Chapter 1 Cyber Threats Singapore Faces CASE STUDY THREATS TO GOVERNMENT The Singapore Government had its share of cyber-attacks in 2016. Public agencies faced attacks that included phishing and APTs (See Chapter 2, Page 24 for an analysis on APT). The Internet Surfing Separation (ISS) policy announced in June 2016 will go a significant way towards securing the Government’s ICT environment. In removing the link between the public officers’ computers from the Internet, it can disrupt the attackers’ cyber kill chain. Without a path out to the Internet, the attacker will not have remote access to the Government’s network, and will not be able to extract data as easily. APT Malware Infection in Government Organisation WHEN CASE ANALYSIS Late-2016 From the investigations, CSA assessed it to be the work of a state-sponsored APT actor, which up till then had not been known to be active in Asia. The incident however was assessed to be more an opportunistic one than a targeted attack. BACKGROUND CSA was alerted to a possible APT malware infection in an organisation in the public sector. CSA found the malware infection – which had backdoor capabilities – on one Internet-facing computer. Fortunately, the infected computer had not been used to process sensitive information. EVIDENCE Suspicious attempts to connect at regular intervals to a C&C server, which was later determined to be a compromised server. FOLLOW-UP ACTION Investigations also concluded that data was not exfiltrated, though the malware had the capability to do so. The malware was also not observed to have spread beyond the infected computer to the rest of the organisation’s network. The organisation did not detect the malicious network traffic earlier because the warning indicators and malware signatures were not on known anti-malware databases. The APT actor was believed to be a group supported by a foreign government (also referred to as a “state-sponsored group”), to engage in cyber espionage to further their national interests. It had not been known to value targets in Asia, but with this incident, it could suggest an expanded scope of targets in the region. Recommendations were provided to the organisation to further secure its ICT environment and prevent similar incidents. These included blocking unauthorised macros or programs, implementing application whitelisting, and segregating networks. TACTICS, TECHNIQUES & PROCEDURES Attackers used sophisticated anti-detection and infection techniques: multi-stage infection through a phishing e-mail that ultimately allowed the attacker backdoor access. One example of segregating networks is the Internet Surfing Separation policy the Singapore Government announced in June 2016, that will help to prevent data from being transmitted to or extracted from the Internet. 12 13