CYBER SECURITY SPECIAL REPORT
Cyber extortion and ransomware crimes have reached an industrial scale amid the rise of remote work, prompting a call for greater personal defences.
With increasing numbers of workers logging in from remote devices, cyber professionals have pointed to the growing business and reputational impacts, speed and average $1m cost of the malicious attacks.
Australian Information Security Association chair Damien Manuel said the scale of extortion attacks was “ever increasing”.
“As organisations have more and more data, it’s easy to now get access to that data,” he said.
“Ransomware is now moving from destroying your data to grabbing a copy of your data – and potentially destroying the local copy – and also extorting you by threatening to release that publicly.”
Major attacks globally have shut down national networks and created widespread business disruption, such as last month’s Optus data theft and extortion attempt that impacted more than 9 million customers.
Often distributed through fake phishing emails or network vulnerabilities, the attacks employ malware to extract data or lock up systems. Networks may shut down or display a message before turning to black, reducing computers to a metal box. Then come the financial demands, usually to be paid in cryptocurrency.
The Australian Cyber Security Centre, the official government agency monitoring cyber threats and leading security, has described ransomware as among “the most disruptive of all threats”.
Manuel said the cyber criminal world had matured into a complex, specialised industry in which data theft was commercialised through a hierarchy of cyber criminal businesses.
“You’ll even find people who are stealing it and running it as business as a service,” he said.
CyberCX executive director, digital forensics and incident response Nick Klein, said ransomware had grown globally as an effective, high-value crime.
The cyber security consultancy has worked with about 400 Australian and New Zealand companies over the past 12 months. Initial extortion demands ranged from $5000 to $50m.
“These are criminals,” he said. “They are motivated by one thing, and that is money.”
He said cyber crime had been facilitated by working from home increasing the attack surface potential, and the availability of cryptocurrency to transfer money.
“Remote working has escalated that risk,” he said. “So much of the workforce is coming in remotely. If (organisations) are not checking every entry point, verifying and locking it down, it will allow an attacker to join the crowd.”
He said experts were aware of the previous crimes, habits, and negotiations of the about 40 main criminal groups.
“There are some attack groups that we deal with where we can tell you their history of honouring their word, and in every instance that they are paid they say what they are going to do,” he said. “The huge caveat that we cannot over-emphasise is that you’re dealing with criminals. There are absolutely no guarantees.”
Danny O’Neill, the director of global managed detection and response operations at cyber security software company Bitdefender, said criminal tactics and techniques were changing constantly and ongoing monitoring was critical.
“I like to call it a game of cat and mouse,” he said. “Every time we come up with detection, the attackers always change.
“We have to assume compromise. The important thing is to identify it quickly, contain it and minimise the impact.”
He advised people working from home to use work devices solely for work, and home devices for personal use.
But he said “the basics still apply”, with individuals responsible for setting up their infrastructure with antivirus software and secure routers.
The rise of cyber crime and its use by state-backed actors has driven significant responses from the Australian government, and was among the drivers for the Australian Signals Directorate’s $10bn REDSPICE (Resilience, Effects, Defence, Space, Intelligence, Cyber, Enablers) response.
This includes a plan to triple the current cyber capability, double persistent cyber-hunt activities and add 1900 new analysts and technologists, along with corporate and enabling roles by mid-2025.
PwC partner in cyber and digital trust Andrew Gordon said there was positive government and industry engagement underway to increase cyber resilience in Australia.
He said the recent expansion of reporting requirements for critical industries to 22 asset classes would assist oversight of cyber crime.
“More sectors have an obligation to make a report to the Department of Home Affairs, allowing them to understand and quantify the issue as well,” he said. “It’s a move forward.”
On the vexed issue of whether ransom payments should be confirmed as illegal, Gordon said it should remain a principles-based guidance given the potential for life-and-death and health impacts.
Cyber Security Cooperative Research Centre chief executive Rachael Falk there was “no doubt” ransomware was an extremely potent form of malware that could cripple organisations with no warning, and advised all organisations to take steps to reduce their risks.
“Basic cyber hygiene is vital and it should focus on patching, multifactor authentication, legacy technology and the risk of human error,” she said. “By all organisations ensuring they have a solid cyber security posture and taking these steps, they can take to reduce the risk that their organisation will be a victim of ransomware.”
Planning for backups is also essential to retrieve data if a system is locked up and encrypted.
RMIT University Centre for Cyber Security Research and Innovation director Matt Warren said remote work removed the “controlled environment” of corporate systems and faced challenges to determine the extent of their data sources and storage.
“The entire threat vector increased in complexity and organisations had to protect it,” he said. “It made it a lot more difficult.”
“The problem you have from a practical perspective is that organisations have now become very bad at backing up data because of the complexity of systems and using third-party systems,” he said.
“Organisations actually don’t have complete awareness of their data. We’re seeing large, well-funded organisations not being able to protect their own systems.”
Australia’s largest telco and internet provider, Telstra, has acknowledged the increased pace and scale of cyber threats in recent years.
Telstra’s chief information security officer Narelle Devine said with the shift to working from home, there were “crucial technical measures” in place but also an equally important culture of security.
“The criminals shifted tactics to take advantage of businesses and people working in a different way,” she said.
“As the nation’s largest telco, we have a front row view of the volume and nature of malicious activity.”