Cloud Hosting

In the Insurance Banana Skins 2023 report, a joint effort by PwC and CSFI, the global insurance industrys primary concerns have been revealed, with mounting fears over cyber crime and escalating worries regarding climate change.

The insurance industry faces its foremost challenge in the form of cyber crime. This threat encompasses the potential theft of sensitive data, phishing, and ransomware attacks.

Notably, cyber crime has held its top position as the most significant global risk since the 2021 report.

Insurers are navigating an increasingly intricate digital landscape characterised by new technologies, cloud computing, and extended supply chains. This complexity amplifies their vulnerability to cyber threats.

To counter this, the report underscores the urgent need for proactive cyber security measures integrated into both business and IT architecture.

Insurers voice concerns regarding the misuse of artificial intelligence as a potent weapon for breaching security, with a specific focus on state-sponsored cyber crime.

Rising costs associated with mitigating cyber threats are causing unease among insurers. The expansion of the insurance industrys IT ecosystem, driven by the proliferation of internet-connected devices and reliance on cloud and third-party services, heightens the challenge of defending against cyber attacks.

Climate change has ascended to a prominent position, ranking among the top three concerns for insurers. This reflects the growing immediacy and impact of climate-related risks.

Governments and regulators are increasingly urging insurers to enhance risk quantification and management in alignment with broader Environmental, Social, and Governance (ESG) agendas.

Regulation remains the primary concern for life insurers, closely followed by cyber crime. The sector grapples with additional challenges related to interest rate risk, macroeconomic factors, and investment performance.

While technological change is a shared concern, the risk from artificial intelligence ranks lower, and climate change is of lesser concern compared to non-life and reinsurance sectors.

Property and casualty insurers in the non-life sector are primarily concerned about climate change, followed by operational risks stemming from cyber crime. High-level concerns include technology, artificial intelligence, and regulation.

Change management challenges take higher precedence in this sector compared to the life insurance sector, although macroeconomic risk is of lesser concern.

Following the record-breaking global heatwave in July 2023, climate change has risen as a significant risk for reinsurers. They share concerns about cyber crime, technology, and artificial intelligence with other sectors.

Recruitment issues are common, and reinsurers are unique in placing de-globalisation among their top ten risks, reflecting the global nature of their business and concerns about protectionism.

Continue reading here:
Insurance industry grapples with rising cyber crime threat, climate ... - Reinsurance News

A prominent cyber security group has investigated operations against government websites in Iran and concluded that due to the structure of Iran's Internet and its separation from the global Internet, operations against government websites, including those belonging to state Radio and Television on January 27, 2022, the Ministry of Foreign Affairs on May 7, 2023, and the office of the president on May 29, 2023 were conducted by infiltration andcould not have been the result of penetration from outside Iran.

In recent years, the Treadstone71 cyber security group has published several reports on the Iranian government and its cyber-attacks and has evolved as an authority in this field.

The Treadstone71 report underscores that major attacks on the Iranian government sites were most likely carried out by penetrations from inside Iran, in particular by insiders who had access to these systems.

Scores of the Iranian governments most important websites, as well as online systems of the Tehran Municipality and national radio and television networks, have been subjected to massive attacks since January 2022.

The group Gyamsarnegouni ("Uprising till Overthrow") has taken responsibility for the main attacks and has disclosed extensive internal government documents of the Iranian government on its Telegram account. The group has defaced the home pages of a number of websites, posting crossed-out images of Supreme Leader Ali Khamenei, and placing the pictures of Iranian opposition leaders.

In 2022, Albania's government internet structures and services were targeted by a massive cyberattack, which caused many problems. Extensive investigation by Microsoft and others pointed the finger at Tehran.

According to Treadstone71s assessment, "Iran has a longstanding history of engaging in cybersecurity attacks, and according to some statistics, ranks fifth among nations known for targeting their adversaries through cyber warfare.

"As a safety precaution," Treadstone71 notes in its report, Iran decided to shift its government websites from European hosting servers to domestic hosting companies, as part of its National Internet," and as a result, All government and state-controlled websites were relocated from European and American hosting servers to domestic hosts, and access to select government and state-controlled websites was restricted to the National Internet, making them inaccessible via the global internet.

Treadstone71 report underscored, we also witnessed a different kind of attack, separate from those infiltrating governmental websites on vulnerable Iranian hosting services; those made by Gyamsarnegouni ("Uprising till Overthrow"). Attacks carried out by this group were among the deepest infiltrations against the Iranian government's networks.

The report notes:

These attacks stood out due to three key characteristics:

1. The extent of infiltration into the most secure government networks, comparable only to the Stuxnet attack (which used a flash drive).

2. The volume of exfiltrated documents.

3. The widespread access to servers and computers.

The Treadstone71 report underscores that state radio and television networks, particularly in undemocratic countries like Iran, are among the most isolated and most protected networks. It further says: Iran's internal broadcasting network is not connected to the Internet and is severely air gapped; meaning it is physically isolated from the internet and can only be accessed from withinThe only way for an outsider to gain access to the network would be through physical infiltration

In January 2022, the Iranian news media pointed out that government institutions believe this attack was carried out by individuals who had inside information about Iranian state radio and TV systems.

The attack on the websites of Tehran Municipality on June 2, 2022 included breaking into 5,000 cameras employed for traffic control and face recognition. According to Treadstone71, the hackers would have known that the cameras were not connected to the Internet and that they would need to gain physical access to the cameras to hack them.

But Treadstone71s most startling findings are related to the two high-profile and attention-grabbing attacks by Gyamsarnegouni in May 2023.

During the attack on the website of the Iranian Ministry of Foreign Affairs, hackers gained access to 50 terabytes of data from the Ministry 's archives. Treadstone71s assessment is that this required "penetration into the inner-most layers of this governmental body. The nature of the leaked documents indicates that such documents would be inaccessible from the internet, further supporting suspicions of insider involvement.

Treadstone71s expert assessment concluded that the transfer of 50 TB data would not be possible remotely and on a filtered network such as that of Iran, and added that the sheer size of the hack is also revealing about how it was carried out.

The normal Internet download speed of Iranian is 11.8 megabits per second. To download 50 terabytes of data from the Foreign Affairs Ministry of Iran at this speed would take over 392 days or over a year of uninterrupted download time, and Irans Internet frequently drops, is throttled by the government, and experiences regular government-induced blackouts, the report stated.

Based on these numbers, such an attack highly likely occurred from direct access to the data.

In relation to the attack on the website of the presidential office, the hackers breached the most secure communication systems of the government and obtained tens of thousands of documents that were no more than a few months old.

According to an Iranian expert, this site used a dedicated IP address that was impenetrable."

"The fact that the hackers gained access to tens of thousands of documents not more than a few months old also suggests that insiders conducted the attack. These documents would have been stored on computers with limited access to the Internet, and it would have been difficult for an outsider to access them," Treadstone71 stated.

The report concluded by saying: The Iranian government initially attributed blame to foreign adversaries. However, cybersecurity experts and mounting evidence suggests insider involvement.

Share this article:

See original here:
Cyber Security Group: Operations Targeting Iranian Government ... - EU Reporter

Members of a Russiancybercriminalgang behind the Trickbot/Contiransomware attacks, which included the hacking of critical infrastructure and hospitals during the COVID-19 pandemic,face new sanctions today (7 September).

Eleven cybercriminals, whose gang also threatened those who oppose the illegal Russian invasion of Ukraine, have beentargetedwith asset freezes and travel bans in a coordinated effort by UK and US authoritiesto counter the threat of ransomware bothin the UK andabroad. The US Department of Justice (DOJ) is concurrently unsealing indictments against seven of the individuals designated today.

The National Crime Agency (NCA), who conducted a complex investigation into these individuals, assesses that the group was responsible for extorting at least $180 million from victims globally, and at least 27 million from 149 UK victims. The attackers sought to target UK hospitals, schools, local authorities and businesses.

The individuals being designatedin the UK are:

This action was taken in coordination with the US, where these key cybercriminals have also been sanctioned,and is a continuation of joint efforts by the UK and US to disrupt and impose costs on high harm cyber criminals. It is assessed that sanctions have hampered the ability of cyber threat actors to monetise their cyber criminalactivities.

Foreign Secretary James Cleverly said:

These cybercriminals thrive off anonymity, moving in the shadows of the internet to cause maximum damage and extort money from their victims.

Our sanctions show they cannot act with impunity. We know who they are and what they are doing.

By exposing their identities, we are disruptingtheir business models andmaking it harder for them to target our people, our businesses and our institutions.

The individuals, all Russian nationals, operatedout of the reach of traditional law enforcement and hid behind online pseudonyms and monikers many of which are revealed today. Removing their anonymity undermines the integrity of these individuals and their criminal businesses that threaten UK security.

Several of those facing sanctions today held significant roles within thegroup. Those targeted includehigh-level managers and administrators, as well astwoindividuals, Maksim Khaliullinand Mikhail Tsarev, who focused on recruiting and inducting new members.

Thegroup was also one of the first to offer support for Russias invasion of Ukraine, maintaininglinks and receiving tasking from the Russian Intelligence Services.

Deputy Prime Minister and Secretary of State in the Cabinet Office Oliver Dowden said:

By targeting these malicious cyber actors, who have been known to work with some of the most damaging ransomware strains, we are seeking out and exposing those who threaten the UKs national security.We will alwaystake decisive action with international partners to protect the UK, its peopleand businesses.

Security Minister Tom Tugendhat said:

These sanctions demonstratethat the UK will crackdown on those trying to hold UK businesses and infrastructureto ransom. We will use our law enforcement agencies to go after the perpetrators and punish their crimes.

We have the skills and resources to find and unmask criminals who attemptto steal from British businesses, schoolsand hospitals.

We will keep working with our partners, like the US, to defeat these threats.

NCA Director General of Operations Rob Jones said:

These sanctions are a continuation of our campaign against international cyber criminals.

Attacks by this ransomware group have caused significant damage to our businesses and ruined livelihoods, with victims having to deal with the prolonged impact of financial and data losses.

These criminals thought they were untouchable, but our message is clear: we know who you are and, working with our partners, we will not stop in our efforts to bring you to justice.

National Cyber Security Centre (NCSC) Chief Executive Officer Lindy Cameron said:

Alongside this latest round of sanctions, I strongly encourage organisations to proactively obstruct the activities of ransomware operatives by bolstering their online resilience.

Ransomware continues to be a significant threat facing the UK and attacks can have significant and far-reaching impact.

The NCSC has published free and actionable advice for organisations of all sizes on how to put robust defences in place to protect their networks.

Todays sanctions announcement reinforces the UKs commitment to cracking down on cyber criminals. They follow on from the first ever joint UK-US sanctions against ransomware actors in February this year. The total number of group members sanctioned is now 18.

Original post:
UK sanctions members of Russian cybercrime gang - GOV.UK