Russian winter cyber offensive | Cyber Intelligence Briefing: 9 December

Top news stories this week

1. Winter is coming. Microsoft warns of new winter Russian cyber offensive against Western targets.
2. Rackspace hack. Ransomware attack at major cloud computing provider leads to service outages.
3. Weaponising AI? OpenAI’s new GPT-3 chatbot demonstrates malicious capabilities.
4. Incident reporting. Swiss government proposes duty to report attacks on critical infrastructure.
5. Healthcare under fire. Hospitals in France and India crippled by separate cyber-attacks.
6. Mind your macros. Hackers target cryptocurrency firms with malicious macro-embedded files.

Don't miss our deep dive on EvilProxy.

Watch S-RM experts discuss this new threat trend.

1. Russian winter cyber offensive?  

Microsoft has released a global warning to be prepared for an uptick in Russian cyber-attacks this winter following battlefield losses in Ukraine. Separately, the Netherlands’ National Coordinator for Security and Counterterrorism has urged its citizens to prepare survival kits in case critical infrastructure is compromised. NATO also held its annual Cyber Coalition exercise in Estonia this week to model attack scenarios.

SO WHAT?

Disaster management and recovery plans should consider scenarios where critical national infrastructure is impacted as a result of a cyber-attack. 

2. Exchange outage after cloud provider Rackspace hit by ransomware

Texas-based cloud computing provider Rackspace has confirmed that a ransomware attack last Friday (2 December) led to an extended outage of its Hosted Exchange email servers. The company has received backlash from customers on social media, with frustrations stemming from a lack of communication over the weekend and difficulties migrating to Microsoft 365, a solution offered by Rackspace to restore services.

SO WHAT?

The immediate aftermath of an incident is confusing, but there is a need for clear, direct, and timely communication with customers to avoid reputational fallout. Incident response should take public communications into account.

3. ChatGPT releases hints at potential impact of AI on cyber security

Researchers have been exploring the security implications of OpenAI’s powerful new artificial intelligence chatbot ChatGPT, which was launched last week. In one case, the tool was able to identify and exploit vulnerabilities in a piece of code. Additionally, the AI can be used to generate highly convincing phishing emails.

SO WHAT?

Artificial intelligence is set to revolutionise the way we work. It could be leveraged to enhance security, but it is a powerful dual use technology which can be weaponised by malware developers and other cyber criminals. 

4. Swiss government proposes mandatory duty to report cyber-attacks  

The Swiss government has proposed a mandatory requirement for critical infrastructure providers to report cyber-attacks to the National Cyber Security Centre. The proposed amendment to existing legislation is designed to provide more visibility on cyber crime.

SO WHAT?

 It is important to stay up to date with changes to legislative and regulatory frameworks that may impose obligations and constraints on the victims of cyber-attacks. 

5. Healthcare sector under fire

The Centre Hospitaller de Versailles on the outskirts of Paris was forced to cancel operations after a major cyber-attack. The hospital transferred critical patients to other facilities and services were suspended. Separately, India’s leading state hospital has recovered its systems following a two week disruption due to an intrusion from an unidentified threat actor.

SO WHAT?

Healthcare organisations make attractive targets due to chronic underinvestment in cyber security. They must remain vigilant and have robust security measures in place to protect their systems and the people they serve.