>> Hello and welcome to
the last video from the module attribution.
This lesson will cover the nation-state attribution.
It is valuable to explore
a nation-state sponsored hackers
because they are generally resourced the best,
and their collective motivations
>> run across the spectrum.
>> Because nation states supported hackers are funded
extremely well relative to small
>> groups and individuals.
>> They can be particularly formidable adversaries
for other countries and for commercial industry.
In short, nefarious nation-state
sponsored cyber activity can
have devastating effects on
a country's national security and its economy.
Let's see together what we will learn in this lesson.
We will start with
an introduction to nation-state actors.
We will see their modus operandi and their motivation.
We will discover the targets
of the state-affiliated attackers.
We will go from defenders perspective
to see what are the challenges for
detection and how can
we mitigate the threat of nation-state actors.
Let's define the nation-state threat actors.
A nation-state actor has a license to hack.
They work for a government to disrupt or
compromise target governments, organizations,
or individuals to gain access to
valuable data or intelligence,
and can create incidents
that have international significance.
The word that we need to focus on
here is "license to hack".
Because these threat actors might be part of [inaudible]
cyber army or hackers for hire for
companies that are aligned to the aims of a government.
The nation-state actor often has
close links to military, intelligence or
a state-controlled operators of
their country and of
a high degree of technical expertise.
Alternatively, nation-state actor recruits
may be picked for a specific language,
social media, or cultural skills
>> to engage in espionage,
>> propaganda, or disinformation campaigns.
A nation-state actor will have
the resources and capabilities of their government
behind them and will take instructions from
other government employees or
members of the armed forces.
When it comes to the targets of a nation-state actors,
these hackers are increasingly targeting
government institutions, industrial facilities,
and many businesses with
powerful and sophisticated techniques
which interrupts business operations,
leak confidential information, and can
result in massive data and revenue loss.
As today's state-sponsored cyber attacks
are growing in scale,
frequency and sophistication,
understanding the motivation and capabilities
of these hackers is the first step
towards employing a risk-based approach
to mitigate in the most advanced
>> and persistent threats.
>> Let's see their motivations.
State affiliated or sponsored
actors often have particular objectives,
aligned with either political,
commercial, or military interests
of their country of origin.
What actors are often attempting to
gain in these attacks is information about
their targets or access to their targets
through trusted relationships
>> with third-party companies.
>> Often the sensitive nature of data being
held by a third party may not be fully
appreciated or the company may not
consider itself the target of a nation state.
Therefore, it often doesn't
>> have the level of prevention,
>> detection, and response capabilities
to prevent nation-state attacks.
A nation-state actor is
specialized with a remit of specific tasks.
They will be tasked with stealing industrial secrets,
disrupting critical national infrastructure,
listening to policy discussions,
taking down companies that
offend their leaders in some way,
and conducting propaganda or disinformation
campaigns within and outside
>> of their country's borders.
>> Wherever possible, state-sponsored actors will use
standard attack methodologies used by
other typical cybercrime actors
>> and penetration testers.
>> They do so because they work incredibly effectively and
want to be generic so they can't
be attributed to any particular group.
These usually involve targeted phishing emails,
followed by use of recent,
known exploits that the victim
may not have gotten around to patching.
All those data taken from data breaches
may not always appear on underground markets.
What can appear are the tools
and guides for how to take advantage
of the vulnerabilities that allow to
access to the vulnerable systems in the first place.
As an example, a researcher published
the flow that was used to penetrate Equifax.
Within 24 hours,
the information was published to hacking
websites and included in hacking toolkits.
When they have a foothold,
these actors often move laterally into
shared servers and other systems
where they can steal privileged credentials.
From there, they rarely use much malwares.
They stick mostly to using
administrator tools like normal sysadmins.
They go to ground in a persistent, long-term,
and relatively quiet way,
much like a parasite.
Any decent state-sponsored actor is
going to persist in their target's networks
without their knowledge or
much impact for months to years before discovery.
Only when a company is
highly mature in it's security posture,
and is a high-value target,
and generic attacks fail,
then these actors will resort to using
costly zero-day malwares developed internally.
The majority of organizations find out about
cybersecurity attacks because someone
else tell them about it.
State-sponsored actors will rarely make lot of noise
and cause sufficient disruption
to warrant suspicion or trigger detection.
Their objectives are to remain persistent to retain
oversight of communications
>> or access to sensitive data.
>> As such, they will also often
plant persistence mechanisms on
systems throughout victim's networks
which may remain untouched or dormant for years.
These can remain practically invisible until
the victim attempts to extract the actors and,
just as the victim thinks it was successful,
the actors will use these to walk
straight back in and continue operations.