WEBINAR | A Deep-Dive into 2023 Cyber Threats
Reduce Alert Noise and False Positives
Boost your team's productivity by cutting down alert noise and false positives.
Automate Security Operations
Boost efficiency, reduce burnout, and better manage risk through automation.
Dark Web Monitoring
Online protection tuned to the need of your business.
Maximize Existing Security Investments
Improve efficiencies from existing investments in security tools.
Beyond MDR
Move your security operations beyond the limitations of MDR.
Secure with Microsoft 365 E5
Boost the power of Microsoft 365 E5 security.
Secure Multi-Cloud Environments
Improve cloud security and overcome complexity across multi-cloud environments.
Secure Mergers and Acquisitions
Control cyber risk for business acquisitions and dispersed business units.
Operational Technology
Solve security operations challenges affecting critical operational technology (OT) infrastructure.
Force-Multiply Your Security Operations
Whether you’re just starting your security journey, need to up your game, or you’re not happy with an existing service, we can help you to achieve your security goals.
Detection Investigation Response
Modernize Detection, Investigation, Response with a Security Operations Platform.
Threat Hunting
Locate and eliminate lurking threats with ReliaQuest GreyMatter
Threat Intelligence
Find cyber threats that have evaded your defenses.
Model Index
Security metrics to manage and improve security operations.
Breach and Attack Simulation
GreyMatter Verify is ReliaQuest’s automated breach and attack simulation capability.
Digital Risk Protection
Continuous monitoring of open, deep, and dark web sources to identify threats.
Phishing Analyzer
GreyMatter Phishing Analyzer removes the abuse mailbox management by automating the DIR process for you.
Integration Partners
The GreyMatter cloud-native Open XDR platform integrates with a fast-growing number of market-leading technologies.
Unify and Optimize Your Security Operations
ReliaQuest GreyMatter is a security operations platform built on an open XDR architecture and designed to help security teams increase visibility, reduce complexity, and manage risk across their security tools, including on-premises, clouds, networks, and endpoints.
Blog
Company Blog
Case Studies
Brands of the world trust ReliaQuest to achieve their security goals.
Data Sheets
Learn how to achieve your security outcomes faster with ReliaQuest GreyMatter.
eBooks
The latest security trends and perspectives to help inform your security operations.
Industry Guides and Reports
The latest security research and industry reports.
Podcasts
Catch up on the latest cybersecurity podcasts, and mindset moments from our very own mental performance coaches.
Solution Briefs
A deep dive on how ReliaQuest GreyMatter addresses security challenges.
White Papers
The latest white papers focused on security operations strategy, technology & insight.
Videos
Current and future SOC trends presented by our security experts.
Events & Webinars
Explore all upcoming company events, in-person and on-demand webinars
ReliaQuest ResourceCenter
From prevention techniques to emerging security trends, our comprehensive library can arm you with the tools you need to improve your security posture.
Threat Research
Get the latest threat analysis from the ReliaQuest Threat Research Team. ReliaQuest ShadowTalk Weekly podcast featuring discussions on the latest cybersecurity news and threat research.
Shadow Talk
ReliaQuest's ShadowTalk is a weekly podcast featuring discussions on the latest cybersecurity news and threat research. ShadowTalk's hosts come from threat intelligence, threat hunting, security research, and leadership backgrounds providing practical perspectives on the week's top cybersecurity stories.
April 25, 2024
About ReliaQuest
We bring our best attitude, energy and effort to everything we do, every day, to make security possible.
Leadership
Security is a team sport.
No Show Dogs Podcast
Mental Performance Coaches Derin McMains and Dr. Nicole Detling interview world-class performers across multiple industries.
Make It Possible
Make It Possible reflects our focus on bringing cybersecurity awareness to our communities and enabling the next generation of cybersecurity professionals.
Careers
Join our world-class team.
Press and Media Coverage
ReliaQuest newsroom covering the latest press release and media coverage.
Become a Channel Partner
When you partner with ReliaQuest, you help deliver world-class cybersecurity solutions.
Contact Us
How can we help you?
A Mindset Like No Other in the Industry
Many companies tout their cultures; at ReliaQuest, we share a mindset. We focus on four values every day to make security possible: being accountable, helpful, adaptable, and focused. These values drive development of our platform, relationships with our customers and partners, and further the ReliaQuest promise of security confidence across our customers and our own teams.
More results...
It has almost been six months since Russia invaded Ukraine, and understandably, the world and its media have focused on this region. Since the onset of the war, there has been a resurgence of hacktivism, with the pro-Russian hacktivist group Killnet taking center stage. Threat groups like Wizard Spider and APT28 have also been observed conducting cyber threat campaigns against Ukraine. So, while attention focuses on Russia-based and pro-Russia threat groups, now is an excellent time to take a quick run-back through the other nations with highly developed cyber capabilities, outlining some key geopolitical points and previous cyber threat campaigns along the way.
Unsurprisingly, the PRC takes the top spot when it comes to offensive cyber capabilities. The PRC’s cyber strategy indicates a preference for avoiding direct confrontation, which makes cyber espionage a central part of its intelligence agenda. Most PRC-linked cyber attacks focus on intelligence property and proprietary information theft.
The PRC regularly uses cyber operations to pursue its national interests and has several advanced persistent threat (APT) groups at its disposal to perform attacks. These groups are among the world’s most sophisticated, technically capable, and persistent cyber-threat groups. For example, the “Winnti” threat umbrella has targeted multiple companies across the globe to obtain intellectual property valuable to the PRC-state, while the APT group “APT40” has targeted many universities in the US, Canada, and South-East Asia involved in nautical technology research. This activity aims to further the PRC’s naval modernization efforts. Also, since at least 2006, the PRC-linked APT group “APT1” has conducted cyber intrusions into 141 organizations globally to obtain “hundreds of terabytes” of data.
PRC-linked threat groups also use supply-chain attacks to achieve their aims. However, these attacks do not always generate the same media attention as, for example, the Russia-linked attack that used SolarWinds’ Orion Platform. In rare instances, some Chinese state-affiliated threat actors have conducted financially motivated cyber operations. “APT41” targeted the video game industry and manipulated virtual currencies to gain funds that were likely laundered on underground criminal platforms. At the same time, the APT group “APT27” targeted five online gambling firms in 2020 to deploy ransomware and extort their victims for financial gain.
Iran has greatly advanced its cyber capabilities over the past ten years. Although it remains less technically capable than the PRC and Russia, its attack campaigns are often successful, notably by relying on relatively simple tactics that still bypass even the most organized defenses.
Like most nation-states, Iran aims to obtain intellectual property advantageous to the state. Such information typically supports Iran’s endeavors, like retaliating against sanctions and previous attacks or establishing dominance in the Middle East. Primarily, attacks are focused on countries that have a strained geopolitical relationship with Iran, such as the US and Israel. The attackers are usually threat groups directly associated with the Iranian state or indirectly affiliated proxy threat groups; proxy groups take responsibility for the attack, allowing Iran to avoid international condemnation.
Iran-linked threat actors are likely involved in the operations of several different groups; there is evidence of overlapping infrastructure and tool/technique sharing. There are three main APT groups associated with the Iranian state: “APT35” (aka Charming Kitten), “APT34” (aka OilRig, Helix Kitten), and “MuddyWater” (aka TEMP.zagros). APT35 has conducted information-gathering campaigns in North America, the UK, and the Middle East since at least 2017, targeting individuals working in or covering issues that overlap with Iranian national security interests. APT34 is primarily active in the Middle East, targeting sectors such as financial services, government, education, telecommunications, and oil and gas. MuddyWater has also been active since at least 2017, targeting various sectors in Asia and the Middle East, likely to conduct espionage operations.
Like Iran, North Korea has a less developed offensive cyber capability when compared with Russia, the PRC, or the US. Despite this, a relatively large number of cyber attacks originate from the nation-state. North Korea has shown a propensity to conduct cyber attacks during a crisis—likely for disruption, espionage, and financial gain—and will highly likely continue such attacks until the state’s goals have been satisfied. In 2020, the US Cybersecurity and Infrastructure Agency (CISA) issued an advisory on North Korean cyber threats, stating that the nation-state was increasingly relying on cybercrime to generate revenue that would fund its weapons-of-mass-destruction and ballistic-missile programs. This move was likely implemented to overcome international sanctions imposed to prevent North Korea from achieving this objective.
Famed for its WannaCry attack on over 200,000 devices worldwide, the North Korea-linked “Lazarus Group” has also been responsible for several financially motivated cyber attacks. The group has conducted several high-profile campaigns designed to steal cryptocurrency, typically distributing spearphishing emails containing fake job advertisements tailored to the recipients’ specific skills and experience. Lazarus Group has targeted cryptocurrency and financial services entities in at least 14 countries globally since at least 2016, likely for financial gain. Lazarus Group will almost certainly continue targeting cryptocurrency platforms in the medium term, as cryptocurrency platforms often fall short in security, leaving investors susceptible to fraud.
Although relatively less advanced, North Korea’s technical capability has developed relatively quickly. APT groups linked to the nation-state have refined initial access techniques and demonstrated an in-depth knowledge of targets and their systems. Other notable threat groups operating in North Korea include “APT37” and “Kimsuky”.
Israel, with its innovative and advanced technology scene and its proactive military-intelligence capability, has one of the most advanced cyber-security and cyber-defense programs in the world. The primary motive behind Israel-initiated cyber-threat activity is likely combatting multiple threats from other nation-states and terrorist groups. Many of Israel’s cyber attacks aim to hinder Iran-sponsored militant groups and reduce the offensive capabilities of Iranian groups and their allies.
Although there is limited publicly available information about the activities of Israel’s intelligence agency, many cyber-attacks are politically motivated and aimed at providing advantage, be that political, strategic, or military, over Israel’s adversaries. In 2010, the Stuxnet worm was used to cause substantial disruption to Iran’s nuclear program, destroying one-fifth of Iran’s nuclear centrifuges and compromising more than 200,000 computers. Stuxnet targets SCADA systems and has been widely reported (but not confirmed by either nation) to have been jointly developed as a cyber-weapon by the US and Israel in a large, collaborative effort known as Operation Olympic Games.
Additionally, the Israeli technology company NSO Group is best known for developing the “Pegasus” spyware, which can be used for cyber espionage. Pegasus has reportedly been sold to several nation-states and groups that have used the software to surveil human-rights activists, journalists, and dissidents. Pegasus has been found on computers in the UK prime minister’s office and has also been used to target activists in Catalan and Bahrain.
While the US is highly unlikely to target private organizations, its cyber capability is one of the most developed in the world; in a 2021 study, the US was ranked the world’s top cyber superpower. The US’s advanced cyber capabilities are well organized and are designed to defend against and deter attacks from other regional superpowers, notably the PRC and Russia. The US has invested heavily in its cyber capabilities, and many domestic government entities regularly issue directives to help users and businesses bolster their cyber defenses. Despite this, many US organizations operate with networks vulnerable to compromise, making the US an ever-popular target for many cyber-threat actors. Such attacks have spurred the US to harden its defenses further and improve its capabilities in anticipation of new attacks from its rivals.
US-initiated cyber-attacks are typically conducted to defend its critical infrastructure and are seldom reported in the mainstream media. The biggest insight into offensive cyber activity conducted by the US came from documents leaked by Edward Snowden in 2013, a former employee of the US CIA. The leaked documents revealed that the NSA had reportedly been collecting the telephone records of tens of millions of Americans, as well as intercepting the servers of nine Internet providers to track online communications. Later, Snowden claimed the NSA had led more than 61,000 offensive cyber operations globally, including many targeting or affecting Hong Kong and the mainland PRC.
While the threat from Russia-linked threat actors—cybercriminal, nation-state, and hacktivist—isn’t going anywhere any time soon, it’s good to remember that threats emanate from a variety of countries with highly developed offensive cyber capabilities. Some nation-states might even take advantage of the Russia-Ukraine war, using it as cover, so their activity flies under the radar. If you want to read more about any of the threat groups mentioned in this blog, why not take a seven-day SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) test drive. You can also get a customized demo of SearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection) to understand your organization’s threats and risks, including access to a fully furnished threat intelligence library with MITRE associations and mitigations from the Photon Research Team.