Nation-state cyber attacks could lead to cyber conflict

A new report from HP released Thursday, Nation States, Cyberconflict and the Web of Profit, found that nation-state cyber attacks are “moving us closer to a point of advanced cyber conflict.”

“Nation-state conflict doesn’t take place in a vacuum; as evidenced by the fact enterprise is the most common victim within those attacks analyzed,” Ian Pratt, global head of Security for Personal Systems at HP, said in a statement. “Whether they are a direct target or a stepping-stone to gain access to bigger targets, as we have seen with the upstream supply chain attack against SolarWinds, organizations of all sizes need to be cognizant of this risk.”

SEE: Social engineering: A cheat sheet for business professionals (free PDF) (TechRepublic)

The research, which was sponsored by HP and conducted by Mike McGuire, senior lecturer in criminology at the University of Surrey, found a 100% rise in “significant” nation-state incidents between 2017-2020. McGuire, who looked at over 200 cybersecurity incidents associated with nation-states since 2009, found that enterprise-class organizations are now the most common target (35%), followed by cyber defense (25%), media and communications (14%), government bodies and regulators (12%) and critical infrastructure (10%). 

“Nation-states are devoting significant time and resources to achieving strategic cyber advantage to advance their national interests, intelligence gathering capabilities, and military strength through espionage, disruption and theft,” McGuire said in a statement. “Attempts to obtain IP data on vaccines and attacks against software supply chains demonstrate the lengths to which nation-states are prepared to go to achieve their strategic goals.”

McGuire also relied on first-hand intelligence gathering from informants across the Dark Web and consultations with an expert panel of 50 leading practitioners in relevant fields (such as cybersecurity, intelligence, government, academia and law enforcement) to develop his findings. What he found was a “clear picture of escalations in tensions” that are being supported by increasingly complex structures that intersect with the underground cybercrime economy known as the “Web of Profit.”

Other findings include: 

• The increase in attacks represent a “worrying” or “very worrying” escalation in tensions
• COVID-19 presented a “significant opportunity” for nation-states to exploit
• Supply chain attacks such as the SolarWinds hack increased 78% in 2019
• Between 2017 and 2020 there were 27 software supply-chain attacks associated with nation-state actors
• Over 40% of cyber attacks involved targets with physical and digital components such as an energy plant—a phenomenon known as “hybridization”
• Nation-states may be “stock-piling” Zero Day exploits 
• Most experts believe nation-states are monetizing cybercrime
• Nation-states are recruiting cybercriminals to conduct attacks

SEE: Identity theft protection policy (TechRepublic Premium)

Nation-states and the Web of Profit

The study also found that nation-states are buying tools and services from the Dark Web and thus contributing to the Web of Profit. Likewise, tools developed by nation-states are making their way onto the black market. The Eternal Blue exploit that was used by the WannaCry hackers in 2017 is a good example, the report said.

Even though 20% of incidents involved sophisticated, custom-made weapons such as targeted malware or weaponized exploits that were likely developed by nation-state cybersecurity programs, half involved low-budget, straightforward exploits that could be easily purchased on the Dark Web. 

Half (50%) of the tools used were built for surveillance, 15% enabled network incursion and positioning, 14% were for damage or destruction, and 8% for data extraction. The mix of tools suggests that nation-states are more focused on listening than stealing data.

“Cybercrime economies are shaping the character of nation-state conflicts,” McGuire said in a statement. “There is also a second generation of cyber weaponry in development that draws upon enhanced capabilities in computing power, AI [artificial intelligence] and cyber-physical integrations.”

Nation-states also are weaponizing chatbots to deliver phishing messages, react to new events and send messages via social media sites. In the future, deep fakes, drone swarms capable of disrupting communications or engaging in surveillance, and quantum computers capable of breaking almost any encryption algorithm will all be part of the digital battlefield, he said.

To de-escalate cyber-tensions and prevent nation-states from being drawn into further acts of cyberconflict, 70% of the expert panel say it is necessary to create a cyberconflict treaty, but few believe it will happen anytime soon.

Cybersecurity Insider Newsletter

Strengthen your organization’s IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices.
Delivered Tuesdays and Thursdays

Sign up today

Also see