Nations investing in cyber, 'democratization' of malware are factors accelerating dangers online, CISA official says

Brandon Wales said at CyberWeek that the twin phenomena have increased the "prevalence and impact" of attacks.

Two trends are combining to amplify the threat that cyber poses to the U.S., according to a top Cybersecurity and Infrastructure Security Agency official: nation-states expanding their offensive capabilities, and the wider availability of easily-used hacking tools.

Brandon Wales, executive director of the Department of Homeland Security’s cyber wing CISA, said Monday that nations like China, Russia, Iran and North Korea “are investing significantly in tools to target our networks.”

A small number of ransomware gangs also are producing malware for wider use as part of their affiliate programs, Wales said at CyberWeek, a Scoop News Group event.

“We continue to see a democratization of malicious cyber capabilities,” he said. “Today, hacking tools can be purchased for use by any criminal, regardless of expertise, or even rented to provide as a service capability.”

Those separate phenomena are responsible for many of the most troubling developments in cyberspace over the past year. The U.S. has blamed Russian and Chinese state-backed hackers for the SolarWinds and Microsoft Exchange Server hacks, respectively, that caused widespread intrusions. And ransomware attacks, mostly from gangs that the U.S. says Russia is harboring, have increased dramatically in 2020 and 2021 in part due to the ransomware-as-a-service business model.

“What we are actually seeing is the intersection of two concerning trends,” Wales said. “Nation-state actors are expanding their capabilities. Full access to off-the-shelf cyber intrusion capabilities are now readily available.”

That has moved the danger of cyberattacks from the “conceptual to the tangible,” he said.

“Over the past year we have seen cybersecurity intrusions increase in both prevalence and impact, targeting some of our most critical national functions, banks — hospitals, oil and gas companies, and everything in between,” Wales said.

Wales touted the Biden administration’s approach to responding to those attacks, such as a May executive order that largely addressed the cybersecurity of government agencies and contractors. CISA, tasked with a great many responsibilities under that order —35 in all — has met every deadline so far, he said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure