In all the years I’ve worked in the cybersecurity field (nine if anyone’s counting), I haven’t seen as much reporting in the media about foreign states interfering with western government elections as I have in the last few months. The latest publication to get me thinking about this topic was the statement by William Evanina, the Director for the US National Counterintelligence and Security Center, where he claimed: 

“Foreign states will continue to use covert and overt influence measures in their attempts to sway US voters’ preferences and perspectives, shift US policies, increase discord in the United States, and undermine the American people’s confidence in our democratic process.” 

A pretty big claim to make in a public statement. Mr. Evanina goes into some detail about the threats he perceives emanating from the People’s Republic of China (PRC), Russia, and Iran; three heavy hitters when it comes to state-linked espionage activity. This statement comes after US government officials recently announced that Russia influenced the 2016 US presidential election and, across the pond, Reuters reported a UK government minister’s email account was compromised by Russian threat actors to influence the 2019 UK general election. With the 2020 US presidential election fast approaching, I expect we will see a lot more on this topic, so I thought now would be an excellent time to explore the murky world of cyber espionage and try to illuminate what it’s all about.

Breaking down cyber espionage

Traditionally, the act of espionage involved using human spies to gather information about a foreign government on behalf of a nation-state. Cyber espionage is essentially the same but with the help and expertise of some highly sophisticated and technically capable cyber threat actors. These cyber threat actors will work with and on behalf of a nation-state, typically as a collective, often referred to as advanced persistent threat (APT) groups, rather than lone actors. Using cyber threat actors and the Internet is an easy and attractive means of gathering this type of information; there are no geographical boundaries or hindrances. A threat actor in China can launch an attack against any government in the world without leaving the comfort of their bedroom. Admittedly, not quite as glamorous as the images we all have of a traditional espionage agent, but it’ll save some money. 

Espionage attacks operated from a distance can also be more challenging for a victim country to attribute. These actors are sophisticated and will know how to hide their whereabouts, leaving security researchers making links based on the tactics, techniques, and procedures (TTPs) used in the attack. While they do a great job, it’s not foolproof. Lastly, and most appealingly, some might argue, a cyber threat actor can remain undetected in a network for months on end and steal vast amounts of information in a single session if given a chance.

The effects of espionage differ based on the end-goal of the driving force behind the activity. So (for example) if Iran wanted to meddle in the US elections, it could use espionage activity to spread disinformation and attempt to sow discord among the population with the goal of undermining the democratic institution of the US voting regime. The PRC government on the other hand has been more closely associated with R&D theft (such as recent reporting around COVID 19 medical research). APT groups are typically used to achieve these aims and do so by gaining access to a target network, residing there for as long as possible without being detected, and gathering valuable information.

Methods of cyber espionage madness

How do they gain access to the network? Put simply, in most cases it’s spearphishing. Of course, there are other means of accessing a system, but spearphishing, a targeted version of phishing, is a tactic favored in many instances by these groups. Threat actors take some time to research their targets to deliver more specialized and more successful spam email campaigns. The emails will contain malicious attachments or URLs that allow the attackers free reign within a network when executed. It seems too simple to be true, but its popularity as an initial infection technique stems mostly from its success; it’s a low effort, high reward enterprise. The age-old mitigation advice is still the best defense here: Make sure you, and any employees you are responsible for, are careful to not open attachments or click on links that come from an unknown or unusual source, or implement a second method to verify the validity of the email.

At Digital Shadows (now ReliaQuest) we’re seeing an increased trend for APT groups to also using their espionage skills to help businesses gain competitive advantage and even to conduct criminal activity. It’s not uncommon for organizations to use these groups to gain a competitive advantage over their rivals. A recent example of this is the RedCurl group that specializes in corporate espionage by using business email compromise. Since 2018, RedCurl has conducted 26 campaigns against 14 organizations, spread across six countries. It’s targeting organizations across multiple sectors, including finance and legal, but most interestingly, it targets organizations in Russia, despite being a Russian-speaking group. This behavior is unusual, as Russian cyber threat actors prefer to avoid the Russian intelligence services’ attention, which makes me think that although the group speaks Russian, they probably aren’t based there. Demonstrating my earlier point, RedCurl favors spearphishing as their initial attack vector. They pretend to be a member of the victim organization’s HR team and write well-crafted emails to fool employees into opening malicious attachments. After a successful infection, the group has access to the victim’s network and spends months going undetected within it, stealing all the information. Super sneaky. 

Figure 1: Graphic depicting RedCurls’ victim base (Source: GroupIB)

Reporting on cyber espionage

I was interested in reading the UK government’s report on Russia when it was finally published, mostly because I don’t remember the last time the UK was so open about a threat from that part of the world. Interestingly, the report included comments from the UK’s Government Communications Headquarters (GCHQ) stating there was a “considerable balance of intelligence… which shows links between serious and organized crime groups and Russian state activity.” GCHQ even went as far as describing it as a “symbiotic relationship.” In layman’s terms, they roll deep. The most famous, or infamous, example of this is probably the Russian cybercrime group known as Evil Corp. Evil Corp is notably responsible for distributing Dridex malware, Bitpaymer ransomware, and now WastedLocker ransomware, which was used recently to attack Garmin. At the end of last year, two of Evil Corp’s members were the subject of sanctions by the US Treasury Department. Evil Corp’s supposed leader, Maksim Yakubets, was openly associated with the Russian state in those sanctions. A perfect demonstration of GCHQ’s well made, if not a bit wordy, point.

A note on cyber espionage groups

Evil Corp is predominantly a criminal group that has some state backing. APT groups primarily conduct espionage activity but are starting to branch out into the criminal marketplace. For example, APT 41 (aka Winnti group) is associated with the PRC and has been attributed to multiple espionage campaigns that seek to fulfill the PRC’s needs. In a fascinating divergence from this activity, the group has also targeted the gaming sector in a move that seems to demonstrate them operating for financial gain over ideological reasons.

Rolling right back to Mr. Evanina’s statement, he only mentions threats from China, Russia, and Iran impacting on the US elections. Still, I couldn’t write a blog on espionage and leave out one of the most well-known APT groups: Lazarus. The Lazarus Group is publicly attributed to the North Korean state and has been associated with multiple espionage campaigns since its inception. However, most of you will probably know Lazarus for its attack against the UK’s National Health Service using WannaCry ransomware back in 2017. Lazarus hasn’t stopped being bad since then, but they have reportedly just returned to the criminal scene with their new VHD ransomware. It’s not clear to me why they have chosen to return to the ransomware game this year of all years, but I’d guess that their motives are financial. I would additionally wager that they plan to capitalize on the success of other dedicated ransomware groups who don’t seem to be slowing down any time soon – but that’s an entirely different story.

The threat of espionage campaigns on the upcoming US election

It’s unlikely that any espionage campaign would significantly change the outcome of an election result, but that doesn’t mean to say these campaigns won’t affect the way that voters think, at least to some degree. We can rely on, though, that espionage campaigns will continue to emanate from nation-states seeking to improve their competitive advantage, in whatever sector, over other countries. It’s my personal belief that the more we talk about the groups doing this, precisely the why’s and the how’s, the better. Whether within government or a large corporation, every employee has a responsibility for stopping that one rogue email slipping through the net; knowing what they need to look out for can be an integral part of keeping secrets secret.