Chapter 1 Spotlight on Cyber Threats Globally, several major cybersecurity incidents were attributed to Advanced Persistent Threat (APT) groups observed to be targeting Advanced Persistent Threats sectors including government, banking and finance, healthcare, infocomm, and media.3 For example, APT groups have allegedly masterminded high-profile incidents involving financial institutions and cryptocurrency exchanges.4,5 A number of covert, malicious activities from APT groups stood out for their sophistication, with notable trends as follows: Mobile Espionage While the Pegasus spyware made headlines in 2019 for enabling its users to read and monitor data on hacked mobile phones, APT groups have also developed and deployed mobile malware to target both individuals and organisations. In the wake of protests in various countries throughout False Flag Operations Hacking the Internet Core Compromising Information Technology (IT) Service Providers to Steal from Victims Cybersecurity experts have observed how APT groups have exploited vulnerabilities APT groups generally undertake cyber operations APT groups are covering their tracks to in the Internet’s core infrastructure to to support the intelligence and espionage avoid attribution by carrying out “false flag” access sensitive networks and systems. In objectives of their respective state sponsors, operations — that is, masquerading as other particular, an APT group was observed to which could include economic, diplomatic and threat actor groups by deliberately adopting have compromised and changed the Domain technological goals. The popularity of cloud their Tactics, Techniques and Procedures Name System (DNS) records of targeted services has inadvertently turned Information (TTPs). In late-2019, an APT group allegedly organisations, in order to intercept and re- Technology (IT) Service Providers, such as attacked and stole information from direct their Internet traffic to malicious servers. Managed Service Providers (MSPs) and Cloud organisations from the same region, by using These servers then inspected the traffic before Service Providers (CSPs), into targets for threat malware and hacking tools stolen from another routing it to the intended destinations. Victims actors looking to steal classified information. APT group based in the Middle East. This might in this campaign included some 40 government An APT group was allegedly behind a spate of have led victims to believe that they had been and national security organisations, as well as attacks on MSPs and CSPs to gain access into targeted by the Middle East-linked APT group. technology firms, from 13 countries. the networks of their client organisations, which 2019, several APT groups were noted to be hacking into and conducting surveillance on mobile devices belonging to individuals from various countries. These operations involved both iOS and Android malware designed to access and read text messages, contact lists and call logs. They were also found to be monitoring targets through recording functions such as cameras and microphones in the compromised devices. Separately, Golfspy, an Android malware linked to a state-sponsored APT group, was used to steal images and military documents from infected mobile devices located mainly in the Middle East. Golfspy’s malicious codes were embedded into legitimate mobile applications, which were then included major technology, telecommunications, hosted on a website and promoted on social and defence companies. media to propagate the spread of Golfspy. 3 4 5 8 SINGAPORE CYBER LANDSCAPE 2019 FireEye Mandiant M-Trends 2020 Report, https://www.fireeye.com/current-threats/annual-threat-report/mtrends.html. Nichols, Michelle. “North Korea took $2 billion in cyberattacks to fund weapons program: U.N. report,” Reuters, 5 August 2019, https://www.reuters.com/article/usnorthkorea-cyber-un-idUSKCN1UV1ZX. Salem, Eli. “Threat Actor TA505 Targets Financial Enterprises using LOLBins and a new Backdoor Malware,” Cybereason Blog, 25 April 2019, https://www.cybereason.com/ blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware. 9