By Ray Birch
NELSON, New Zealand—The war in Ukraine could slow ransomware attacks in the U.S., security experts state, adding that may be the only upside to the impact on cyber threats from the growing Eastern Europe conflict.
Moreover, one expert is advising that as the war in Ukraine potentially threatens more data systems, financial institutions must make sure they have hard-copy backups of their data, and not just rely on the cloud as the fallback strategy.
Brett Callow, threat analyst with Emsisoft, told CUToday.info that at present the war in Ukraine appears to have had little impact on the ransomware landscape.
“We certainly haven’t seen the surge in attacks that some predicted,” said Callow. “If anything, the war seems to have made things somewhat harder for the Russian gangs. It’s not uncommon for them to use people or services based in Ukraine, and those people and services may no longer be available. And we’re also seeing distrust and even hostilities between cybercriminals due to the divisions the war has created, which may be complicating their operations.”
Making Life Harder
Brett Callow
However, the disruption the criminal gangs are experiencing can also make life harder for their victims, Callow pointed out.
“At least one gang has stated that issues related to the war have slowed their response times, meaning it may take longer for decryption keys to be supplied to organizations which pay, which can increase downtime,” he explained. “And, of course, if any of the gangs' physical infrastructure were to be destroyed by shelling, they may lose the ability to supply a decryption key at all.”
While the number of ransomware attacks may not have spiked, financial institutions shouldn’t assume the risk has diminished, emphasized Callow.
“Ransomware and other cyberattacks are still happening and the potential for escalation remains,” Callow said. “Organizations that haven’t already done so should review CISA’s Shields Up advice and take immediate action to address any security weaknesses. Additionally, the Krebs Stamos Group has released an excellent advisory which may help organizations to establish their security priorities.”
Directly Targeting Credit Unions
Security expert Jim Stickley is less concerned about how the war may impact ransomware threats to U.S. companies as he is worried over regional banks and credit unions being targeted directly.
“What keeps me up at night is the huge reliance on outsourced solutions and the risk at a global level we face were Russia or China to attack those,” said the CEO of Stickley on Security as well as CEO of Troy, Mich.-based Mahalo Technologies. “Imagine the huge number of organizations that go down if Microsoft Azure were to be brought offline.”
He said the same holds true with Amazon’s AWS.
“The risks to the financial sector come from our exposure brought on by single points of failure,” Stickley said. “If I am wanting to bring down the financial sector, I can either go after one bank or credit union at a time, or I can go after the infrastructure that the vast majority sit on. It just makes sense that the infrastructure would give far more bang for the buck.
‘Not Just a Few Hackers’
Jim Stickley
“Of course, the argument will be made that Microsoft Azure is far more secure than the average regional bank network, but we are not talking about a few hackers trying to steal a few bucks through ransomware,” continued Stickley. “We are talking about extremely well-funded state actors who have spent years infiltrating our networks and systems throughout not only the U.S. but many other countries. We simply have no idea how at risk we are and if they are already imbedded into critical systems.”
Stickley suggested that if the war does expand to other countries, including the U.S., the next major battle won't be won through troops on the ground.
“It will be won by taking down critical infrastructure—finance, energy and water,” he said. “You bring those down, society falls apart. If Russia were to decide to truly begin World War III, it will start with zeros and ones.”
What to Do Now
What should financial institutions be doing now?
“While, obviously, redundancy is critical, I think one area that financial institutions might be forgetting about is hard copies of backup data,” said Stickley. “It's so easy now to back up all your systems in the cloud. But what if they cloud goes down? What if the equipment you were hosting in that cloud goes down? What physical records do you have locally in the event that you can no longer access whatever was stored in the cloud?”
On ransomware, Stickley’s biggest concern is not over the ability to pay the ransom, as some experts have stated. Instead, the analysts have noted that it may be more difficult for ransomware payments to flow through to crooks with U.S. sanctions in place against Russia. Stickley disagrees.
“Bitcoin is easy to get your hands on and easy to use anywhere in the world,” he said. “In the unfortunate event that you need to pay a ransom, odds are you will be just fine. The more scary thought is that if these attacks are state funded, they may not offer you the chance to pay a ransom. They might just be out to bring things down with no option to bring it back.”
‘Terrifying’ Scenarios
Stickley acknowledged the worst-case scenarios in which infrastructures fall are “terrifying” to contemplate.
“However, the reality is that they probably won't happen,” Stickley said. “Keep in mind that the U.S. is just as embedded in other countries as they are in ours. Everyone knows that once one country starts cyberwarfare, everyone is going to go down worldwide. I am not sure any country is willing to make that happen.”