H-ISAC Hacking Healthcare 8-4-2020 - Health-ISAC - Health Information Sharing and Analysis Center

TLP White: This week, Hacking Healthcare explores the ramifications of the European Union’s decision to sanction malicious cyber actors for the first time ever, including why it may only really benefit the healthcare sector in the long-term. Following that, we brief you on an evolution in disinformation campaigns that makes trusting online sources even harder.

As a reminder, this is the public version of the Hacking Healthcare blog. For additional in-depth analysis and opinion, become a member of H-ISAC and receive the TLP Amber version of this blog (available in the Member Portal.)

Welcome back to Hacking Healthcare.

1. European Union (EU) Sets New Precedent by Sanctioning Cyberattack Perpetrators.

On July 30^th, 2020, The EU took the unprecedented step of imposing sanctions on six individuals and three entities “responsible for or involved in various cyber-attacks.”[1] The Council of the European Union noted several specific cyber incidents, including WannaCry, NotPetya, Operation Cloud Hopper, and an attack against the Organisation for the Prohibition of Chemical Weapons.[2]

The individuals and organizations named are linked to China, North Korea, or Russia. Both named Chinese individuals are linked to APT 10, while the four named Russian nationals are tied to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GU/GRU).[3] In addition, the organizations sanctioned are the Main Centre for Special Technologies of the GU/GRU, a China based science and tech company, and a North Korea based organization linked to APT 38 and numerous cyberattacks across the globe.[4]

In a statement accompanying the sanctions, Josep Borrell, High Representative of the EU, stated they took action “to better prevent, discourage, deter and respond to such malicious behaviour in cyberspace,” while also “[calling] upon every country to cooperate in favour of international peace and stability, to exercise due diligence and take appropriate action against actors conducting malicious cyber activities.”[5] Both the United States State Department and the United Kingdom’s Foreign Secretary lauded the move.[6]^{, [7]}

The mechanism for the sanctioning appears to come from a relatively newly adopted sanctions regime that is now part of the Framework for a Joint EU Diplomatic Response to Malicious Cyber Activities, referred to as the Cyber Diplomacy Toolbox.[8]^{, [9]} The sanctions themselves impose travel bans, asset freezes, and prohibit EU persons or organizations from making funds available to any of the named individuals or entities.

Action & Analysis
** Membership required **

2. News Sites Infiltrated by Hackers to Plant Fake News.

Disinformation campaigns are not new, but as we have seen, the growth of the Internet and the proliferation of social media has greatly expanded the methods used by those with a disinformation agenda. Combatting disinformation is often a tall task due to concepts like free speech, difficulty in determining intent, and ambiguity over whether misleading or false information breaches applicable terms of service. A new FireEye report shows how the already insidious action of disinformation campaigns can be amplified with the help of hackers.

FireEye reports that over the past few years, disinformation operations “aligned with Russian security interests” have sought to hack legitimate news websites and replace their content with false and misleading text and images.[10] These unauthorized changes appear to have been a result of stolen user credentials that allowed access to the victim organization’s content management systems.[11] Furthermore, FireEye believes that the threat actors tended to replace existing legitimate entries with fabricated articles, which could slow discovery of the changes.

While these unauthorized alterations tended to be quickly found, removed, and disavowed, such remediation did not happen before false information was quickly shared on social media.[12] This type of tactic would appear to both discredit reputable organizations while simultaneously lending credibility to misleading content. For the operations that the FireEye report covered, content was primarily focused on anti-NATO messaging and included COVID-19 related material in an attempt to stoke fear and resentment.

Action & Analysis
** Membership required **