CHAPTER 1 SPOTLIGHT ON CYBER THREATS MALWARE Fewer ransomware cases were reported to CSA in 2018. There were also significantly fewer Command and Control (C&C) servers observed in Singapore; however, the number of botnet drones – compromised computers infected with malware – remained largely similar. FEATURED TOPIC ADVERSARIAL AI IN CYBERSECURITY RANSOMWARE 21 ransomware cases were reported to CSA in 2018, a decrease from 25 in 2017. Although the number of reported cases is low, the actual number of ransomware cases may be higher as many go unreported. Ransomware affected systems across multiple industries in Singapore, such as construction, education, and food and beverage. While there were no global widespread campaigns like the WannaCry attacks seen in 2017, ransomware remains lucrative, and continues to evolve in sophistication. GandCrab was described as “one of the most aggressive forms of ransomware” 3 in 2018. Since its discovery in January 2018, GandCrab has infected over half a million computers and is believed to have extorted around US$300 million GANDCRAB, THE MONEYGRABBING RANSOMWARE GandCrab is offered in the Dark Web as Ransomwareas-a-Service (RaaS) by its criminal developers. Modeled after Software-asa-Service (SaaS) principles, cybercriminals without programming knowledge would rent such ransomware for their malicious activities, and pay the developers by sharing a portion of the collected ransoms. in ransom payments. In February 2018, a private financial institution in Singapore was infected with GandCrab, when one of its employees surfed a compromised website and was prompted to install a ‘font update pack’ for displaying the website properly. Ransomware remains a common threat. Europol has warned that targeted ransomware attacks which are tailored to specific organisations or individuals, such as GandCrab and SamSam,4 may become the new normal.5 Organisations should ensure that their systems are regularly updated to thwart known ransomware threats. They should also not make any form of payment demanded, as there is no certainty they would get their data back. Some characteristics of GandCrab include: (a) being frequently updated to evade detection and deletion, (b) targeting mainly English-speaking countries, and (c) customisable ransom demands. As part of the No More Ransom initiative, free decryption tools for later versions of GandCrab are made available for affected victims to recover their files. This public-private cooperation exemplifies the need for collaboration between government and industry partners to combat global cyber threats together. Machine learning and datadriven detection systems are being adopted in cybersecurity applications to cope with rapidly evolving cyber-attacks. However, threat actors are now leveraging adversarial Artificial Intelligence (AI) technologies to deceive these systems. One method of deception involves using Generative Adversarial Networks (GANs) to create new variants from known malware that are able to bypass malware detectors. One way to counter this attack would be to include GAN samples during re-training, so that the malware detector is tuned to identify this class of mutated samples. To combat against new cyberattacks, AI engines constantly train and update their models. This adaptive learning process, however, creates an opportunity for threat actors to poison data used to train the models and thus influence decision boundaries. One method of defending against this type of attack involves processing the training data to identify potential adversarial data manipulation first, before providing them to train the AI engines. 3 “The GandCrab Ransomware Mindset,” Check Point Research, 13 March 2018, https://research.checkpoint.com/gandcrab-ransomware-mindset. 4 On 22 March 2018, the City of Atlanta in the US state of Georgia suffered a ransomware attack which affected several local government systems and disrupted businesses. Almost US$17 million was reportedly spent in recovery efforts. The ransomware used in the attack, dubbed ‘SamSam’, was also linked to another ransomware attack on the Port of San Diego in September 2018. 5 Palmer, Danny. “Cybercrime: Ransomware remains a 'key' malware threat says Europol,” ZDNet, 18 September 2018, https://www.zdnet.com/article/cybercrime-ransomware-remains-a-key-malware-threat-says-europol. 16 17