Advanced, Persistent or State-Sponsored Cyber Threat Actors

Unlike other cyber threat actors, the cyber threat actors that carry out more comprehensive, long-term cyber attacks that require large budgets and are more effective in their results, and that are also supported by states’ intelligence units, have become a plague for countries and large companies.

Known as Advanced Persistent Threat, or APT for short, these actors, after first infiltrating the systems they target, run a piece of malware called a backdoor that lets them re-enter the system. By running malicious code on systems in the target network, they achieve privilege escalation and equip themselves with up to the highest level of user privileges in the system. After neutralising the protection of the system’s defence mechanisms, namely firewall systems, the large-scale antivirus software called EDR/XDR (Endpoint/Extended Detection and Response), and the tools called SIEM (Security Information and Event Management) in which all log records in the system are analysed, they aim to reach the furthest point that can be reached through lateral movement within the system. Having gained access to the files in the target system, they take full command and control of the system and bring the attack to its conclusion.

The view that such advanced cyber attacks with persistent effects are supported by states is widely accepted. For example:

Microsoft’s Digital Defense Report stated that 58% of state-sponsored cyber attacks in 2021 originated in Russia. The success rate of the country’s hackers rose from 21% the previous year to 32% in 2021. The reason given is that cyber attacks are not pursued through a very strong legal framework in Russia and similar countries, and that these incidents are not seriously dealt with. The report, which stated that the US was the country most targeted by cyber attacks, recorded the highest attack volumes from North Korea, Iran and China. South Korea and Türkiye also appeared in Microsoft’s annual report for the first time.

There are many well-known APT groups. Let us briefly touch on the first that come to mind and the attacks they have carried out recently.

APT29 and the SolarWinds Attack

The APT29 team, thought to be backed by Russia, is believed to be behind the SolarWinds attack that caused a large-scale crisis in the US.

The attack, which exploited a software vulnerability that arose when downloading an update of SolarWinds’ program called Orion, looks set to eclipse WannaCry as probably the costliest cyber attack in history. Although the US Treasury, Department of Homeland Security and Commerce Department, as well as parts of the Pentagon, are believed to have been affected, the true scale of the attack is still not fully known. The 18,000 SolarWinds customers exposed to the first stage of the Sunburst malware attack are carrying out threat assessments to determine whether they were among the attackers’ priority targets. Microsoft identified more than 40 customers that were compromised with additional and complex TTPs (tactics, techniques and procedures) on top of existing TTPs and that were strategically targeted by the threat actors.

It is assessed that there were at least two different threat actors in the SolarWinds network. One was the APT-grade threat actor discovered by FireEye, while the other was a less sophisticated threat actor spreading the SUPERNOVA backdoor.

APT31 Attacks

APT31 is an APT group with links to the Chinese government, also known as Zirconium, Judgment Panda and Red Keres. APT31 is one of the three threat groups to which the UK government, the Five Eyes countries (US, UK, New Zealand, Canada and Australia), the European Union, NATO and Japan officially attributed the Microsoft Exchange server attacks, as hackers linked to the Chinese government. Last year APT31 is believed to have targeted government institutions, political figures, contractors and service providers in European countries, including the Finnish parliament.

Stuxnet

Stuxnet is a complex, multifaceted piece of malware that disrupted uranium enrichment centrifuges in Iran and slowed the country’s nuclear programme by several years. The use of cyber weapons against industrial systems occurred for the first time with the Stuxnet attack. Believed to be a US-backed attack, Stuxnet, a malicious worm able to spread rapidly by itself over a network, affected the uranium enrichment centrifuges by setting their rotation speed to a very high level, thereby physically destroying them.

Ways to Protect Against APT Attacks

While it is not possible to definitively block state-sponsored advanced persistent threat actors, as with all other cyber threats, reducing existing risks and bringing them down to acceptable levels is a more realistic goal. In this context:

• Since most targeted attacks begin with phishing or other social engineering techniques, companies or institutions should give their employees basic cybersecurity training and make sure they are aware of cybersecurity policies.
• Access controls should be tightened, multifactor authentication (MFA) applied to network-connected systems, and protection provided against possible data leaks.
• A proactive response strategy against threats should be pursued by ensuring that cybersecurity teams have access to advanced threat intelligence (TI) and actively track threat actors.
• Advanced security solutions should be used that detect potential threats and the attack vectors known as zero-day vulnerabilities, for which no countermeasures have yet been developed, at an early stage.
• Security patches should be kept up to date to reduce the number of vulnerabilities APT attackers can exploit.
• Security gaps in the network should be closed by building a multi-layered security infrastructure; with a security architecture consisting of firewall, WAF (Web Application Firewall), IPS (Intrusion Prevention System) and SIEM (Security Information and Event Management), access requests and login operations, in addition to anomalies in the system, should be reviewed more quickly and unusual behaviour detected.
• Creating a whitelist and determining which domains and applications may be accessed from the network further limits the APT attack surface.

Conclusion

According to US-based cybersecurity organisations, the damage of cyber attacks to the global economy is expected to reach 6 trillion dollars by the end of 2021. It is also forecast that the global cost of cyber attacks will rise from 3 trillion dollars in 2015 to 10.5 trillion dollars by 2025.

Business Wire, a Berkshire Hathaway subsidiary, estimates that the cybersecurity market, worth 161 billion dollars in 2019, will reach 363 billion dollars in 2025. Behind this strong forecast lies the increase in investment in cybersecurity in recent years. Especially the shift of most sectors to remote working as part of the measures taken after the pandemic once again demonstrated the importance of cybersecurity. With the workforce dispersed across various locations and digital adaptation accelerating, cybersecurity has become a necessity rather than an option for companies. According to Crunchbase data, investment in the cybersecurity sector reached its highest level so far in 2020 at 7.8 billion dollars, while investment in companies operating in cybersecurity has increased ninefold since 2011.

While all these data show the importance of cybersecurity and the seriousness of the threats, they also clearly reveal that there are serious signs of learning from the mistakes made before the coronavirus pandemic. Let us hope that these investments are not superficial measures put in place out of economic concern against a long-term security threat, but realistic steps taken to prevent greater costs and suffering likely in the future. Because none of us is sure whether the world could bear another coronavirus crisis!