PRESS RELEASE

Atlanta, GA - April 16, 2024 – BeyondTrust, the worldwide leader in intelligent identity and access security, today announced a definitive agreement to acquire Entitle, a pioneering privilege management solution that discovers, manages, and automates just-in-time (JIT) access and modern identity governance and administration (IGA) across the entire cloud estate. These capabilities enhance a customer’s ability to provision user access to sensitive data and cloud resources on a time-bounded and “as-needed” basis. While regulations and industry best practices are moving towards zero-standing privileges (vs. permanent privileged access as provided by traditional PAM offerings), companies have struggled to implement JIT with existing tools, particularly in cloud and hybrid environments; Entitle solves this issue with its automated provisioning workflows, self-serve access requests, and 150+ integrations across IaaS/PaaS platforms and SaaS apps.

This acquisition includes all Entitle products, employees, customers, partners, assets, and intellectual property.

BeyondTrust further solidifies its industry-leading Privilege Identity Security platform with the acquisition of Entitle, expanding beyond traditional privileged access management (PAM) to encompass dynamic, just-in-time access management across cloud, SaaS, and on-premises environments. Adding Entitle to its product portfolio enhances the capability to address the sophisticated challenges of PAM and cloud infrastructure entitlement management (CIEM) in today's cloud-centric landscape, with a unified orchestration approach that enriches the platform with advanced identity governance functionalities.

“The BeyondTrust acquisition of Entitle signifies a crucial evolution in our fight to ensure customers can protect all paths to privileges, focusing on identity-first security across all IT environments,” says Janine Seebeck, CEO of BeyondTrust. “Adopting a unified, orchestrated approach that incorporates dynamic, just-in-time access is critical for safeguarding our customers' ever-changing paths to privilege. This strategy not only reduces operational friction, but also enhances the security of the entire identity infrastructure more effectively.”

"Entitle’s JIT Access and Cloud Permissions Management solution is an emerging leader in the Identity Security market,” says Ron Nissim, CEO of Entitle. “This acquisition allows Entitle to continue to grow through BeyondTrust’s years of expertise and dominance in the PAM market - offering significant opportunities for Entitle’s team.”

“BeyondTrust’s acquisition of Entitle adds comprehensive permissions and entitlements management across cloud and SaaS platforms to the BeyondTrust Privileged Identity Security platform,” states Paul Fisher, Senior Analyst at KuppingerCole Analysts.

The Entitle solution is immediately available to all BeyondTrust customers. For more information, visit www.beyondtrust.com/products/entitle.

About BeyondTrust

BeyondTrust is the worldwide leader in intelligent identity and access security, enabling organizations to protect identities, stop threats, and deliver dynamic access. We offer the only platform with both intelligent identity threat detection and a privilege control plane that delivers zero-trust based least privilege to shrink your attack surface and eliminate security blind spots.  
BeyondTrust protects identities, access, and endpoints across your organization, while creating a superior customer experience and operational efficiencies. We are leading the charge in innovating identity-first security and are trusted by 20,000 customers, including 75 of the Fortune 100, plus a global ecosystem of partners. Learn more at www.beyondtrust.com.

BeyondTrust Acquires Entitle, Strengthening Privileged Identity Security Platform

PRESS RELEASE

Copenhagen, Denmark, April 16, 2024 – Keepit, a global leader in SaaS data backup and recovery, today announced Kim Larsen as new Chief Information Security Officer (CISO). With more than 20 years of leadership experience in IT and cybersecurity from government and the private sector, the new CISO’s areas of expertise include: business driven security; aligning corporate, digital and security strategies; risk management and threat mitigation; developing and implementing security strategies; leading through communication; and coaching. Larsen's deep government and broad private sector experience will position him to bring Keepit’s security advisory capabilities and development of future services to the next level.  

Kim Larsen is an experienced keynote speaker, negotiator, and board advisor on cyber and general security topics, with experience from a wide range of organizations, including NATO, EU, Verizon, Systematic, and a number of industry security boards. 

“It's a real pleasure to welcome Kim Larsen to the team — his deep government and broad private sector experience is exceptional, and perfectly positions him to bring Keepit’s security advisory capabilities and development of future services to the next level. Our current growth trajectory and go-to-market strategy has us engaging in conversations where his expertise is highly valuable,” says Morten Felsvang, Keepit CEO.

Kim Larsen started his career in the Danish National Police and subsequently spent nine years with Security and Intelligence Service (PET) where he served as delegate for the Danish government in both NATO’s and the EU’s security committees.

Moving into the private sector to act as strategic advisor on government, public and financial sector matters, and developing security organizations and partnerships in companies such as Verizon, Huawei and Systematic, he has served on the information security board of the Danish Industry confederation (DI) and Danish Council for Digital Security for 10 years. 

Backup and recovery critical components to cybersecurity

With this background, Kim Larsen has a holistic take on cybersecurity and a profound understanding of what is required and desired in organizations bolstering their IT infrastructures against cyber threats:

“I am very happy to join Keepit: Backup and recovery are critical components of a solid cybersecurity posture, and the unique Keepit solution is the answer to so many compliance and security challenges. It’s a great opportunity to work with organizations on how to retain access to their data in the face of any malign or arbitrary threats to their infrastructure,” says Kim Larsen.

The CISO points to compliance, cyber resilience, and disaster recovery best practices as three of his favorite subjects and reasons for choosing Keepit as his new stomping ground: 

“If there’s one thing we can be sure of, it’s this: We don’t know the threats we will be facing in the future. But we can make educated guesses. And based on those, we can make sure to cross the t’s and dot the i’s that we do know about. That’s why the Keepit solution is a future-proof solution: With its vendor-independent tech stack that keeps data physically and logically separate from the production environment, it’s a guarantee that customer data is always available. And with local data centers keeping data in the same regulatory regions as the organization, full compliance is assured. It really is quite unique,” states Kim Larsen. 

About Kim Larsen

Kim Larsen is Chief Information Security Officer at Keepit and has more than 20 years of leadership experience in IT and cybersecurity from government and the private sector.

Areas of expertise include business driven security, aligning corporate, digital and security strategies, risk management and threat mitigation adequate to business needs, developing and implementing security strategies, leading through communication, and coaching.

Kim Larsen is an experienced keynote speaker, negotiator, and board advisor on cyber and general security topics, with experience from a wide range of organizations, including NATO, EU, Verizon, Systematic, and a number of industry security boards.

Find Kim Larsen on LinkedIn.

Kim Larsen New Chief Information Security Officer at SaaS Data Protection Vendor Keepit

The two allegedly sold the Trojan on Hack Forums, allowing other threat actors to gain unauthorized control, disable programs, browse files, record keystrokes, and steal credentials.

Source: imageBROKER via Alamy Stock Photo

Edmond Chakhmakhchyan, also known by the screen name "Corruption," was arrested last week by the FBI on federal charges alleging that he intended to market and sell malware that would allow a threat actor to take control of a victim's device.

Chakhmakhchyan, who is from California, pleaded not guilty to his two-count indictment and will stand trial on June 4.

According to the Justice Department, Chakhmakhchyan and the creator of the malware, an Australian national, struck a deal requiring Chakhmakhchyan to advertise the Hive remote access Trojan (RAT) on a website called Hack Forums, accept payment in bitcoin for licenses to use the malware, and provide assistance to the malware customers if needed.

Once deployed, Hive RAT customers were able to gain unauthorized control, disable programs, browse files, record keystrokes, access communications, and steal credentials without the victim's knowledge.

"The indictment specifically charges Chakhmakhchyan with one count of conspiracy — to advertise a device as an interception device, to transmit a code to intentionally cause damage to a protected computer, and to intentionally access a computer to obtain information — as well as one count of advertising a device as an interception device," the press release stated. If convicted, Chakhmakhchyan faces a maximum penalty of five years in federal prison for each count.

The Australian Federal Police (AFP) have charged Chakhmakhchyan's counterpart, who was allegedly involved in the creation and sale of the malware. They face 12 charges, each of which has a maximum penalty of three years in prison.

**About the Author(s)**

Global Cybercriminal Duo Face Imprisonment After Hive RAT Scheme

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

The enemies are always getting closer, using the same advanced technologies as security pros are employing to protect their networks. So perhaps it's time for a back-to-basics approach? Come up with a clever cybersecurity-related caption to describe the scene above, and our favorite will win a $25 Amazon gift card.

Here are four convenient ways to submit your ideas before the May 13, 2024, deadline:

*   Via social media: X, Facebook, and LinkedIn. (If you win, we'll respond to you on the same platform, requesting your email address.)
    

**Last Month's Winner**

Great Dark Reading readers' minds think alike! Several captions submitted for last month's contest, "Bridge the Gap," played on the same theme of air gapping. They all made us chuckle, but in the end only one could win. So a round of applause, please, for Bill Cote, a cybersecurity engineer at Leidos. And big thanks to all who submitted an idea!

**About the Author(s)**

John Klossner has been drawing technology cartoons for more than 15 years. His work regularly appears in Computerworld and Federal Computer Week. His illustrations and cartoons have also been published in The New Yorker, Barron's, and The Wall Street Journal.

Name That Toon: Last Line of Defense

Recent analysis shows that enterprises need to think about the impact on security budgets and resources as they adopt new AI-based applications.

Source: Absolute Security Cyber Resilience Risk Index 2024

Enterprises assessing their readiness for artificial intelligence (AI) transformation have to ensure they have devices capable of running AI-enabled applications. A recent analysis by Absolute Security found that the majority of organizations need to update or replace their systems to be AI-ready. Deployments of this size can have significant implications on their cybersecurity risk and resiliency, Absolute Security states.

"Absolute Security Cyber Resilience Risk Index 2024" assesses the state of cyber resilience for global enterprises. The index is based on telemetry from millions of mobile and hybrid PCs running Absolute Security's firmware-based agents. To determine AI-readiness, Absolute Security analyzed over 4 million devices running Windows 10 or 11 to determine how many of them had a minimum of 32 GB of RAM. According to the index, 92% didn't meet the basic requirements needed to efficiently handle modern AI applications.

Absolute Security based the assessment on whether enterprise PCs are capable of supporting AI applications on the recommendation that PCs should be equipped with a minimum of 32 GB of RAM and have either a stand-alone graphics processing unit (GPU) or an integrated neural processing unit (NPU).

"Huge investments in AI-capable endpoint fleets have the potential to divert budget and human resources away from critical IT and security priorities that can leave gaps in security and risk policies," Absolute Security says.

The concern isn't just about diverting resources; Absolute Security notes that new devices being added to the environment can also add complexity. Organizations are already struggling to keep up with patching and making sure the right security controls are in place. New devices could mean defining new controls or adjusting workflows to make sure they are being patched.

While there is a marked improvement between 2023 and 2024, Absolute Security found that organizations are still lagging behind with patches. Most industries continue to run weeks or months behind in complying with their own patching policies, although Windows 11 devices seem to be faring better than Windows 10, the company said.

**About the Author(s)**

Enterprise Endpoints Aren't Ready for AI

Many teams think they're ready for a cyberattack, but events have shown that many don't have an adequate incident response plan.

Chris Crummey, Director, Executive & Board Cyber Services, Sygnia

April 16, 2024

5 Min Read

Source: Yee Xin Tan via Alamy Stock Photo

COMMENTARY

The new Securities and Exchange Commission (SEC) rules on cybersecurity risk management, strategy, governance, and incident disclosure recently went into effect, and organizational approaches to cybersecurity incident response are top of mind for stakeholders at both public and private companies. While most executive leadership teams and corporate board members assume their organizations are ready for a potential cyberattack, recent events have shown that many are ill-prepared to handle what will be their worst day on the job.

A company's response to a crisis is a direct reflection of its preparedness. Rather than focus solely on what happens during and after a cyber incident, executives and leadership teams must first understand that the period preceding an event is most critical. Organizational remediation efforts can and should be developed, tested, and implemented before an attack happens. It is imperative for those at the top to use this time to evaluate how well their teams will respond when thrust into a dire situation and take the necessary steps to ensure cyber readiness.

**Develop and Implement an Incident Response Plan**

Far too many organizations find themselves in the middle of a cyber crisis without a formal response plan in place. Companies make critical errors that can compound the financial and reputational damage associated with a cyber incident due to the simple fact they do not have established roles or responsibilities or a documented chain of command to handle this sort of situation. Within the first hour of the crisis, we see the most instances of job bias emerge and lead to a significant number of mistakes. During that "golden hour," people are unsure of what to do, but they inject themselves into the crisis because they believe it is their job to do something. This lack of understanding ultimately slows down the recovery and remediation process.

There isn't a single blueprint on what an incident response plan should look like, because each crisis is different. However, executives, board members, security teams, and others involved must know who takes the lead in responding, what each person's responsibilities are, and what steps should be taken to communicate internally and externally. The formal incident response plan should include an identified incident commander who works across lines of business and divisions within an organization to ensure each person and department understands the situation and handles their duties as assigned. The incident response commander will also be charged with contacting the company's third-party experts, such as legal, incident response firms, ransom negotiators, and public relations, to ensure they are aware of what has transpired. The cyber incident response protocol should be incorporated into the broader organizational crisis response plan, frequently reviewed and updated as necessary.

**Stress Test the Response Plan in an Active Simulation**

Planned actions can easily be lost in the chaos during a real cyberattack because of the natural psychological response employees have to a crisis. Leaders must understand that those involved in the attack will experience a rush of cortisol, the stress hormone that creates a "fog of war" during turbulent times, and it can lead to additional issues. The most common problem is the inability to validate and verify information. A person's interpretation of what has happened or what has been shared with them can differ significantly from the facts of the incident. The result can escalate a single piece of information about a potential event and turn it into a full-blown crisis.

The best way to evaluate how teams will react to a cyberattack is to put the formal incident response plan to the test. Tabletop and wargame exercises are immersive experiences, conducted in a controlled environment, that prepare enterprises to face and mitigate a potential attack. This gives every person within the organization the opportunity to feel, act, and behave as if they are in the midst of an attack situation. These training exercises allow teams to experience that rush of cortisol, learn how to handle and manage it, and develop the necessary discipline to execute the response plan. This also provides leadership with visibility into how an individual's response impacts the holistic approach to remediation.

**Evaluate the Plan's Efficacy and Improve it **

Once the organization and its cyber incident response plan have been put to the test, the next step is to evaluate the efficacy of the plan and identify opportunities for improvement. It is important to note where the fundamental breakdowns occurred and what can be done to address them. For example, if the communication cadence faltered, why was the team unable to contact the appropriate stakeholders? Was it procedural or did the incident commander not fulfill his or her duties? Leadership should know if it is a matter of committing additional resources to enhance security posture or if they need to incorporate different organizational leaders to spearhead response efforts.

Executives and board members must consider how prepared their team is before the attack happens and how it behaves during the crisis, and understand that the challenges from the wargame exercise are going present themselves when a real attack occurs. It is imperative for leadership to be involved in the evaluation process, as the final decisions will have a widespread impact on key stakeholders. The ability to comprehend how each choice impacts and improves security posture and coverage will boost employee engagement, which is paramount to successfully defending an organization.

Cybersecurity has become a board-level issue in recent years, and it must remain a priority moving forward. It is incumbent on executive leadership to be well-informed about their organization's security response plan and how people respond before, during, and after a cyber crisis. By proactively evaluating their response protocol before an attack begins, board members and executives can shore up their defenses against emerging risks and ensure cyber readiness.

**About the Author(s)**

Director, Executive & Board Cyber Services, Sygnia

Chris Crummey is the Director for Executive and Board Cyber Services globally at Sygnia. For the past eight years, Chris has prepared and advised thousands of companies, SOCs, executives and Boards of Directors on cybersecurity best practices before, during and after a cybersecurity crisis. These best practices focus on the intersection of cybersecurity, risk-based decision making, crisis communications, leadership under pressure and the role human beings play in cybersecurity. As a keynote speaker on these topics, Chris is also a cybersecurity faculty member of “Competent Boards,” which is the original and premier creator of online of ESG training programs for board directors and senior business professionals. Prior to this role, Chris was the Executive Director for the IBM’s X-Force Command Centers globally and specialized in tabletop exercises and cyber wargames.

3 Steps Executives and Boards Should Take to Ensure Cyber Readiness

Kaspersky researchers discovered the new variant after responding to a critical incident targeting an organization in West Africa.

Source: Zoonar Gmbh via Alamy Stock Photo

The LockBit ransomware-as-a-service (RaaS) group has struck another victim, this time using stolen credentials to launch a sophisticated attack against an unidentified organization in West Africa. The attackers used a new variant of the LockBit 3.0 builder, which was leaked in 2022.

Kaspersky researchers discovered the latest variant at the end of March 2024 after responding to the incident in West Africa, describing it at the time as Trojan-Ransom.Win32.Lockbit.gen, Trojan.Multi.Crypmod.gen, and Trojan-Ransom.Win32.Generic. Particularly concerning about this variant is that it can generate custom, self-propagating ransomware that is difficult to defend against.

During the attack, threat actors impersonating an administrator infected multiple hosts with malware, aiming to spread it deeply into the victim's network. According to Kaspersky, the customized ransomware performed various malicious actions, including disabling Windows Defender, encrypting network shares, and deleting Windows Event Logs to avoid discovery of its actions. 

The researchers discovered that the variant can also direct attacks on select systems and infect specific .docx or .xlsx files. "The nature of this finding is rather critical since the use of leaked privileged credentials allows the attackers to have full control of the victim's infrastructure, as well as covering their tracks," says Cristian Souza, an incident response specialist at Kaspersky. 

The organization in West Africa hit by the new LockBit variant is the only victim Kaspersky's Global Emergency Response Team (GERT) has encountered in that area to date, according to Souza. "However, we detected other incidents that used the leaked builder in other regions," he says. 

**The Appeal of LockBit 3.0 to Attackers**

Since it was leaked in 2022, attackers have continued actively using LockBit 3.0 builder to create customized versions and variants. "This opens up numerous possibilities for malicious actors to make their attacks more effective since it is possible to configure network spread options and defense-killing functionality," according to a research brief on the attack and a detailed description of the variant posted by Kaspersky. "It becomes even more dangerous if the attacker has valid privileged credentials in the target infrastructure."

According to a recent Trend Micro report, the LockBit group was responsible for at least 25% of all ransomware attacks in 2023 and has hit thousands of victims since 2020. The LockBit 3.0 builder is a popular tool among threat actors because it doesn't require advanced programming skills.

In February 2024, the Cronos Group, an international law-enforcement group, claimed that it had taken down the group's infrastructure, but less than a week later, LockBit responded that it had recovered and was back in business.

**Protecting Against LockBit Attacks**

As the debate continues over whether LockBit will remain the pervasive force in waging ransomware attacks, Kaspersky advises that organizations take the same steps they would undertake to prevent an attack from any group. Those steps include using properly configured antimalware and endpoint detection software, implementing a managed detection and response solution, conducting vulnerability assessments and penetration tests, and performing and testing backups of critical data.

Further, Sousa recommends network administrators employ network segmentation, enforce multifactor authentication (MFA), whitelist permitted applications, "and have a well-defined incident response plan."

**About the Author(s)**

Jeffrey Schwartz is a journalist who has covered information security and all forms of business and enterprise IT, including client computing, data center and cloud infrastructure, and application development for more than 30 years. Jeff is a regular contributor to Channel Futures. Previously, he was editor-in-chief of Redmond magazine and contributed to its sister titles Redmond Channel Partner, Application Development Trends, and Virtualization Review. Earlier, he held editorial roles with CommunicationsWeek, InternetWeek, and VARBusiness. Jeff is based in the New York City suburb of Long Island.

LockBit 3.0 Variant Generates Custom, Self-Propagating Malware

The scam is spreading across the US and impersonates the specific toll-collection services of each state in malicious SMS messages.

Source: Mira via Alamy Stock Photo

The FBI is warning people about widespread SMS phishing (smishing) campaign spreading "state to state" that's luring people with messages informing them that they have unpaid tolls to resolve. The scam is aimed at stealing their credentials and defrauding them.

There also is evidence that that the campaign — which has been reported by people in three states so far, according to a public service announcement by the FBI Internet Crime Complaint Center (IC3)—affected other parts of the world before it reached US shores.

The campaign, active in the US since at least early March and reported by more than 2,000 people, sends users a text message that appears to come from the road-toll collection service of their specific states, claiming they owe money for unpaid highway tolls.

"We've noticed an outstanding toll amount of $12.51 on your record," the text of one such message reads. "To avoid a late fee of $50.00, visit https://myturnpiketollservices.com to settle your balance."

**Old Social Engineering Trick Remains Effective**

While smishing scams are by no means new, they continue to be used by attackers because they still have the potential to fool users into giving up the valuable credentials that allow for cybercriminals to profit. The FBI's warning alone is a sign that the unpaid-toll campaign is likely to escalate, and is worrying enough to warrant vigilance from potential victims.

The texts "contain almost identical language" and use similar amounts for so-called outstanding tolls. What changes from state to state is that the malicious link provided within the text is created to impersonate the state's toll service name, "and phone numbers appear to change between states," according to the IC3.

The link takes users to what looks very much like the toll services' legitimate websites, asking them to enter information on the pretense of paying the toll. Instead the attackers collect the victim's payment credentials and other sensitive data that potentially could be shared with other cybercriminals and/or used in future social engineering attacks.

**Toll Scam Spreads Across US**

The FBI didn't specify which states are currently being affected by the wave of toll-related attacks, but a quick perusal of social-media platform X, formerly Twitter, found evidence that the scam has at least affected users in Pennsylvania.

The Pennsylvania Turnpike (@PA\_Turnpike), the toll road, and related services that spans the state, posted a warning on social platform X to let users know about the campaign, and encouraged them to report any scam messages to the IC3.

"Some customers have received phishing-attempt text messages claiming to be from the PA Turnpike’s toll services," according to the post. "If you receive such a text, providing you with a link to pay an outstanding toll, do not click on the link, and delete the text."

The scam may be related to a similar one that previously swept across Australia, as people in states in both the eastern and western parts of the country in 2022 and 2023, respectively, also reported on X that they received driving toll-related smishing messages.

Back in August 2022, X user Anthony Campisini posted about a toll scam associated with City Link, a toll freeway service in the southeastern Aussie city of Melbourne, that also tried to lure users in the region with a message about unpaid tolls. Less than a year later, another X user in the state of Western Australia (WA) observed in March 2023 that he had been receiving "a lot of scam" SMS messages informing him that he owes money on road tolls.

"How do I know they are scams?" the user, @EMacskasy, who goes by the X name of "Evan Stop the Killing," posted. "Over here in WA = we do not have tolls on our roads."

**Stay Vigilant**

EMacskasy's observation is a good example of how people being targeted by the scam can avoid being compromised by it — by taking a moment to rationalize if it's even possible that they owe money on tolls before having a knee-jerk reaction and immediately engaging with the message.

The IC3 is advising people to file a complaint with the IC3 on the agency's website if they receive one of the messages and include the following information: the phone number from where the text originated and the website listed within the text.

People also should check any toll-service account that they have by going separately and directly to the service's legitimate website, to ensure that their accounts are in order, and/or contact the legitimate service's customer service phone number to check the account and let them know of the scam. As previously mentioned, people also should delete the texts.

In case someone has already engaged with the link or given information, they should make an effort to secure their personal information and financial accounts, and dispute any unfamiliar charges that may show evidence of cybercriminal activity.

**About the Author(s)**

Elizabeth Montalbano is a freelance writer, journalist, and therapeutic writing mentor with more than 25 years of professional experience. Her areas of expertise include technology, business, and culture. Elizabeth previously lived and worked as a full-time journalist in Phoenix, San Francisco, and New York City; she currently resides in a village on the southwest coast of Portugal. In her free time, she enjoys surfing, hiking with her dogs, traveling, playing music, yoga, and cooking.

FBI: Smishing Campaign Lures Victims With Unpaid-Toll Notices

Cyberattacks tripled over the past year in Israel, making it the most targeted nation in 2023, as cyber operations become a standard part of military conflicts and global protests.

Source: Ruma Aktar via Alamy Stock Photo

As tensions in the Middle East continue to escalate, cyberattacks and operations have become a standard part of the fabric of the geopolitical conflict.

Last week, the head of Israel's National Cyber Directorate blamed Iran and Hezbollah for "around the clock" cyberattacks against the country's networks, government agencies, and businesses, tripling in intensity as Israel's military operations continued against Hamas in Gaza. Following Quds Day — Iran's commemoration of its pro-Palestinian Jerusalem Day on April 5 — dozens of denial-of-service attacks disrupted Israeli targets, according to data from cybersecurity firm Radware.

While the volume of cyberattacks are running at a lower level so far this year, renewed tensions between Israel, Iran, and Lebanon could easily lead to more cyber activity, says Pascal Geenens, director of threat research for Tel Aviv-based Radware, a maker of cloud security solutions.

"There are two planes that we need to consider here," Geenens says. "One is more nation-state aligned, meaning purposely doing attacks against another nation, while the other is all the hacktivist activity — they just want to share their message \[and\] show that they're not happy with the situation."

Overall, Israel should be ready for more destructive cyberattacks, as Iran and other regional cyber groups have shown little restraint in such attacks, Google conclude in its "Tool of First Resort: Israel-Hamas War in Cyber" report, published in February. As Iran and Hezbollah appear ready to use destructive cyberattacks against both Israel and the United States, Israeli-linked groups likely will continue to target Iran, and hacktivists will likely target any organization they deem associated with their perceived enemies, the report stated.

"We assess with high confidence that Iran-linked groups are likely to continue to conduct destructive cyber attacks, particularly in the event of any perceived escalation to the conflict, which may include kinetic activity against Iranian proxy groups in various countries, such as Lebanon and Yemen," the company stated in the report.

**Not Your Father's Cyber Conflict**

When Russia invaded Ukraine, the Russian military used cyberattacks to target Ukraine prior to the invasion and during the invasion, and widely attacked the US and Ukraine's allies in Europe in the two years since the start of the war.

A significant spike in cyberattacks came prior to and after Oct. 7, while much more modest levels of activity targeted Israel this year. Source: Radware

For the Middle East, the cyber conflict has a different character. On one hand, the participants in the conflict have different strengths and limitations, which are affecting their options and making the cyber conflict more asymmetrical. Where the Russian government has a unity of purpose, Iran and Hamas are more opportunistic adversaries. Where Russia and Ukraine have similar cyber capabilities, Israel's military operations have limited Hamas' ability to respond, and the country has the most sophisticated cyber-offensive capabilities in the region, says Ben Read, head of cyber espionage analysis for Google Cloud's Mandiant incident-response group.

"Iran is very opposed to Israel, but aren't a direct party to the conflict, so their goals aren't necessarily about supporting the seizure of territory in the same sort of way as Russia," he says. "Because conventional weapons are not \[currently\] an outcome acceptable to Iran, they are using cyber to do some destructive \[operations\]. ... Cyber can be an easier tool to reach for there."

Iran is not the only anti-Israeli actor in the region. Google has observed cyber operations by groups linked to Hezbollah, a Lebanese Islamist political party and militant group aligned with Iran.

Iran has also been the target of disruptive cyber operations in the context of the conflict, says Kirsten Dennesen, reporting analyst with Google's Threat Analysis Group (TAG). Several disruptive attacks on the nation's infrastructure have been attributed to Predatory Sparrow, which reappeared in October and attacked Iranian gas stations in December, and which some analysts have linked to Israel.

"Telegraphing intent and demonstrating involvement in the conflict without escalating or directly taking part in on-the-ground confrontation ... limits potential blowback while also giving regional players the opportunity to project power through the cyber domain," she says. "Moreover, cyber capabilities can be quickly deployed at minimal cost by actors who may wish to avoid armed conflict."

**Resurgence in Hacktivism**

Nation-states are not the only actors involved in the conflict. In the past year, hacktivism has taken off as technologically savvy protesters react to the Russia-Ukraine war and the conflict between Israel and Hamas. Much of the increase in attack activity in Israel is due to hacktivism, as is demonstrated by sharp upticks in denial-of-service attacks, says Radware's Geenens.

"It's not like it did not exist before, but before they were much less organized, and now they have like this ability to gather on Telegram," he says. "They all started to communicate with each other through hashtags. They find each other much more easy, so they come together and create alliances to perform attacks."

In the past, the groups banded together under the Anonymous name, claiming the monicker for their own and attempting to get other groups to sign up. Today, they use operation-specific hashtags on Telegram to gain like-minded collaborators, a much more efficient method of operation, Geenens says.

Hacktivism likely will continue to fuel attacks against not only Israel, but other countries as well, he says. Attacks are more likely to ramp up quickly as nation-states develop standard techniques and hacktivists are able to collaborate more efficiently.

"Anything that happens in the future," Geenens says, "whether it be a military operation or an outcome of an election that they don't like or somebody says something that that they don't like — they will be there and there will be a wave of DDoS attacks."

**About the Author(s)**

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline Journalism (Online) in 2003 for coverage of the Blaster worm. Crunches numbers on various trends using Python and R. Recent reports include analyses of the shortage in cybersecurity workers and annual vulnerability trends.

Cyber Operations Intensify in Middle East, With Israel the Main Target

PRESS RELEASE

WEST LAFAYETTE, Ind. — Hiccups and failures of consumer cyber-physical systems like smart gadgets and appliances are inconvenient and annoying. But in mission-critical applications for the Department of Defense, any system weakness or flaw could have serious consequences, such as disruption, damage or even loss of life.

To help mitigate the problem, a group of Purdue University researchers has launched a multidisciplinary project to model, simulate and analyze cyber-physical systems (CPS), with the goal of rendering such systems more robust and making analysis of the systems more scalable and effective. Code named FIREFLY, the multiphase $6.5 million project is sponsored by the Defense Advanced Research Projects Agency under its FIRE program (Faithful Integrated Reverse-engineering and Exploitation). 

A technically intriguing aspect of the research is that, for a CPS with multiple cyber and physical components, the individual components may not appear faulty or vulnerable. But when the components start to interact, weaknesses or vulnerabilities may occur in unexpected ways: “When it comes to the security of system components and of the overall system, one-plus-one may be less than two. And we are particularly interested in exposing and analyzing such system-of-systems weaknesses,” says Dongyan Xu, the Samuel Conte Professor of Computer Science and the principal investigator of the FIREFLY project. 

Read more about the research at the Purdue Office of Research website.

Source

DARKReading