Tuesday, February 20, 2024

Kremlin disinformation tactics stir new action

Delivered every Monday by 10 a.m., Weekly Cybersecurity examines the latest news in cybersecurity policy and politics.
Feb 20, 2024 View in browser
 
POLITICO's Weekly Cybersecurity newsletter logo

By Joseph Gedeon

With help from Maggie Miller and Antoaneta Roussi

Driving the day

— Democracies face a critical test as a Kremlin-backed disinfo war targets vital health care efforts in Africa, with growing concern over the attacks kickstarting the first steps of a global counteroffensive.

HAPPY TUESDAY, and welcome to MORNING CYBERSECURITY! The Hill is off this next week, and with no more football, now I need to find a hobby to fill the downtime. Is it bird watching season or something? Or maybe I should just try to turn to more of these steroid-esque hockey games.

Have any tips or secrets to share with MC? Or thoughts on what we should be covering? Find me on X at @JGedeon1 or email me at jgedeon@politico.com. You can also follow @POLITICOPro and @MorningCybersec on X. Full team contact info is below.

 

SUBSCRIBE TO GLOBAL PLAYBOOK: Don’t miss out on POLITICO’s Global Playbook, the newsletter taking you inside pivotal discussions at the most influential gatherings in the world, including WEF in Davos, Milken Global in Beverly Hills, to UNGA in NYC and many more. Suzanne Lynch delivers the world's elite and influential moments directly to you. Stay in the global loop. SUBSCRIBE NOW.

 
 

Want to receive this newsletter every weekday? Subscribe to POLITICO Pro. You’ll also receive daily policy news and other intelligence you need to act on the day’s biggest stories.

Today's Agenda

The Pentagon’s chief digital and AI officer, Craig Martell, is heading to the Defense Department’s Advantage DOD 24 Defense Data and AI Symposium, which kicks off today. 12:30 p.m.

At the Agencies

DISINFO WAR — A Kremlin-backed disinformation campaign aimed at disrupting Western health care efforts in Africa has set off alarm bells within the global intelligence community, prompting the United States and its allies to launch a coordinated counteroffensive.

U.S. envoy James Rubin, who heads the State Department's Global Engagement Center meant to expose and counter foreign state-backed disinformation attacks, told MC he met with American, British and Canadian counterparts at the Munich Security Conference to organize the first phase of a united front against Moscow’s disinformation globally.

“We're in a phase of information warfare in the continent of Africa and around the world where the Kremlin believes that they can benefit from conducting these operations,” Rubin told MC.

The news comes after the Munich Security Conference’s annual risk report showed a spike in global leaders’ concerns about AI-powered threats, with cyberattacks and disinformation campaigns also ranking highly among top security worries. With more than 50 elections worldwide this year, the revelations offer sobering lessons for democracies facing modern information warfare.

— Operation details: Dubbed the “African Initiative,” Russia’s disinfo outfit recruits local African journalists and influencers to launder anti-Western narratives undermining U.S. and European medical assistance across the continent.

It blurs the line between legitimate grievances over Western colonization and outright conspiracy theories blaming Western doctors for disease outbreaks — targeting millions across dozens of African countries.

The local offices for the “African Initiative” had been uncovered in both Burkina Faso and Mali, in western Africa.

— Early intervention: But Rubin believes the Africa-focused operation was detected early enough to prevent significant impact. After the first fabricated narratives blaming Western medics for disease outbreaks appeared, the U.S. rapidly alerted journalists, governments and health workers across Africa. This quick exposure is hoped to have blunted the disinformation before it could widely propagate.

"We believe we have captured real disinformation so early that that will prevent the campaign from having significant success," Rubin said.

— Wagner is alive: Rubin warned that operatives tied to Russia’s notorious Wagner Group “still exist” and remain dangerous. Some staff were recruited from the disbanded troll farms of late oligarch Yevgeny Prigozhin, who already had disinfo officers scattered across the continent.

And with many Russian operatives expelled from Europe due to the war in Ukraine, Africa may now be emerging as a key battleground for the global information war — and a testing ground for global attacks. And Russia already has a foothold in the continent’s disinformation landscape: A 2022 report from the Africa Center for Strategic Studies identified 23 campaigns across several countries in Africa, with 16 operations linked to the Kremlin.

— Not easy work: Concerns about Russia's evolving tactics are further amplified by a new report from the Center for the Study of Democracy in Europe, which details Russia integrating evolving cyber capabilities into disinfo efforts along NATO’s eastern edge.

The report found that the Kremlin is using a combination of open and hidden methods in its attacks. They mix military and civilian targets and try to twist a dagger into divisions of society for their advantage. And one way it launches those attacks has been by creating fake websites for foreign institutions.

Rubin admitted combating these influence campaigns remains an uphill battle, citing the openness of Western social platforms versus closed systems in Russia and China.

“The rest of the world can’t operate inside Russia and China,” Rubin said. “So there is a fundamental asymmetry here, for any damage they can do.”

NSA DISCLOSURE — A prolific Chinese government-linked hacking group has not yet been deterred from attacking and burrowing into critical U.S. networks, despite a full-court press by the Biden administration to call them out.

An official at the National Security Agency, not authorized to speak publicly as a matter of practice, told Maggie that Chinese hacking group Volt Typhoon is continuing its efforts. The comment was made following reporting from operational technology cybersecurity group Dragos that Volt Typhoon had targeted the emergency services networks of an unnamed large U.S. city.

“Industry and incident response reporting reflects that new incidents tied to Volt Typhoon are happening every day – demonstrating that their activities have not slowed down or ceased since their activities have been called out publicly,” the official said.

The NSA was among the U.S. and foreign allied agencies that signed on to an alert sent out earlier this month warning of Volt Typhoon’s malicious activities, and noting that the group had been in U.S. networks for “at least five years.”

Some background: That alert was put out the same week that top officials, including former NSA director Gen. Paul Nakasone, appeared before the House Select Committee on China to publicly warn of mounting cyber threats from Beijing to U.S. critical networks. These include military systems on the U.S. territory of Guam, along with hundreds of smaller routers on the mainland, according to the Justice Department.

The official said that as a result of the ongoing threat, the NSA and other U.S. agencies will “continue to release public cybersecurity advisories” pertaining to Volt Typhoon in the future.

— Beijing hits back: The Chinese government has denied the allegations of hacking, and instead called out the U.S. for similar actions. Chinese Foreign Ministry spokesperson Mao Ning said at a press conference Monday that the “U.S. jumped to an unwarranted conclusion” about Chinese hacking efforts, describing this as a “distortion of facts.”

“The U.S. needs to stop its worldwide cyber espionage and cyberattacks, and stop smearing other countries under the excuse of cybersecurity,” Mao said.

 

DON’T MISS POLITICO’S GOVERNORS SUMMIT: Join POLITICO on Feb. 22 to dive into how Governors are wielding immense power. While Washington remains gridlocked, governors are at the center of landmark decisions in AI and tech, economic development, infrastructure, housing, reproductive health and energy. How are they setting the stage for the future of American politics, policies and priorities? How are they confronting major challenges? Explore these questions and more at the 2024 Governors Summit. REGISTER HERE.

 
 
The International Scene

PRO-CURBING SPYWARE — The former chief of the United Kingdom’s Secret Intelligence Service (MI6) is a fan of the new initiative to curb intrusive cyber tool proliferation, called the Pall Mall Process.

Speaking during a panel at the Munich Cyber Security Conference last week, Sir Alex Younger said he was “aghast” with the “casual way” that both state and nonstate actors were using spyware.

“Utterly irresponsible; we wouldn’t tolerate it in the nuclear space,” he said. “I don’t think anybody underestimates the diplomatic challenges of this — but it’s in everybody’s interest notwithstanding their geopolitical position to see these tools controlled.”

— Who signed on?: The United States, the United Kingdom, the African Union and EU members including France, Belgium and Italy. On the industry side, defense firm BAE Systems, Apple, Google, Meta and Microsoft.

Among the signatories of the declaration was Greece, whose sitting government was embroiled in a huge spyware scandal in August 2022. Still, the former spy boss said the group needed to include as many countries as possible — including China, India and Russia — because an initiative that became “one bloc against the other” wouldn’t achieve anything.

— Next step, endorsements: Well, according to Younger, “there is no external policeman here … We have to bring together a group and go together at the speed everyone will tolerate.”

We feel relieved already.

Vulnerabilities

OT UNDER SIEGE — Industrial organizations face a growing storm of cyber threats, with ransomware attacks surging 50 percent in 2023 as three new threat groups joined the fray, according to the Dragos OT cybersecurity year in review report.

The report confirms ransomware's dominance, with Lockbit, ALPHV and BlackBasta leading the charge. Manufacturing bore the brunt of the attacks, accounting for 71 percent of incidents, primarily targeting North America and Europe.

— Ready, new players: The report introduces three new threat groups: VOLTZITE, linked to China's Volt Typhoon; Moscow-backed GANANITE targeting CIS and Central Asia; and LAURIONITE, focused on Oracle E-Business Suite vulnerabilities.

According to Dragos, VOLTZITE conducted prolonged surveillance of utilities and satellite providers to gather intelligence across Asia, Africa and North America, while GANANITE stole data from government and critical infrastructure companies in former Soviet states.

— Breaking new ground: For the first time, Tehran-linked hacktivist collective CyberAv3ngers breached programmable logic controllers at water facilities in North America and Europe in an anti-Israel hacking campaign. While hacktivists typically launch disruptive attacks meant to overload a network, CyberAv3ngers demonstrated the ability to infiltrate operational technology by exploiting weak security controls.

The White House told MC back in January it was aware of at least 18 water facilities across the United States being affected by those attacks.

It also shows how geopolitical tensions escalate cyberattacks, with Russia’s war in Ukraine emboldening established groups like ELECTRUM, while China-Taiwan tensions in the lead-up to the island nation’s election fueled targeted cyber espionage in the Asia-Pacific region and the United States.

Tweet of the Day

Sometimes you can’t help but be a good sport about it.

Source: https://twitter.com/vxunderground/status/1759697172101022176

Quick Bytes

HIMES SPEAKS — The ranking member on the House Intelligence Committee, Rep. Jim Himes (D-Conn.). joined POLITICO’s Ryan Lizza on the Playbook Deep Dive podcast to explain the backstory on last week’s warning of a serious national security threat, and what it did for Section 702 reform.

TROJAN ALERT —  A Chinese cybercrime group developed an iOS trojan called GoldPickaxe to steal bank account details from victims in the Asia-Pacific region, writes Eduard Kovacs for SecurityWeek.

Revealed: The respectable life of the suspected Medibank hacker (The Australian Financial Review)

Chat soon. 

Stay in touch with the whole team: Joseph Gedeon (jgedeon@politico.com); John Sakellariadis (jsakellariadis@politico.com); Maggie Miller (mmiller@politico.com); and Heidi Vogt (hvogt@politico.com).

 

Follow us on Twitter

Heidi Vogt @HeidiVogt

Maggie Miller @magmill95

John Sakellariadis @johnnysaks130

Joseph Gedeon @JGedeon1

 

Follow us

Follow us on Facebook Follow us on Twitter Follow us on Instagram Listen on Apple Podcast
 

To change your alert settings, please log in at https://www.politico.com/_login?base=https%3A%2F%2Fwww.politico.com/settings

This email was sent to edwardlorilla1986.paxforex@blogger.com by: POLITICO, LLC 1000 Wilson Blvd. Arlington, VA, 22209, USA

Unsubscribe | Privacy Policy | Terms of Service

No comments:

Post a Comment

This “Wealth Pattern” Predicted Every 1,000% Move

Crypto's FINAL Wealth Moment  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏  ͏ ...