Rising Threat of Russia’s Cyber Warfare

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today we're going to talk about how Russia has adapted its nation-sponsored cyberattack capabilities since the Ukraine invasion. And I think there's some, some really interesting insights here. And I'm going to be talking with Mikko Hypponen. Mikko is the Chief Research Officer at WizSecure, Principal Research Advisor for F-Secure, advisory board member to a whole host of different companies, and really a renowned technology speaker and author. Welcome, Mikko, and thank you for coming and talking with us.

Well, thank you, Matthew, and thank you for having me.

Okay, so, you know, Russia, it's considered one of the top 4 most aggressive nation-states for cyberattacks. Give us a little insight. Why are they so active? Why do they invest so much and choose to go down that aggressive path?

Hmm, it's actually very simple. Russia understands very well but when they are caught doing nasty stuff to other countries. If they do that stuff in the real world, there's very real repercussions. They get, you know, bad things happen to them as well. If they do the very same things online, nothing's going to happen. If you compare how much effort different nation-states put into trying to avoid getting caught, we'll see a huge difference in Western Western intelligence agencies and Western militaries compared to Russia, or for example China. Russia and China don't really care too much about getting caught because they know nothing's going to happen. This is a very basic motivation for them to do action in the online world. They can get the results they need either working in the real world or in the online world. In the online world, getting caught doesn't really matter, so why wouldn't they do it in the online world?

So for an object— objectives that these different aggressive nation states, right? China is well known for stealing intellectual property. You know, Russia, it seems like a lot of their efforts are really geared towards pushing their foreign policies. Do you see it really as an effective foreign policy tool? Do you think this is the, the direction they're going to grow it into something that could be more powerful in that space?

When we look at all the attacks Russia has ever done, like from the nation state, like governmentally funded, governmentally operated attacks, every single attack has either been about espionage or about sabotage. So the end game, what they really try to reach with these might differ, but it's always about either stealing stealing information, effectively spying, or it's about sabotage. And of course, during wartime, when two countries are at war and there are attacks between those countries, we don't call it sabotage anymore, then we call it war. And that's exactly what happens here as well. The very same attacks that Russia might be waging against countries that they are not at war with, when they use the very same attacks against countries like Ukraine that they are at war with, then the attacks change from cyber sabotage to cyber war even though it's exactly the same attack. So from my point of view, cyber is just a new domain for waging war. Technology has always expanded the ways and the places where we wage war, starting from hundreds of years ago when we only had land war because we didn't have technology for air war or even for sea war, definitely not for space war, and definitely not for cyberspace war. Domain, cyber, won't be the last new domain. Technology will open up new domains for conflicts and for war, but this is where we are today.

And Russia obviously has, you know, a history even going back to Soviet Union and even prior to that to investing quite a bit in, you know, different, those different domains of war, whether it was troops on the ground, whether it was foreign espionage, whether it was, you know, new research in aircraft or armor, things of that sort. So it makes sense that they're investing also heavily in the offensive capabilities in cyber. Now, prior to February 2022, right, prior to the invasion of Ukraine, Russia had a formidable kind of nation-state offensive cybersecurity program, but they often relied on third parties, including organized criminal groups, right, to do a lot of their dirty work. But it looks like that has significantly changed since the invasion. What happened, right? What was that change that happened before versus what we see now?

I think in some ways we were overestimating the capabilities Russia really had. And I think we did the same thing for both real-world offensive capability, but also definitely for the cyber offensive capability. Now, we had seen isolated examples where Russia had really successful cyberattacks, including, for example, the Trikarpattya Oblenergo power cuts in Ukraine around 2017, which were very effective, which got exactly the results they wanted, and very impressive in technical capability. So we were sort of afraid about what full-scale usage of their capabilities would look like. But then, in February '22, when things really started happening, we saw isolated examples of capabilities, but not nearly the amount we were expecting. At the same time, analysts around the world were expecting Russia to take over Ukraine immediately with traditional military forces, and they didn't do that either. So it wasn't as bad as we were expecting. It wasn't as bad as I was expecting. And there's probably a couple of reasons why was, but I would claim that the main one simply is that Russia isn't a very functional state. With the amount of corruption they have in there, a big part of these projects and their funding probably disappear into places that nobody knows about. So they try to build these capabilities, and they have had isolated success stories, but it isn't as functional, not in the online world and not in the internet world. Either. And that's of course great. Things could be very different. I mean, we have to remember Russia is the biggest country in the world. It's a country filled with tons of great world-class technical universities, a lot of world-class programmers, a lot of technical things they could really, if they were able to execute, use to do powerful things. But I think the best example on how Russia one way or another is broken from the technical point of view is the simple fact that we don't use any Russian-made technology in anything we do. China is the perfect counter-example. China exports tons and tons of different kinds of technology, definitely chips and hardware, but also software and services. You have Chinese-made chips in your pockets right now. You have nothing made in Russia in your pockets right now. Neither do I. You can't even name Russian mobile phone manufacturers or laptop makers, can you?

No, no. I mean, that's not what they're known for by any means. So, I mean, some software, and even those, we're seeing them come under sanctions. So if they can't do it in-house, even though they've got this great technical depth with a lot of their universities. And, you know, they're very well known for their mathematics and so forth. And, you know, you know, they were the first into, into orbit and things of that sort. You know, I'm playing back in my head as they're invading in Ukraine in February 2022. And I was expecting a lot more cyberattacks, I started seeing things like Conti come up, right, where, you know, they had outsourced and started working and partnering with, with, you know, other criminal groups and nefarious groups and third parties. And all of a sudden, some of them started to turn and started to expose. And I guess the mindset was, We're paying them probably in rubles. We're paying them to be criminals. And that's what criminals do. And even though we're going to go attack Ukraine, they're still going to do what we ask. And it almost seems like, you know, some of these people who were from Ukraine decided, yeah, the money isn't important when you're bombing my babushkas' village and I actually have more loyalty. And it only takes a few insiders to kind of up turn things. You know, we have the Conti example. Are you aware of other type of examples where there was a turn on their masters, if you will, on their managers for some of these third-party groups that they used?

I was watching the leak sites for the largest ransomware gangs very, very closely in February '22 when the invasion started to see how the groups would comment or if they would make any comments about the war. Conti, of course, famously did it. On the second day of the war, they posted publicly that they are aligning with Russian interests and they will use their skills, their power, their tools to help Mother Russia. And that, of course, was the reason why the group imploded then in the next weeks. As you mentioned, some of the members were Ukrainian, and maybe even the leadership wasn't really fully aware how they would react or what would happen. As they started leaking information about the group leaders, the group imploded and regrouped. Many of the Conti members are now part of other groups, including Clop, Aktyra, and LockBit. So Conti no longer exists. There were other ransomware gangs, at least 3 other gangs made similar statements aligning themselves with the Russian government and then changing minds or removing those comments from their leak sites fairly quickly. I don't think Russian government is directly paying these guys. I think it's more about protecting these guys. That's how they try to keep them loyal. As long as your Russian cybercriminal gang isn't hitting Russian targets, as long as you're hitting targets in Europe, in United States, elsewhere, you're fine. We're not gonna do anything about you. It's sort of like protection. It might even be that money might be flowing the other way around. There are some cases that would indicate that these cybercriminal leaders might be bribing officials or bribing law enforcement to let them keep operating. So I think it's important to make the distinction between attacks that we know are coming from Russian government, that we know are coming from GRU, SVR, or FSB. That's nation-state stuff. That's clear. That's intelligence work. That's law enforcement work. That's military work done by governments. Fairly clear-cut. Then we have the criminal gangs, the Contis, the Akiras, the Lockbits. A very big part of the top 100 ransomware gangs are Russian gangs. Not all of them are Russian, but surprisingly, I mean, majority are. Then when you look at the rest of them, most of them are what I would call ex-Soviet states. So you take all of the old Soviet Union and you'll get the countries that split out of it, including Ukraine, and many of those are coming from those countries. Then of course we do have the The outsiders, we have Vietnamese, even Iranian ransomware gangs, but they are really, really the odd ones out. But nevertheless, nation-states, criminals, and then the third group, which would be patriotic hackers, these groups that don't belong to the government but are not trying to make money with their attacks either. Groups like NoName or HaxNet. Even Killnet, which is now disbanded. And most of these gangs appeared out of nowhere when the invasion started. Within the first 3 weeks since February 2022, I think we had close to 10 patriotic hacker groups operating from Russia: Russian Hackers Team, Free Civilian, Rachdit, MistSec, Bloodnet, Cyber Army of Russia, and others. And all of these were organising themselves typically on Telegram groups, trying to gather volunteers, trying to gather donations, building up botnets, and then coordinating strikes with denial-of-service attacks against symbolic targets. And it was always about the war in Ukraine, always reacting to what's happening. Germany is donating tanks to Ukraine, let's hit websites of German banks, things like that. Very good example here in Finland, when Ukrainian President Zelensky was giving an online talk to members of our Parliament. On the same minute when the talk started, we saw a massively large denial-of-service attack against the Defence Ministry's website here in Finland. I remember very well how my phone immediately starts ringing. And it's journalists. Journalists calling me about the attack. It was very visible. They of course announced it on their channel and the news was picked up pretty quickly. And some of these journalists were, or seemed, genuinely scared. Like they were speaking with me and they were like, oh my God, they are doing it for real. It's really happening. And I asked, every single journalist that I spoke with on that day the same question. And the question was simply that, okay, yeah, sure, they're attacking, and yes, the website is down, and of course it is linked to Zelensky's speech, but how often do you, Mr. Journalist or Mrs. Journalist, how often do you visit the website of the Defense Ministry? And of course none of them ever go there. So my point is that yes, it is really happening, but the main thing they are accomplishing with this hit is that it feels bad. And it does feel— you feel violated. They are hitting our Defence Ministry. But that has nothing to do— the fact that our website of the Defence Ministry is down has nothing to do with the capability of the Ministry to do their daily work, much less to do with anything that our military is capable of doing. So it is an attack on hearts and minds, and the more the journalists write stories about it, the better it works, right?

It's symbolic, and they're trying to drive that fear even though tactically it's meaningless, right?

Yes.

Um, okay, so then let's talk about the evolution that you're seeing in the type of attacks, right? I mean, just before and even after, you know, we saw a lot more destructive wipers, right? New wipers kind of came out and it looked for me that, okay, they've probably been working on these wipers for a little while, you know, getting them ready. And then all of a sudden they released them. You know, what are your thoughts on that? And do you think that is going to continue where it's more destructive versus gathering the spine like you were talking about.

Mm-hmm. Probably we'll see them in the future as well. The best wipers we've seen made by Russian government are not just wiping Windows laptops. For example, the electricity attacks including the Pripyat-Petroblenivka attack included wiping Ethernet to serial adapters, like physical things which were actually bricked after their firmware was overwritten, including the part of the firmware that you need to reflash the firmware., which means you cannot fix them anymore. You have to physically change the things. That's pretty neat, pretty advanced. That is a wiper, which isn't a very complicated attack, but they clearly have the kind of capabilities that can take a while to recover from. The thing that really saved Ukrainian power distribution in the 2017 attack is that a big part of the operations are still very manual. It's not all computer— as centralized, computer-driven as you would see in the West. They really did have the capability of sending people to the outstations and turning on switches manually instead of using central control as you would in North America or in Europe. Another thing which is important to underline about the power cut attacks with wipers that we've seen in Ukraine, which we've seen 3 times now over the years, is that these attacks were accomplished because of defense problems by the defenders. What I mean by this is that the very first attack in 2017 was done with a Word document emailed to one of the engineers. I actually have a copy of the Word document. One of the engineers working in a control station was tricked into opening up an attachment on a Windows laptop which was connected to both public internet but also to the control network. You are not supposed to do that. That is not the way you set up the control system for your electricity creation or electricity distribution. That is not the way it is done in the West. But that's the way they were doing it in Ukraine in 2017. It's not the way they do it anymore. They are, of course, getting better. And in fact, one lesson to learn out of what's been happening over the last couple of years in Ukraine is that Ukraine is slowly but surely becoming the best country in the world in defending their networks against Russian cyberattacks. And the reason why that is happening is the practical practice they are getting every day. Let me illustrate this. Of course, everybody, all nation-states try to prepare themselves for offensive cyberattacks. That's what we do here in Finland as well. But whenever our military or our reserve, we have a million-man reserve here in Finland because we have a draft system, When we go back to military refreshers in cyber domain, we play tabletop exercises. We do different kinds of red teaming, blue teaming things. We play war games. We play make-believe, like what would we do if the Russians would do this? That's what we do, which is, of course, that's what you should be doing. But that's not what Ukraine does. In Ukraine, they've been defending themselves for 10 years against very real attacks coming from Russia. When you do something for a decade, you start to get good at it. That's one of the reasons why the cyberattacks Russia has been trying to launch against Ukraine for the last couple of years haven't been as effective as we were expecting.

Well, you had mentioned firmware wiping, which is definitely moving down the stack. Do you think that they're going to also move into the OT space versus the IT space and start really sharpening their skills to go after those type of environments where we see a lot in, you know, the electrical grids and in various different critical infrastructures?

Well, we hope not because that would be really bad and it would also expose other countries to really, really nasty scenarios because our societies are running on computers whether we like it or not. We are slowly but surely becoming as reliant on connectivity as we are becoming reliant on electricity. And that is exactly what attackers, aggressive attackers, or unfriendly nations could do if they would have the capability. There are some indications that they would like to go that route. They would like to gain more understanding of OT networks and what to do inside of them. In fact, there are a couple of examples that would indicate that directly. But I think the biggest challenge Russia really has is the skills gap, or finding the right people, the people with the skills, and convince them to work for the government instead of using their skills for something which pays them better, if you understand what I mean. One reason, I mean, over the last 33 years that I've been looking at Russia, cyber problems or computer security problems, one thing that I have become convinced of is that a big part of the problems we have aren't technical at all. They are social problems. Why do people choose to use their skills for bad? Why do they go and write malware or hack into servers or decide to, instead of doing something good with what they have learned, they decide to do something bad. And the one explanation I keep hearing is that it's very easy to use your skills for good if you are living in a functioning society where you can get a well-paying job if you are technically capable. It's a totally different story when you are living in the middle of Siberia or somewhere in poor parts of the world. The easiest way for you to make money might be to go into life of crime. Definitely the best paying places for cyber experts probably are not inside Russian intelligence agencies or Russian military. So they might have a hard time finding the right people working for them.

But they have the deep economic resources to be able to fund these programs, not only hiring the people,, also in, you know, forcing the universities to train the next generation in how to be good hackers, recruiting them in. They've got massive intelligence agencies, both domestic and international, and they, you know, have the ability to funnel resources to, you know, nation-state type of efforts here. Do you have any reason to believe that they're not using their economic power and their influence over education and driving the social understanding of, hey, this is important to protect the fatherland, the motherland, whatnot, right, to get the next generation of people working for them to achieve those nation-state goals in the cyber warfare.

I think they're trying. I think that's exactly what they're trying to do, and I think they're failing. The borders are open. The borders are open, and the smart ones are leaving. The best graduates from the best technical universities, many of them don't like the war. Many of them don't like the prospect of getting drafted into the physical war. Many of them want to leave and go and live their lives somewhere else, go and use their skills to get paid much better somewhere else.. And that's what we've been seeing for years and years. In fact, if you look at many of the Silicon Valley dot-com companies, many of them, the founders or early people are Russian developers, Russian coders. I mean, 50% of the founders of Google are Russian, right? Sergey Brin, there you go. People like that. People who have the skills, who are great, who don't want to use their skills inside Russia, they just leave. The borders are open and people are leaving. The ones who stay, yeah, certainly those they can recruit, but they're not getting— they're probably not getting the best of the best.

That makes a lot of sense. It really does. Um, okay, so taking it at a, at a global view here, do you think the attacks that, that Russia is driving towards or encouraging or things of that sort, and the severity of those attacks, do you think it's raising the bar internationally and giving a little more latitude to China, North Korea, and Iran in thinking, "Hey, we might be able to get away with this new level of attacks if we so desire." Yeah, I think this example is picked up by other countries like North Korea.

The idea that you can do tons of things in the cyber world that you couldn't do in the real world because like, what are they going to do? How can they really attribute us? Attribute as what's going to happen, yet another sanction, as if we wouldn't have seen all the sanctions already. So this is being picked up. And the one thing which I found fascinating about North Korea in particular is how they are the one that breaks the rules. I told you earlier how every single nation-state attack from Russia is either espionage or sabotage. The same thing applies to all countries. You look at offensive cyberattack coming out of the United States of America, every single one of those is either espionage or sabotage. Sabotage like Stuxnet, which clearly was sabotage. The odd one out is North Korea. It's the only government, it's the only country in the world which we've ever seen using nation-state resources to do cyberattacks to make money. There is no other country which is so hopeless, so broke, that they are trying to fix their budget deficit with ransomware or by hacking into foreign banks or hacking into cryptocurrency systems. They especially love cryptocurrency because you can't sanction bitcoins. So it really is the odd one out and they are clearly following very carefully what Russia is doing and probably even more what China is doing.

Okay, so, you know, North Korea, you're right, they've been sanctioned for I don't know how many decades, right? And, you know, their economy is suffering and they funnel it all into their military. They need more money. Yeah, you know, getting around those sanctions is definitely priority number one for them. Do you think with the increasing sanctions on Russia that they may also try and use that tactic against Western countries, one, to, you know, bring financial resources in, right, hard currency, but also at the same time they're benefiting because they're reducing the currency and creating disruption in financial markets in the West. Do you think they're going to expand or maybe even just shift from disruptive, uh, destructive wipers that may not be too effective to more of that economic attacks?

Hmm. Well, indirect, yes, like espionage, stealing information, valuable information, maybe passing it on to Russian companies to use it in their R&D, which is traditional espionage. I would be really surprised.

That's not North Korea. North Korea is stealing the money, right?

Yeah, yeah, that's what I mean. I could see them doing espionage to make money. I don't really— I have a hard time imagining Russia starting to do what North Korea is doing, like directly trying to steal from other countries, hacking international banking networks, like the SWIFT network, which North Korea has done. I'd be really surprised to see that. Of course, nothing is impossible, but I don't really think that's going to happen anytime soon, or if it does, I really would be surprised.

Do you think they would do it in a more passive way and simply give the informal green light to those patriotic cybercriminals that they may be protecting, collaborating with, you know, providing protection with and say, okay, you know, if you wanted to go attack the West and do massive campaigns, we would definitely want to endorse that at this time. And there was a time, especially when there was a threat of taking them out of the SWIFT network. They didn't want that. They didn't want to cause ripples in the financial markets. But now the gloves are off. You know, you've kicked us out of SWIFT. You're shutting down these banks. You're seizing our financial assets. Guess what? I'm going to go give the green flag to these other parties, cybercriminal parties that are based in Russia or receiving the benefit of our protection and maybe even the benefit of our intelligence. Yeah, go raise some havoc. Go steal a lot of that. 'You know, we want our bribes anyway.' Do you see that accelerating?

Probably yes, although I don't really know how direct contact channels groups like Lockbit have with the Russian government. We don't really know if they're calling each other on the phone or if there's any kind of connectivity. What we do, what it seems to be, what seems to be the case is that there's sort of like a silent agreement, like I mentioned earlier, that if you don't hit targets in Russia, they're not going to be bothered by the local law enforcement, which basically is giving them the green light already. Go and create havoc in the rest of the world, and that's just great for them because the rest of the world is trying to sanction Russia in all possible ways. So I think they already got the green light, if not directly, then indirectly.

So it's interesting, right? Because I imagine— And in a lot of these organized criminal groups, I know there's been ties and to be able to show that some of them are former FSB and GRU. Why wouldn't be there be covert communications that, you know, direct covert communications that we necessarily, you know, can't really see or monitor? I mean, if this these are ex-employees. They could be meeting at the pub. They could be having their social, you know, monthly poker game like I do with my buddies and just talking about this. You know, could there be that direct relationship and we're just not picking it up? Or do you think, no, it's probably still completely informal? I mean, what's your gut feel here?

I think the thing you described is probably a good guess. Certainly people know each other and people work in different capacities. There's unofficial information exchange, and that's probably a good guess about how it's actually happening in practice. I still find it hard to think that someone from GRU head office would call a number belonging to, you know, the guy who's running LockBit, who was just sanctioned a couple of months ago himself. But indirect communication between people who are in the know, that's, yeah, That's the likely way it's happening, if it's happening.

So it's the more informal, I know a guy, I know so-and-so, and be able to potentially leverage those resources. I can't imagine if you did have that resource, you wouldn't try and leverage it. It seems like they're pulling everything out of museums, even in the kinetic world. Why leave that on the table?

And we have to remember that there are cases where botnets controlled by Russian criminals seem to somehow mysteriously end up in the hands of Russian intelligence. Maybe the most famous example of Yevgeny Bogachev, who is still probably the longest wanted Russian cybercriminal. He's been listed by Europol and Interpol for more than a decade now, and he's still on the run. Nobody knows where he is. But it seems— well, there's a lot of Rumors that the reason why he was let go by the law enforcement in Russia was that he handed over the botnet he had built over the years, which had hundreds of thousands of infected computers worldwide. This is sort of like a gold mine for an intelligence agency in many different ways. If you gain access to an existing old botnet which was used, provably used by criminals before, then When you need information about a particular organization, let's say an agency in a particular country, you can just look at your existing computers. Do we have any computers in that network, in that IP range, any computers belonging— home computers of the employees of that organization? Which means you already have access to what you're looking for. And even better, while you're using that access, if you get caught Whoever is investigating the case is jumping through the roof, oh my God, we've been hacked, and then they are like, oh, thank God, it's just a banking Trojan. We thought it's the Russians. No, no, it's just a banking Trojan. It's both the perfect cover, but also a great way to use an existing access. So this is a clever way for intelligence agencies to work with the criminals. Catch them, give them an offer they can't refuse, take their existing access, and in exchange let them walk.

I mean, that's a tremendous, tremendous resource. That's a powerful tool. If we kind of roll that forward, right, because again, GRU FSB, they're going to go, oh, this is about— we want this, we want this capability. The logic then follows to say, well, wait a second, These organized criminals can have certain skills and capabilities, can create certain tools that we can leverage. Do you think that next logical step is to form more of a partnership and say, you know what, you've got the technical chops to create a botnet like this. You've got, you know, certain infrastructures that you try and maintain. What if we help you with providing you intelligence, human intelligence, right? We have that in spades. Mm-hmm. Um, what if we provide you with certain infrastructures that are a little more bulletproof than what you have to play with? Uh, do you see the Russian government potentially providing these resources? Um, you know, signal intelligence, all that. To select partners that may be able to leverage them and then share those tools, those resources, and those benefits back with those intelligence agencies and military agencies?

Yep, I do, and it's one of the things I'm worried about the next decade of ransomware. Earlier this year, I gave my keynote at RSA conference titled The first decade of corporate ransomware, and I ended up with a pretty pessimistic note about how we've only seen the very beginning of this problem. Ransomware, you know, it's going to go on as long as ransoms are paid. It's only getting bigger, and victims are paying the ransom, so it is going to continue. And right now, the targeting of ransomware victims is very, very random. This is obvious to anybody who has scrolled through the leak site of a group like Akira or Lockbit or Clop, because you see all kinds of organizations from all business sectors from all over the world, small companies to enterprises to public sector. And the reason why it is— why the selection is so random is that there is no targeting. They simply have a vulnerability and then they just scan the whole net to find all vulnerable machines, and you end up with a really random selection. Now,— if there would be more professional targeting, maybe helped by an intelligence agency, they would be hitting much more selective targets, targets that would be much more valuable from the criminal's point of view and much more valuable from disruption point of view for nation-states. That could very well be where we will be going, because this problem is just in the very beginning. We have only seen the first decade. It is going to go on. This is the beginning. It's gonna get worse.

I completely agree. So let's talk a little bit about how it's going to get worse. Let's get more specific in what you're talking about. When you're talking about, you know, valuable targets, good level of disruption that could help, obviously, the government and their intentions around the world. You know, that screams to me critical infrastructures. Is that really what we're talking about here? Are we just talking bigger businesses and, and, you know, media sites or things like that? Or are you really worried about the critical infrastructures that deliver energy, power, transportation, communications, national defense, those types of things that keep the lights on, the food in the grocery stores, armies, you know, connected under, under command, things of that. What are we talking here in your mind when you're talking disruption?

All of that is absolutely prone to attack. You can absolutely hit all kinds of critical infrastructure targets. The level of defenses we have in place anywhere in the world wouldn't really withstand proper attacks by professionals. One thing that seems to limit ransomware gangs in hitting really large critical infrastructure targets or really large governmental targets is the fact that when that has happened in the past, the groups have found themselves under very active reconnaissance and targeting from US government. Prime example here being REvil and Colonial Pipeline and JBS Foods 3 years ago. The amount of bounties put onto their heads and the amount of investigations started by law enforcement, all the way to Biden talking one-on-one with Putin about how they have to do something about this. It doesn't get much bigger than that. So it may be a little bit too big a game for any ransomware gang to try to want to go there unless they really really know what they're doing. So it seems to be a better idea to hit companies, even huge enterprise-sized companies, than to go after critical infrastructure and military targets and governmental targets. They like the attention, but to a limit. If it gets too big, then many of these groups have realized that, well, the groups don't exist anymore. Like our REvil is no more.

Yeah, but they just reinvent themselves, right? It's like they scatter and then recoalesce and they pick a new name and a new webpage and a new, you know, icon and banner or flag or whatever you want to call it. It seems like no matter how hard you hit these, they just, they come back together.

They do take a hit. I mean, even if the individuals who were in R-Evil I'm guessing most of them are still in cybercrime and are part of other groups, but the group disbanded, and that's not a small hit. It's actually surprisingly important for these ransomware gangs to maintain the brand. They go to great lengths to build a brand on themselves. LockBit, that's a great brand. Everybody who works in the industry knows that this is serious. You know that if you get hit by a ransomware gang, it's bad. If you get hit by LockBit, it's very bad. You know that these guys have been in business for years and years. You know that you won't be able to crack the encryption. You know that they will post your files if you don't pay. But you also know that if you do pay, they won't attack you again, they won't leak the files, the decryption tool will work. It's been tested over and over again. You know that they are criminals, but they are like honest criminals. And this is the reason why these gangs do branding. That's why they have names. That's why they have logos. That's why they have websites. That's why people take LockBit tattoos. Just like people take Hells Angels tattoos, people are taking LockBit tattoos for the same reason. Hells Angels is an organized criminal gang which has a very strong brand recognition. It's a scary brand. That's exactly what Akira LockBit and Clop and Quantum and RansomX and Play are trying to build with their own brands. And if the brand disappears because you have to regroup and change brands, that's actually a pretty big deal for them. They don't like to do that unless they have to.

So it sounds like— well, I completely agree, right? Branding in business, and this is really for a lot of these criminals, it's their business, and they treat it very, very professionally, and that's why they, they're, they're so good at it. But from the nation-state perspective, right, that then creates an area of variability that they may not want, especially for those tools, or if they want to leverage them, um, you know, as an element or a support to foreign policy. Uh, and, and we see this in in the kinetic world as well, though, right? Um, we see how Russia over time, uh, did use a lot of independent mercenaries, right, if you go back. And then they kind of moved to, okay, we're going to build up our own military. But they also have allowed groups like, uh, Wagner Group, right, a private military company, essentially a business but very specialized, that has very close ties in the kinetic world, right? You're talking about a company that has their own tanks and jets and troops. Um, do you think the evolution, when we look out maybe 3 or 5 years, maybe sooner, do you think Russia will go down that similar path with cyber warriors to be able to say, yeah, we want to have these private military cyber groups that we've got close ties with. We are resourcing, but we're still, you know, it's not our official military. So there is arm's distance, but yet empowering them to be able to conduct attacks at their behest against targets that, that they prefer. Do you think that's in the cards?

Yep, I think it is. We could see that, but we have to keep in mind that there's a very big difference between traditional deterrence and deterrence in the cyber world. The biggest property of a weapon typically isn't using the weapon, but having the weapon and showing the weapon. Which we call deterrence. The fact that you don't want to go to war against a country because you know that it's a very powerful country. That's what we are trying to do here in Finland. That's why we have such a large reserve. We don't want to fight, but we want to have a very large military because we don't want to fight. So it's sort of like reverse psychology. However, this completely falls down in cyber. Because how do you show what kind of capabilities do you have? You can definitely show your aircraft carriers and your bomber jets your tanks. That's why we have military parades. Funnily enough, the military parades never have the cyber troops part of the parade. And if we would really like to get some return on the investment that militaries put into offensive cyber power, that's something we should be doing. But of course, having them in part of the parade wouldn't really prove anything. The only way to really show what you can do in cyber is to actually show what you can do in cyber. If not for real, then have some kind of war games and show it to your enemies. Look at how we can do things like that. And the problem in showing what you can do is that you really would have to show that you do it for real. It's not a simulation. You really have this capability. And if you show it, then unlike any other weapon, by just showing what you do, your enemies can see what you do and they can clone what you do. They get a copy of your attacks, but simply by seeing the attack. They don't get a copy of our tanks simply by seeing the tanks, but if you show them that there is this vulnerability in these systems, we can exploit it like this, and now we are inside of your military systems, then they know they can do the same thing, or they can fix the problems that you were exploiting. So the problem of deterrence is really complex in cyber, and it's made worse by the fact that the weapons we use in cyber are typically exploits, finding ways into vulnerable systems. Exploits rust, just like tanks rust. They don't work forever. You buy a brand new tank today, you might be able to run it for 50 years, 40, 50, maybe even 60. Well, Russia runs them for 60 years or 70.

Russia is pushing some T-55s and T-54s out of museums right now.

It's amazing. But yes, but nevertheless, there is a limit to how many years you can run it. Same applies applies to cyber. If you have an exploit against Windows 11 right now, it's going to work for a couple of years. It's not going to work for a decade, definitely not for 20 years. So there's a limited lifespan. But the problem is, when you get closer to the end of the lifespan of the exploit, you got no return on the investment to develop the exploit. No one even knows you have this. You haven't shown it to anyone, unless your tanks. And it's just going to expire and all of your investment is just going to vanish. This is completely different from everything else we do in military. Typically the biggest, or one of the reasons why we invest in military is to get the deterrence power and in cyber we typically get no deterrence return at all. And that is totally different from anywhere else.

What if it isn't about deterrence, right? And I see a lot of analogies between cyber operations and traditional foreign intelligence operations, right? I mean, you don't parade your CIA agents at the parade either, or your GRU agents, right? You don't do that. However, you know, Russia has tremendous capabilities. You know, you start seeing a lot of people falling off their balconies or are being irradiated, um, in foreign countries, right? There are signs, there are telltale signs. Um, do you think that, you know, that they're going to invest in those, those capabilities and maybe not have it out at the front of the parade but still invest those billions of dollars or trillions of rubles to make that capability real, and they'll probably also be signs, right? There'll be signs for certain levels of attacks and certain targets and so forth. Do you think that's where they're potentially going? Is that what we're going to see, not only from Russia but from all the, the major aggressive nation states?

Yep, and I think it also lowers the barriers for actually using these weapons, um, because they've— if you've spent the effort, if you spent the money, and you're getting nothing in return, when these tools, whatever weapons you have, whatever exploits you have, when you're getting closer to useful life cycle of the tool, maybe you want to get some return on it. Maybe, of course, you don't want to start a war just to use your weapons, but you might pass them on to intelligence agencies that, hey—

We are talking about Russia here.

Yeah, yeah, yeah. I hear what you're saying, but let's keep realistic here. But nevertheless, you could pass this on to intelligent people. Hey, we developed it to use this for wartime, but they're not going to work for very much longer. Why don't you use this to, you know, hack some of our enemies to find intelligence and use these for other useful things for the motherland? So it lowers the barriers for using offensive exploits and zero-day exploits that are developed for military use just by having them if you want to get some return on your investment instead of just letting it disappear without anyone even ever knowing you had them.

An unused weapon is a useless weapon.

Unfortunately, you're right.

Okay, I don't want to fearmonger or anything like that there because that does not help anybody. But I mean, you live in Finland, you're a couple of hours away from the Russian border. You just joined NATO. Welcome, by the way.

Thank you.

You know, what types of cyber aggression are you worried about? Are you telling your governments and your businesses that they need to pay attention to or they need to to invest in? You know, it's not fearmongering. It's okay, we know we have an aggressive threat here. What are you telling them? What's your advice to them?

First of all, let me thank you for having us in NATO. We promise to do our part.

You already are. So yes, thank you.

But here in Finland, we have to remember we're a small country, 5.5 million people, and we 13,000 kilometers, close to 900 miles of border with the biggest country in the world, a very unpredictable country, country we fought before. Both my grandfathers fought the Russians in the Second World War. We are very aware that they are right there. I am in capital Helsinki, this is 2 hours away from the Russian border. This is something that the whole country knows, so I don't really have to educate the companies about this. Everybody knows already. But one part of this is the military draft system. Practically all males go to army for a year after high school, which is what I did as well. And then you go back regularly. One thing we try to do is to put our people in positions in reserve that match their skills in their civilian life. So for example, when I go back to to refreshers in the military, they don't give me a gun, they give me a keyboard. I'm much more effective with a keyboard. You will do more good with that. Maybe much more deadly as well, so who knows. But you get the point. We try to match the skills of the reserve with the skills of the civilians to make it as effective as possible. Companies here in Finland understand not just national security as a concept, they feel that they are also responsible for it as a company. So companies, when their employees take leaves to go back to military refreshers for a week or two, that's understood. You are still paid by the company for the duration that you are there. It's the norm. Everybody does that. Companies have their executives trained for crisis and conflict situations. We have a national defense course that's actually targeting the very top management of the largest companies and the politicians, which is actually a fairly long course. I've been a teacher there for 20 years, and it's surprising how it's a course. I mean, imagine this. You take the average American company and you would propose to the chairman of the board or to the CEO that you would have to leave your work for a month to go and train national security. Wouldn't be an easy pill to swallow. That's what we do here. And companies, the executives are actually queuing to get in. It's actually much wanted to be accepted to this course. You can't apply, you are asked, and it's a badge of honor. That you get into one of these courses. So, we think about this a little bit differently here because we do have such a big neighbor. And that, I guess, it makes my job a little bit easier because I don't really have to explain to the typical executive in a Finnish company, regardless of the size, that we have to take these things seriously.

Well, that is definitely not the mindset here in the United States. United States, right, where we've always benefited from big oceans on both sides and, and not had to worry about that, um, you know, after our— since our revolution, right, since we became a company. So how do we in, in North America, in the United States, how would you suggest we overcome that chasm that, that you don't have to— your, your country, your people, your businesses, your culture understand you have a bully on the block that you need to deal with. Um, we don't. I mean, any recommendations, um, other than having a bully in North America or South America we have to deal with?

You have to keep your eye out for the Canadians. You never know.

He just brings syrup, you know.

True, true. Well, a very practical answer to your question is that one of the best things you can do to prepare your country, your government, and your critical infrastructure against nation-state attacks is to make sure the amount of legacy systems you have is at the minimum. The more you have outdated machines, operating systems, machinery, the harder these things are to secure. It's hopeless to try to secure systems that are running operating systems which are no longer up to date. This is unfortunately very much the norm, especially in manufacturing industry and big part of the critical infrastructure in United States. The mental state in many factories has been that yes, we have these old systems with this computer running Windows 2000 controlling our factory automation system, but it's okay because it's not connected to the internet. And that's true. If you are able to keep them offline, it is pretty much secure. But how do you keep it offline? That's the real problem. It's surprisingly hard to keep these things offline. Certainly you can design your network that, you know, it's separate net segment, it's off limits. Works for now. How long will it work is the real question. If you have a system running for years and years, The longer time passes, the more likely it is that you are exposing some parts of your network without even realizing it. Pandemic was a great example of this, as people were installing remote access systems and modems into different parts of networks just to be able to work from home. At the very same time, they were exposing systems which were supposed to be completely offline to public internet. It's surprisingly hard to secure things by trying to keep them offline, so we must not keep running old and outdated systems. We must be updating our systems to something we can actually defend.

Yeah, you know, when I was at Intel, you know, I led the strategy for factories and we had 26 different operating systems going back to DOS 3.0 that were running in these environments. And, you know, even the more— the newer operating systems, because they were part of an appliance, you couldn't patch it. You had to have the vendor do it. So you had vendors in and out out all the time. Sure, you could air gap it, but over time, just like you were saying, that begins to erode. And as some technology gets replaced, well, now every new component that's replacing an old component now has some online capability. So, you know, eventually holes start appearing and connections start happening. The tendrils reach out. You authored a book, right? If It's Smart, It's Vulnerable. I'll put the link in the thing. Yes, yes. And so even in those air-gapped systems, as things start upgrading, right, you're now— those tendrils are going out and you're now making them smart and therefore you're making them vulnerable.

Yep.

Any key insights you want to share from your book in regards to that? I mean, how big of an issue is this? Where are you seeing the biggest vulnerabilities?

Slowly but certainly everything is becoming connected. There's nothing we can do to stop this. There's many reasons why things that we wouldn't think would be going online will be going online. It doesn't matter that we might not like it. It's going to happen anyway. And eventually connectivity will be exactly as necessary for our societies to function as electricity is today. We really should be changing the mindset that we defenders have. I'm guilty for this myself. I've been in this industry for so long, and I for years and years thought that my job is to secure computers. I'm a computer security guy, so my job is to secure computers. Well, now when everything is becoming a computer and when our societies are running on top of systems run by computers. Our responsibility, my responsibility, your responsibility, Matthew, our responsibility is to secure the society. That's what it is.

Outstanding insights. Thank you, Miko. It's always insightful and a little scary to chat with you. Definitely keep doing what you're doing. And I know you work a lot, you know, with the folks over in Ukraine to help defend their environment. And even in North America. Your talk at RSA this year was outstanding. The poor laptop suffered, but that's okay. For anybody that hasn't seen that, I think it's out on YouTube. You can look at his keynote.

Yes.

Again, a great kind of history of ransomware, where, how it emerged, where it's going, great insights. Thank you again so much for chatting with us. Chatting with us today.

Thank you, Matthew. Thanks for having me, and I'd be happy to come back anytime.

And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders like Miko here, where, you know, talking about the most relevant and interesting, sometimes scary challenges, uh, different perspectives and industry best practices. Thank you much. See you next time.