is taking the board’s full attention.
“The last thing they want is this pesky little IT problem they’ve heard about bothering them and knocking them off track.”
“Here’s your Windows 7 laptop and 50p for the slot on the side”
Seen from the outside, efforts to combat this plague often feel like a case of whack-a-mole: private sector companies teaming up with public sector partners to tear down the online infrastructure supporting such attacks. (The CTI League, one such partnership, took down an impressive 2,833 cybercriminal assets on the Internet in just five weeks earlier this year).
Yet infrastructure itself is so fast-moving (“what is this, the ’90s?” scoffs one security researcher when asked about private sector efforts to take down command & control infrastructure) and ransomware attacks keep coming like clockwork: it is exceptionally rare to hear of anyone ever getting caught.
Are the police, simply, outgunned?
Hulett is blunt in his response: “It would be difficult to argue credibly that we weren’t. The public sector are never going to be particularly cutting edge with their standard IT and training equipment that we give to people.
“We’ll bring in bright young things straight out of university; you come into law enforcement and it’s a case of ‘here’s your Windows 7 laptop and 50p to put in the slot on the side’. We’re not always keeping pace in general terms.”
“We can get to an individual level and map what they’re doing…”
Often however, such investigations straddle an amorphous boundary between “conventional” law enforcement/investigations, and national security — with agencies in the latter realm punching harder than many realise.
As one senior investigator working with a UK intelligence agency told Computer Business Review that visibility into criminal networks was more proactive than is often recognised; the challenge was making it prosecutable — then overcoming geopolitical issues that mean the culprits are often protected.
They said: “In the past, nation states haven’t been able to identify an individual. We can now. The scale of what we can do in an offensive capacity is similar to a targeted attack of the type that you could do if you were a [cyber] criminal. We can sit on an [criminal] organisation’s network and we can risk assess, to make sure that there’s no loss to life or serious risk to property.
“My team have gone to CEOs to tell them that they about to get attacked. That comes from sitting on a suspect’s network, watching what they are doing; capturing all the IPs that they’re going to be delivering from and crucially, the information that comes into their systems from — sometimes — the people who are funding them. So we can get to an individual level and map what they’re doing; with all the necessary authorisations taken into account.”
Exploiting Millisecond Breaks in a VPN
Another law enforcement interviewee who preferred not to be named said: “Cybercriminals make mistakes. They’ll often use a VPN and we can map when/where there’s a break [in the VPN] for a millisecond.
“And because we’ve got agreements in place with many providers, they’re not breaching their terms with their users; we’re just being able to take advantage of a natural occurrence [to gain intelligence on the attacker].”
Marc Rogers, an experienced white hat hacker who now heads up cybersecurity strategy at security firm Okta, told Computer Business Review that private sector actors — in terms of taking proactive measures to help combat cybercriminals — have often limited themselves to the low-hanging fruit, identifying indicators of compromise (IoCs) and taking down malicious domains, but “we are literally drinking from the fire hose”.
He adds: “Too often organisations make it easy for attackers: there’s a lot of old infrastructure that has inadvertently been exposed to the internet; there’s unpatched things that we would hope to have been patched by now…”
Yet Rogers, along with other public and private sector interviewees agree: collaboration between well-resourced security firms and law enforcement has never been better, nor more international. Formal and informal collaborations make intelligence gathering more robust than many give credit for, even if the consequences of that work rarely make it into the public domain: sometimes because it is just quietly disruptive, sometimes because attempts to prosecute run up against an unhelpful nation state shielding the culprits.
Tracking the Links Upstream
Shelton Newsham, of Yorkshire and Humber Regional Cyber Crime Unit, points Computer Business Review to the recent (and strikingly detailed) indictment of Maksim Yakubets, a Russia-based, Ukraine-born malware kingpin who drives a Lamborghini with a number plate that reads “Thief” as an example of a successful investigation against a leading figure in the cybercrime world.
As the de facto leader of Evil Corp, he was described unequivocally in December 2019 by British and American intelligence agencies as “the most significant cyber crime threat to the UK.”
Yakubets is now subject to a $5 million US State Department reward – the largest ever reward offered for a cyber criminal – and faces extradition to the US if captured outside of Russia.
Newsham said: “If someone is sponsored by a nation state, ‘allegedly’, an individual is identified and links continue to be made with leaders of a nation state, that has political implications. Once you indict an individual that’s got personal, economic or whatever links to people within a political structure. That’s a whole different animal. That’s that’s the thing to get across.
“People think: you’re a toothless tiger and by indicting somebody because you’ll never get them. But now there’s a much bigger picture. There’s a much more strategic view of this in relation to the disruption that attribution to an individual causes; but it also stops becoming as simple as prosecuting a crime.”
The NCA’s Hulett adds: “It’s very difficult to tell whether you’re being attacked by a cyber criminal or a hostile nation state. From a tactical perspective, what we see them do is virtually the same. And if you look at where state actors, what do you mean by that? Is that state-trained? Is it state-sanctioned, state-turned-a-blind-eye-to? State-financed? There are all shades of grey.”
“There are other OCGs [organised crime groups] who are tasked by the state, particularly in the Russian arena: ‘go and do a job for us’. So it becomes a very blurred line between what is criminal activity and what is hostile state activity. That’s forced law enforcement and intelligence services far closer together.
Russia Remains a Problem
He adds: “I don’t want to give the impression that cyber crime is a Russian problem. It is not. But people actually in Russia, or Russians, or Russian speaking people in other countries, are the majority of our problem.
“I think, sadly, from a law enforcement perspective, we play very much second fiddle to the wider geopolitical situation and diplomatic position. It seems to be an unwritten rule in Russia that if you if you attack a Russian bank, then then the Russians will come after you. If you sit in Russia and attack the West you can almost do so with impunity. The chances of there being cooperation from Russian law enforcement against a Russian national are slim.
“With things like child sexual abuse there is cooperation.
“We can exchange intelligence and information with the Russians and they will act on it. With cyber it’s a different situation, I’m afraid. So we we tend to rely on opportunities elsewhere in the world.”
Meanwhile, despite best efforts, attacks remain rampant.
And as Jasmit Sagoo from security firm Veritas puts it: “Companies have to prepare for when this happens not if it happens.
“They have to take their data back-up and protection more seriously as a source of recovery. The “3-2-1 rule” is the best approach to take. This entails each organisation having three copies of its data, two of which are on different storage media and one is air-gapped in an offsite location. With an offsite data backup solution, businesses have the option of simply restoring their data if they are ever locked out of it by criminals exploiting weaknesses in systems. Realistically, in today’s world, there’s no excuse for not being prepared.”