Cyberwar: US Enemies Are Targeting Small Businesses

As you probably know by coming to our blog site, we are a cybersecurity company. We provide managed IT security services to many small and medium businesses (SMBs). Therefore, we have become evangelists on the topic of cybercrime protection through our blogs, services, webinars, and social media. We do our best to communicate and educate. 

But the most frustrating part of speaking out on the dangers of cyber criminals is that our messaging can come off as marketing hype. In fact, many companies in our industry are guilty of proclaiming the dangers about cyber crooks just to sell products and services. And as we all know, fear is a strong motivator for triggering sales. In fact, many industries survive and thrive on making people feel insecure. I especially like the Allstate mayhem commercials. 

However, gaining sales through fear is not our motivation for talking about cyber security. We speak out for a different reason. We relentlessly promote our messaging to SMBs to talk about cyberwar as well as cybercriminals. Let me explain… 

Who are the cybercriminals and what do they look like? 

I find that business executives have an outdated image of a hacker. Without fail, my first objective in a presentation is to dispel the decades old perception that hackers are just rogue teenagers in their parent’s basement. In fact, this has not been true since sometime around 2003. Although it can be argued that the origin of the hacker culture started with some very talented and mischievous youngsters, the cybercriminal world has had twenty years to develop, improve, and mature.  

In the early part of the twenty-first century, the online world of crime quickly moved from sneaky pickpockets to syndicates. Fast forward to today and the commercial cybercrime industry has developed into a multilayered marketplace on the dark web that better resembles Amazon than a cartel. In fact, according to the World Economic Forum, Cybercrime is projected to cost the world $8 trillion in 2023 and $10.5 trillion by 2025.  This would make Cybercrime (if it was a country) be the world’s third largest economy after the US and China. Setting up an entire illegal phishing attack infrastructure takes about the same effort as standing up an e-commerce site. So today cyber criminals can look like anyone with some bitcoin and a questionable character. 

Of course, you should protect your company from the latest hackers whoever they are. But random crooks are not the primary motivation for our cybersecurity media content. We want to change the conversation. Enough about these cyber criminals who attack companies for personal gain. We know that we can stop them. What we really need to start talking about is the cyberwar on the U.S. small business economy. 

What does global cyberwar look like? 

They best current example of cyberwar is the attack by Russia on Ukraine. After hours of reading studies by major U.S. institutions, I found that almost all agree that the cyber-attacks on Ukraine during the war had little impact on the effectiveness of the Russian military. In fact, the attacks trailed down significantly after the invasion. I was surprised by that. 

However, what made more sense to me was that the attacks on Ukrainian businesses by the Kremlin began years before the Russian troops crossed the border. They used both phishing techniques to infiltrate government and corporate networks and malware that hacked firewalls and routers. Microsoft reports that in 2018, Russian intelligence agencies infected over 500,000 of these edge devices worldwide. 

Fortunately, Ukraine has world class information technology talent. During the decade of Russian cyber-attacks before the invasion, they worked to harden their defenses. They also had the support of the major security, software, and cloud companies as well as European cyber defense agencies. And obviously with Russia closing in they were motivated. 

Several cyber security leaders in Europe, UK, and the United States believe that these precursor Russian cyber-attacks gave Ukraine years of experience in fighting back. It forced them to spend the resources to strengthen not only their defenses but also develop rapid responses to quickly restore damaged systems. 

It will be years before the Western thinktanks know for certain the methods and effectiveness of the cyber efforts by the Russians during the war. But the biggest takeaway for now is that Ukraine used the same methods that we preach to build up their defenses—endpoint detection and response, security awareness training, updates to devices, and building redundant backups in the cloud. 

And these precautions had a significant impact on protecting the Ukrainian government and businesses by the time the physical war happened. 

What does cyberwar look like for local businesses? 

Recently, we were contacted by company that had been hacked. They were alerted that they had an issue when payments to their vendors were never received but the money had left their accounts. 

The first thing that we did after reviewing their systems was to reconfigure the network and isolate the data streams moving through the company network into distinct pathways that we could control. 

We segregated functions such as the desktop/laptop computers, servers, cameras, phones, and printers. Once we did this, we found unusual traffic access to the servers and security cameras from outside the company.  

Of course, we shut down the access to the network resources from the outside. Immediately, our security roadblock triggered new events including autogenerated virtual computers that appeared until we shut them down for good. Obviously, the intruders wanted their access to the network back. Once we mitigated the attack, we found hacking applications that are known to be of Chinese origin.  

I can’t get into the details of the amount of cash lost by the company. But I will say that ACH account numbers for vendor payments were changed as well as new fictious vendor accounts being created which resulted a significant amount of money lost over several months.  

What does this mean for American small businesses? 

The reason that we point out the Russian attacks on Ukraine in the years before the invasion is because it illustrates that our enemies can use time and technology to infiltrate the businesses of their enemies (like us). The hackers using Chinese software had been in the network for many months.  

Our government agencies that monitor cyber-attacks regularly state that it is not only China and Russia attacking American companies, but it is widely accepted that North Korea and Iran also use technology to breach American companies. 

Here are some takeaways for business owners: 

• Our foreign enemies have the technology to infiltrate thousands of unsuspecting U.S. companies in a short period of time. 
• These intrusions are likely to remain dormant for months or years before being called into action for additional intrusions, stealing money, or staging mass attacks. 
• The state actors use the same techniques as common criminals to attack—captured passwords, phishing, devices with outdated updates, and misconfigured networks. 
• We know how to combat these attacks with technology security assessments and remediation followed by the implementation of integrated layered security tools and following security best practices. 

• Cybersecurity agencies estimate that more than half of small businesses have already been breached. 

I hope that I have created the idea in your mind that we need cybersecurity for more than just random attacks of ransomware for bitcoin by criminal syndicates. But what I really want is to reshape the thinking of American small business owners. I hear these comments to often: 

“Why would hackers come after my company? I have nothing of value. We won’t get hit. They would be wasting their time.” 

Opportunistic criminals target specific companies, and their motives are obvious. We call it “phishing” because crooks want to hook one of your employees, immediately send in the ransomware, encrypt your files, and take your money in bitcoin. Get in, get money, and get out. 

There is a bigger picture to consider the strategic attacks found in global cyber warfare. The sophisticated criminals (including nation actors) are very deliberate and covert in their infiltrations. They are very stealthy in stealing money and establishing a base of operations for future damage. According to the experts and our anecdotal investigations, your business is likely already compromised. 

The sophisticated criminals are much more capable, subtle, and focused on long term damage. Of course, as evidenced by recent investigations that we have done, they will steal money. But as we have learned from the events in Europe, there is a political motivation that we need to recognize. Our enemies are taking American territory one business at a time. 

American firms and institutions need to take a lesson from our friends in Ukraine. We need to take the next few years to harden our defenses on a company-by-company basis. Small and medium business owners need to take responsibility for not only their own cyber risk, but the risk to their customers, vendors, and employees. And their bank accounts. And to our nation. 

But more importantly, take leadership. Own your piece of the responsibility that we all share to protect our small business nation from manipulation and exploitation by our enemies. Like Ukraine, we can’t wait for a conflict with one of our adversaries to act. Now is our time to fight back. Let’s get motivated! 

At CIS, we are ready to back up our talk with action. If you are a concerned business owner or executive, we are happy to give you a “no fault” outside independent assessment on a budget that you can afford. Please contact me for details. 

Custom Information Services: Your Cybersecurity Partner

Are you facing cybersecurity challenges or have questions that need expert answers? Don’t hesitate to reach out to us. We’re here to help you navigate the complex world of cybersecurity and ensure your business is secure.

Interested in understanding your organization’s security posture? Consider exploring our Vulnerability Assessment service. It’s an essential step towards identifying potential weaknesses in your systems and implementing the necessary security measures.

Discover what a Vulnerability Assessment could do for you.

Remember, in the digital world, being proactive is better than being reactive. Let us help you stay ahead of the curve.