CHAPTER 1 SPOTLIGHT ON CYBER THREATS ADVANCED PERSISTENT THREATS In the past two editions of the Singapore Cyber Landscape, we highlighted the significance and potential impact that Advanced Persistent Threats (APT) have on our cyber ecosystem. Often associated with a nation-state, APT groups have access to a wealth of resources and deep expertise to achieve their objectives, which include causing disruption, cyber theft for financial gain, and conducting cyber espionage. DISRUPTION APT groups may choose to target prominent, highly-visible international events with the aim of disrupting them to draw attention. The Opening Ceremony of the PyeongChang Winter Olympic Games in February 2018 was one such example. The attack, attributed to an Asia-based APT group, disrupted Internet access and telecasts, and shut down websites covering the event. Another type of APT attack seeks to disrupt operations. Shamoon, a type of wiper malware associated with an APT group based in the Middle East, is designed to wipe data and render endpoints and servers unbootable. This prevents the targeted organisation from conducting business as usual. First seen in 2012 in the energy industry, it reemerged in December 2018, affecting a number of organisations across many industries in the Middle East. FINANCIAL GAIN A number of high-profile cyber-attacks targeting payment systems were attributed to APTs, resulting in significant losses to affected financial institutions. These attacks typically involve tactics, techniques and procedures (TTPs) such as phishing e-mails to compromise employee accounts and gain access to systems and networks, as well as technical methods to cover the attackers’ tracks. In June 2018, attackers breached the SWIFT payment system at the Bank of Chile and the Cosmos Bank, siphoning off US$10 million and US$13.5 million respectively, through fraudulent wire transfer requests. These attacks were likely conducted by the same APT group. CYBER ESPIONAGE APT groups are known for conducting information gathering and cyber espionage. Information gathered can be useful for intelligence purposes, and/or give countries a competitive advantage over rivals during state negotiations. One such example was a watering hole 1 campaign active in the last quarter of 2018 that compromised several government and media websites in Vietnam and Cambodia. These websites were used to infect visitors with spying malware. This attack was attributed to an Asia-based APT group that cybersecurity experts had identified as being behind several espionage and spear-phishing campaigns targeting Southeast Asian countries. 1 A watering hole attack is a type of cyber-attack targeting a particular organisation, where malware is delivered from websites that are regularly visited by the organisation’s members and infects its systems. 10 11