State actors targeting critical infrastructure for espionage, sabotage, says DarkMatter

BT News Desk
June 29, 2019 6:18 pm

DarkMatter Group, released the first semi-annual Cyber Security Report for 2019 revealing that critical infrastructure sectors, including oil and gas, financial, utilities and transportation, are in the firing line from a growing incidence of cyberattacks across the UAE and wider Middle East. The report analyses threats and trends observed by DarkMatter between October 2018 and March 2019 providing a snapshot of the cybersecurity environment in the UAE and the wider region.

The Middle East breaches are both widespread, frequently undetected, and increasingly appear to be state-sponsored. Cybercriminals are aiming their weapons where it hurts the most at critical infrastructure, with potentially devastating effects on the security of nations and their citizens. The report found that the most significant threats to regional critical infrastructure organisations came from eight malicious threat actors and campaigns, motivated by espionage and then sabotage. Spear phishing was found to be the principal method of attack to gain access to targets.

Q1 2019 highlights

  • 75% of intrusions were motivated by cyberespionage actions, such as stealing remote access credentials and personal information.
  • 75% of observed UAE domains are hosted outside the country, placing sensitive data at high risk.
  • 91% of organisations assessed by DarkMatter had outdated software and were missing critical security patches.
  • 83% of organisations assessed by DarkMatter used unsupported software.
  • 91% of organisations assessed by DarkMatter were vulnerable due to weak or default passwords.
  • 87% of organisations assessed by DarkMatter used insecure network protocols.

The report focuses on the global significance of targeted attacks on the UAE’s critical infrastructure sectors. Of these, the oil and gas sector faces the greatest vulnerability to cybersecurity breaches. In the Middle East, an estimated 75% of regional oil and gas companies have had their security in their operational technology compromised. The commercial and strategic importance of this industry to the region makes it an attractive target for geopolitical or economic rivals.

The financial, transportation, water and electricity sectors also face widespread risk from advanced cyberattacks.

DarkMatter’s analysis identified intrusion sets such as Bitter, Molerats, MuddyWater, Chafer, DarkHydrus, Shamoon 3, OilRig, and DNSpionage, which are actively deployed in the region with the objective to disrupt critical infrastructure sectors. Shamoon 3 in particular has been deployed with the intent to sabotage major organisations.

The UAE has the second-highest smartphone adoption rate globally and is one of the world’s most digitally interconnected societies. This digital ecosystem offers an expanded surface for cyberattacks. DarkMatter observed numerous incidents across the region where critical infrastructure was compromised through technology-connected assets. Most of the attacks leveraged outdated and unsupported software, and weak passwords resulting in unauthorised remote access.

The report includes a list of organisational and technical cyber security practices for businesses and governments to implement to improve their security posture.

Karim Sabbagh, CEO of DarkMatter Group.

“Cybersecurity breaches in the region pose a genuine risk to critical sectors as cybercriminals harness new technologies to launch sophisticated and targeted attacks,” said Karim Sabbagh, CEO of DarkMatter Group. “The intent of the attacks we are observing is to undermine the progressive social, economic, and digital agendas in the Middle East. Organisations in the region have a short window of time to transform their cyber security posture and demonstrate stronger resilience in the face of escalating and increasingly sophisticated cyber security threats.”

“DarkMatter’s analysis indicates that public-facing assets in the UAE will continue to be targeted by global threat actors. Organisations must prioritise an improved security posture with continuous monitoring and patching of cyber threats to protect their assets and those of stakeholders,” Sabbagh added.

“In this digital battlefield, while organisations believe they have most of the security management controls in place to mitigate cyber security risks, the reality is that technical control and capabilities to address the cyber security challenge are markedly lagging behind. So there is a considerable risk that if an attack happens, it may well be successful. The C-Suites must and can readily take steps to effectively manage holistically their security posture in order to be better prepared against escalating malicious attacks,” concluded Sabbagh.

Headquartered in the UAE, DarkMatter Group is a fully integrated digital and cyber transformation firm.

Key takeaways

  • Middle East breaches are widespread, frequent, appear to be state-sponsored.
  • Cybercriminals are aiming weapons where it hurts most at critical infrastructure.
  • Most significant threats from eight malicious actors motivated by espionage and sabotage.
  • Spear phishing was found to be principal method of attack to gain access to targets.
  • Oil and gas, financial, utilities, transportation, are in the line of fire.

Tags: