THREAT ACTORS IN CYBERSPACE The activities of state-sponsored actors in cyberspace and cybercrime have long been the most serious threats to the cyber security of the Czech Republic. The trend in recent years has indicated that the activities of state actors and advanced cyber threat actors have begun to overlap.vii The evolution of cybercrime activities is best demon­ strated by the development of ransomware attacks. In 2020, the healthcare sector was the most affected.viii The activities of cybercrime groups in the Czech Republic were mainly visible during the ransomware attacks at the University Hospital Brno and the Psychiatric Hospital in Kosmonosy. Whereas previously extortion attacks were a non-targeted low-cost activity aimed at quick profits, the trend in ransomware activities in recent years has been characterised by a targeting of specific institutions rather than a random mass of individual users.ix Ransomware operators preselect the institutions they consider most likely to pay a ransom. If they suc­ ceed in penetrating their systems, they do not encrypt the files immediately. Instead, they investigate the at­ tacked system and specific data are only encrypted once their potential value for the victim has been assessed.x Some cybercrime groups, similarly to state actors, thus have a long-term unnoticed presence (persistence). The expansion of Ransomware as a Service6 is partly responsible for this development. The activities of state actors are extensive: from ob­ taining large quantities of personal data to industrial and strategic espionage, which also takes place in the Czech Republic. In 2020, the NÚKIB cooperated in the handling of an incident that involved a breach of data confidentiality in the networks of a strategic government institution. The NÚKIB analysis of compromising indicators discovered that the attacker was almost cer­ tainly a state actor (90% – 100% probability). The trends in espionage indicate that some states are highly likely 6 7 (75% – 85% probability) to employ cybercrime groups for espionage purposes and other state-required activities more and more often in exchange for toleration of their criminal activities. The statistics of the Police of the Czech Republic (Chart 15) show that, contrary to their previous increas­ ing trend, cybercrime and crimes committed on the Internet have remained at a constant level over the last two years. The number of cases investigated dropped by 4.1% between 2019 and 2020. The reason is an amendment to the Criminal Code,7 which increased the amount of damage that has to be caused for clas­ sification as a crime. Considering the long-term trend, a further increase in cybercrime in the Czech Republic in the coming years is likely (55% – 70% probability). Chart 15: Cybercrime cases investigated in the Czech Republic between 2011 and 2020 (source: Police of the Czech Republic) 8 417 8 000 8 073 6 815 6 000 5 023 5 344 5 654 4 348 4 000 3 108 2 000 2 195 1 502 0 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 Ransomware as a Service (RaaS) denotes a service provided by ransomware developers to other hackers, usually for a share of the ransom; the ransomware developers do not take part in the actual penetration of organisations’ systems. Act No 333/2020, amending Act No 40/2009, the Criminal Code, as amended, Act No 141/1961, on criminal procedure (the Criminal Procedure Code), as amended, and some other laws. Threat Actors in Cyberspace 15