Winter Olympics targeted by nation

One month out from the 2018 Winter Olympics, hackers are targeting the games with a campaign that looks like it came from a nation-state.

Hackers targeted the upcoming 2018 Winter Olympics in a campaign that had all the hallmarks of a nation-state hacking campaign, according to the cybersecurity firm McAfee.

A slate of organizations involved with the Pyeongchang-based games received spearphishing emails beginning Dec. 22, 2017 and continuing until the end of the month. The attackers pretended to be with the South Korean National Counter-Terrorism Center.

The goal was to have targets open a malicious Microsoft Word document that would establish a backdoor on targeted machines so hackers could then take additional steps to steal data or completely take over a computer.

The Olympics are a major target for hackers because billions of dollars as well as global geopolitical undertones always run through the event. The South Korean organizing committee is spending 1.3 billion won ($1.2 million) on cybersecurity for the games.

“Overall, this is an example of something that happens fairly regularly with major events and the Olympics generally,” Betsy Cooper, head of the UC Berkeley Center for Long-Term Cybersecurity, told CyberScoop

In 2017, Cooper authored a report on the cybersecurity of Olympics that examined how the range of threats faced by the event is rapidly expanding.

South Korean officials have a particular eye toward threats from North Korea. Due to a tumultuous year on the Korean peninsula, cyber threats have increased significantly.

The targets of the December 2017 campaign included planning, direction and operational organizations behind the upcoming Pyeongchang Olympics.

“The hackers are interested in gaining a deeper insight than would be necessarily public knowledge,” Ryan Sherstobitoff, a senior analyst with McAfee Advanced Threat Research, told CyberScoop.

Sherstobitoff noted that the attackers used the tool Invoke-PSImage, released on Dec. 20, to hide code in pixels of a hidden image file that would then decode the image and reveal the malicious implant. The fact that attackers adapted, tested and deployed Invoke-PSImage so rapidly is an important bullet point.

“That suggests the attacker is not a sole person but an organization that is interested in getting into these targets,” Sherstobitoff said. “Second of all, they’re leveraging the increased usage of fileless attacks which have been heavily used in the last year.”

At this point, there’s no telling which nation might have been behind the campaign. There are dozens of countries that regularly carry out this kind of action.

In August 2016, the World Anti-Doping Agency (WADA) was successfully hacked and had data publicly leaked in a campaign widely credited to Russian hackers. That campaign came just amid the 2016 Summer Olympics after it was revealed that Russian athletes engaged in a widespread, systemic and government-backed doping system.

The country was formally banned from the 2018 Winter Games.

With about one month left until the Olympics begin, experts are expecting more of the same.

“Similar attacks like this are possible in coming month leading up to the Olympics,” Sherstobitoff said, “that might even be more full-scale operations with a lot more pieces moving to it.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure