In 2015, the word "cyber-security" became trendy. Perhaps for the first time in history, issues relating to the security of the Internet and the protection of internal networks were discussed by and relevant to every sector of the economy as well as everyday life: from finance, manufacturing/industrial, automotive and aircraft to wearable devices, healthcare, dating services and more.
2015 saw near-exponential growth in all areas related to cyber-security. For Kaspersky Lab, the overriding trend has been increased complexity in cyber-attacks. The growing number of attacks, the numbers of both attackers and their victims, together with a greater focus on cyber-security in defense budgets, new or enhanced cyber-laws, international agreements and new standards: 2015 redefined the rules of the game. This year, agreements on cyber-security were signed between Russia and China, China and the United States, and between China and the United Kingdom. These agreements include not just a commitment to mutual cooperation but an assurance that both sides will seek to prevent attacks on each other.
Cyber-activity during 2015 is described by Kaspersky Lab’s Global Research and Analysis Team (GReAT) as “elusive”: full of cyber-criminals that are proving hard to catch, cyber-espionage actors that are even harder to attribute, and with privacy often the most elusive of all. Cyber-attacks have achieved the impossible: they have thinned the walls of bedrooms and offices around the world.
Kaspersky Lab: predicting the future
A year ago, the director of Kaspersky Lab’s GReAT team, CostinRaiu predicted a few trends for advanced, persistent cyber-threats in 2015. As the year was to show, his forecast was accurate:
• The evolution of malware techniques. In 2015, GReAT discovered previously unseen methods used by the Equation group, whose malware can modify the firmware of hard drives, and by Duqu 2.0, whose infections make no changes to the disk or system settings, leaving almost no traces in the system. These two cyber-espionage campaigns surpassed anything known to date in terms of complexity and the sophistication of techniques.
• Targeting executives through hotel networks. This prediction was later modified to include any venue where a high-profile target could be targeted outside the protected corporate perimeter. For example, the Duqu2.0 malware infections were linked to the P5+1 events and venues for high-level meetings between world leaders.
• Threat actors add mobile attacks to their arsenal. Desert Falcons targeted Android users.What Kaspersky Lab’s GReAT didn’t anticipate was that in 2015 we’d see wars between APTs. In the spring of 2015, Kaspersky Lab recorded a rare and unusual example of one cybercriminal attacking another. In 2014, Hellsing, a small and technically unremarkable cyberespionage group targeting mostly government and diplomatic organizations in Asia, was subjected to a spear-phishing attack by another threat actor, Naikon, and decided to strike back. Kaspersky Lab believes that this could mark the emergence of a new trend in criminal cyberactivity: the APT wars.
In total, Kaspersky Lab’s Global Research and Analysis Team issued 14 public reports on APT attacks in 2015: Duqu 2.0,Darkhotel – part 2, Naikon, MsnMM Campaigns, Satellite Turla, Wild Neutron, Equation, Blue Termite, Hellsing, Carbanak,Desert Falcons, Animal Farm, Spring Dragon and Sofacy. These advanced actors “speak” different languages: traces hidden in the APTs were in Russian, Chinese, English, Arabic, Korean, and French. They targeted financial institutions, government, military and diplomatic organizations, telecommunications companies and energy firms, political activists and leaders, mass media, private business and more.