CHAPTER 2 TARGET.SG TARGET.EDU.SG CASE STUDY Threat actors target academic institutions for a variety of reasons. These include stealing sensitive research information, and using them as stepping stones to gain access to high security systems and networks. CYBER-ATTACK ON UNIVERSITIES In 2017, the National University of Singapore (NUS) and Nanyang Technological University (NTU) were hit by sophisticated cyber-attacks that were assessed to be the work of APTs. These incidents highlight the need for academic institutions to stay vigilant constantly and strengthen their cybersecurity defences, as part of measures to protect their intellectual property. I UN IT RS E V Y WHAT HAPPENED? FOLLOW-UP ACTION resembled the web portals of the In April 2018, CSA received universities. These portals were information that there was a breach of user account credentials made to look as if the victims had at various universities in Singapore. accidentally logged out of their accounts and prompted them to Further investigations revealed that at least 52 accounts from four enter their login credentials. universities – NTU, NUS, Singapore The login credentials of the Management University (SMU), victims were later used to gain and Singapore University of unauthorised access to the Technology and Design (SUTD) – online libraries of the universities, had been compromised. in order to obtain research publications of staff members Unsuspecting victims received across various research fields and spear phishing e-mails that academic disciplines. directed them to a credential The affected universities reset the passwords of all users, and scanned computers and networks for signs of further compromise. SingCERT sent out advisories to alert all users about the incident, and heighten their vigilance against similar attacks and other potential cyber threats. harvesting website, which closely 26 27