HP Wolf said this fear was justified, because evidence has already emerged that ransomware gangs unaffiliated with Russia’s APT29 or Cozy Bear, the group that hacked the SolarWinds Orion platform in a US-focused espionage campaign, have used some of the TTPs leveraged by the spooks in their own campaigns.
“Tools developed by nation states have made their way onto the black market many times,” said Ian Pratt, global head of security for personal systems at HP Inc. “An infamous example is the Eternal Blue exploit, which was used by the WannaCry hackers.
“Now the return on investment is strong enough to enable cyber criminal gangs to increase their level of sophistication so that they can start mimicking some of the techniques deployed by nation states, too.
“The recent software supply chain attack launched against Kaseya customers by a ransomware gang is a good example of this. This is the first time I can recall a ransomware gang using a software supply chain attack in this way.”
Pratt said the Kaseya incident had created a blueprint for financially motivated threat actors to monetise attacks developed by nation-state actors, which meant they were now likely to become more widespread.
“Previously, an independent software vendor [ISV] with a modest-sized customer base that didn’t supply government or large enterprise may have been unlikely to become targeted as a stepping-stone in a supply chain attack,” he said. “Now, ISVs of all types are very much in scope for attacks that will result in compromised software and services being used to attack their customers.”
Besides the risk from cyber criminals, more than half – 58% – of decision-makers said they were concerned about being directly targeted by a nation state, and 70% feared they could end up becoming collateral damage in a hypothetical future cyber war. The main concerns relating to nation-state attacks were sabotage of IT systems or data, disruption to everyday operations, data loss or theft, and revenues loss.
“This is a very real threat that organisations need to take seriously,” said Pratt. “Whether defending against a cyber criminal gang using nation-state tools and techniques, or a nation state itself, organisations are facing an even more determined adversary than ever before.”
He advised decision-makers to re-evaluate how they go about managing cyber risk. Given that no single tool or technique can possibly guarantee 100% protection, leaders must take a more architectural approach to cyber, said Pratt.
“This means mitigation through robust security architectures that proactively shrink the attack surface, through fine-grained segmentation, principles of least privilege, and mandatory access control.”