Chapter 2 Cyber Threats in Focus: Actors Targeting Singapore CII SECTORS SUCH AS THE GOVERNMENT, BANKING & FINANCE, HEALTHCARE AND ENERGY SECTORS ARE ATTRACTIVE TARGETS FOR APT ATTACKS BECAUSE A STRIKE ON THEM COULD HAVE SIGNIFICANT IMPACT ON THE ECONOMY AND SOCIETY. ADVANCED PERSISTENT THREAT(APT) HACKTIVISTS APTs operate stealthily and with sophistication, often hiding in networks for prolonged periods to plan their targeted attacks. APTs, which may refer to the type of attack, or the threat actor or group, are also often state-sponsored. Their mission includes espionage, data exfiltration, and data manipulation. Hacktivism is the act of hacking, or breaking into a computer system, and/or defacing webpages to promote a political or ideological message. Hacking has arguably become an increasingly attractive alternative to conducting physical street protests as the Internet affords hacktivists anonymity and reach. Cyber activities associated with state actors are becoming more overt in recent times. Cyberspace is one environment through which sensitive information is obtained for state-on-state espionage. As geopolitical tensions rise, the need for international cyber norms becomes more pressing. (See Page 40 on Singapore’s efforts to promote International Cyber Norms). group was discovered to be eyeing a Singapore institution, using its signature tactic of phishing on individuals there. Through close collaboration between the institution and the authorities, the APT attempt was detected and halted before further harm could be done. The early identification and stopping of malicious APT activity is a multi-stakeholder effort that would involve the intelligence APT groups active in the Asiacommunity, law enforcement Pacific region include APT1 and APT30; and Southeast Asia-based agencies, the targeted institution, PLATINUM. CII sectors such as the and even foreign counterparts. Government, Banking & Finance, Healthcare and Energy sectors are attractive targets for APT attacks because a strike on them could have significant impact on the economy and society. One APT Owned by Defacer G In 2016, there were a total of 1,750 Web defacement cases related to Singapore. Most of the websites defaced belonged to SMEs from a range of sectors including home interior design to healthcare. The hacktivists appear to be politically-motivated groups from the Middle East, and had also concurrently conducted their mass defacement activities on websites around the world. CASE STUDY Top Defacer in Singapore This group appears to be a politically-motivated hacktivist group from the Middle East. The group carried out website defacement attacks that often included messages bearing their views on issues such as the conflicts in Syria and Palestine. The group would typically replace the home page of the affected website with a cartoon of a devil carrying a pitchfork. This group has been responsible for defacing as many as 339 Singapore websites in 2016, accounting for about 20 per cent of Singapore websites that were defaced last year. Targets included organisations in the non-profit sector. However, the group does not appear to target Singapore companies alone, as their acts of mass defacements were also carried out against company websites in other countries, including India and Iran. (See Page 32: Common Cyber Threats in Singapore - Website Defacement). Cyberspace presents a rich target environment and the rise in geopolitical tensions may potentially spill over into cyberspace with APT groups targeting key assets in Singapore and the region. 24 25