Srsly Risky Biz: Iranian hacks with Russian characteristics

0:04Amberleigh Jack: Hey everyone and welcome along to Seriously Rescue Biz. This is our podcast where we look at sort of big picture stuff like cybersecurity, policy and intelligence. My name is Amberleigh Jack and very shortly I'll bring in Tom Uren, our policy and intelligence editor, and we will have a bit of a chat through Tom's newsletter that he has written up this week. If you're not yet subscribed to that, you can head along to our website, rescue.biz, and read it, subscribe, it lands in your inbox every week. First, though, I'd like to thank our sponsor for this week, which is Airlock Digital, the application and allow listing platform, and you can find them at airlockdigital.com.

0:41Amberleigh Jack: Tom, it's great to see you.

0:43Tom Uren: G'day, Amberley, how are you?

0:44Amberleigh Jack: You're really good, thanks, Tom. And I do love a good skeptic, and that's pretty much what you've brought to the table with your newsletter this morning with your first piece. So France has come out, has blamed Iran for some of the freezer hacks that we saw recently. And first up, I guess, because there's been so many of these and they haven't all been blamed on Iran. So why don't you walk me through really quickly what France has attributed to Iran here and what is still up in the air?

1:14Tom Uren: Okay, so France, the government, they came out and attributed a couple of days of hacks to Iran. So October 11 and 12, Sunday and Monday, overnight, there was really quite a lot of freezers, fridges diddled with to make them run hot, like really hot, like 50 degrees. I mean it's a bit of a mystery now that I think about it Why you would ever want a fridge to go that high Or a freezer Maybe it's to defrost super quickly But when there's food in there that is obviously very bad And it was hundreds of stores were affected So it's like on a national scale Is it the end of the world? No, but it's like a pretty significant attack And so that set of attacks was attributed to Iran.

2:15Tom Uren: There's been a string of these incidents since August, and the first set was a set of freezers in US military bases across six different bases. And same deal, temperature set really high, food spoiled, has to get thrown away. and there have been several other incidents across Europe and affecting many different countries all at the same time, hundreds of stores. Yeah. So it's, you know, when you're throwing out hundreds of freezers worth of food, that starts to get pretty significant in just terms of dollar loss. so they've narrowly attributed that particular hacks on those particular days. There was also the French National Blood Donation Service.

3:14Tom Uren: Their refrigeration units were also affected but pretty reassuringly they had monitoring in place so staff detected that there was an anomaly and could step in and fix things. so it didn't interrupt the blood supply.

3:29Amberleigh Jack: Yeah. So I want to ask you because when, I mean, people have been talking about these hacks for a while and there have been a number of people, including you, saying it looks very Russia. Why Russia, not Iran?

3:46Tom Uren: Well, it just makes sense considering all the other things that they've done. So it fits within a pattern of behaviour. They've done many different small-scale destructive attacks That range from trying to convince someone to throw a bomb Like a pipe bomb or a Molotov cocktail at a military warehouse To attempted assassinations all across Europe So the part that really matches is the array of things That have occurred in European places because it's just trying to sow that kind of chaos. Yeah, yeah. And it just matches their modus operandi in the last several years, really.

4:30Amberleigh Jack: And probably worth pointing out that Iran is in a war currently and not with Europe. That's right.

4:39Tom Uren: So the one thing that does make sense is the first set of attacks against US military bases. Like that would be entirely consistent with Iran. And if there had been a subsequent string of attacks all across the US of the same sort of thing, different retail fridges or freezers affected, I would entirely buy that as a possibility. So Iran a few months ago did quite a few water facility hacks in the US. And that to me made total sense in terms of raising political awareness of the pointlessness or the costs, I guess, of the US war in Iran without ever reaching the point where the US would go, well, we'll just throw more bombs at the problem.

5:34Tom Uren: because it's like it was annoying but it's not that serious. And so that feels like if it had been constrained to the US, Iran would make sense. Yeah. That the scope has expanded from an Iranian point of view. To me it's like, well, we're at war at the US. Let's open up a second front with Europe because that'll help. That just seems to make no sense, right? Now, it could be that there's several different campaigns going on at the same time. Like, you know, someone saw the US incident and went, oh, that's a bright idea. Let's pick that up. It doesn't to me feel like hacktivists or people doing it for fun because they're not making, they're not getting any publicity out of it.

6:23Tom Uren: Usually you amplify what you're doing for the lulls. So this feels like a state actor. Yeah. Now, the French, when they announced that they'd been hacked, the US also sent investigators who had been dealing with the military hack. And they had, according to the New York Times, low confidence that it was Iran. So there is something definitely there. It could actually be Iran. but it feels to me that well it is attribution is a political decision like if you've got low confidence um it's up to political leaders decide are we going to run with that and it feels like maybe the the French government is in a position where maybe it makes more sense to actually just go take a bit of a risk uh if it's Iran well okay that's fine we can they're not going to achieve anything by calling out iran and sanctioning them but they're not going to achieve anything by if it's russia calling out russia and sanctioning them either so you know why not act quickly when you're not that certain like it feels like from their point of view there's nothing to be gained or lost by going out early and hard even if you're

7:42Amberleigh Jack: wrong because that's basically what they've said they're going to do about it right is sanctions but of a stern talking to.

7:48Tom Uren: Yeah, they said we'll call the ambassador in and give them a stern talking to, say that this is unacceptable. And I think the broader point here is that these attacks are very significant nuisance attacks. Is France going to go to war with Iran or Russia, for that matter, if either of them is responsible? Absolutely not. There's no way you're doing that. I think the limit is a stern talking to and talking about sanctions. Both those countries are already pretty significantly sanctioned. What else are you going to do? Not much. I think the problem with these attacks is that they kind of foreshadow that there may be other things out there that are connected and weakly protected that would be even more annoying or equally annoying and the possibility of a rolling campaign of just you know petty annoyances that are costly for particular firms psychologically have some sort of impact really hard to deal with just a bad time all around yeah it's funny you bring up the

9:01Amberleigh Jack: the psychological because I was sort of thinking you know yes they're nuisance attacks but with especially with the sheer amount of attacks that are going on constantly as like an everyday person you're not going to know about any of them but if you hear that your food is potentially at risk. I think that feels like it could bring about sort of everyday person panic.

9:32Tom Uren: Well, Kieran Martin was on the main Risky Business podcast and he spoke about this, that these attacks in the UK had had some sort of psychological impact. Yeah. And it reminds me a bit of during COVID, the runs on toilet paper. And in Australia, occasionally a town will get isolated because of flooding and you'll get runs on supermarkets. And it is pretty striking when you look at a supermarket and the shelves are bare for whatever reason. And I think even if that doesn't affect you personally, it can be like, oh, whoa.

10:05Amberleigh Jack: Yeah.

10:07Tom Uren: A moment of pause because it feels like it could happen to anyone.

10:11Amberleigh Jack: Yeah, yeah. You sort of said even if it doesn't affect you personally. And I have a certain kind of bread that I like that always seems to be in stock. But even walking past and seeing all the other bread that I would never buy, if one of them's empty, you do kind of get that, oh, are we in trouble? Is something going on here? Yeah, it's a kind of disconcerting feeling.

10:33Tom Uren: Yeah, and there was at the beginning of the Iran war in Australia,

10:37Amberleigh Jack: there were petrol stations that ran out of diesel.

10:41Tom Uren: And it seems that at least some of that was driven by people buying diesel to secure their own supply, which meant that there was plenty of diesel coming into the country but individual stations ran out. So there is that kind of, I guess you'd call it panic buying, that can occur. So I wouldn't, like nationally, like the country, France is not going to fall apart. But it does have an impact on people.

11:08Amberleigh Jack: Yeah. And France may not fall apart, but it doesn't really sound like Iran or Russia is going to stop this.

11:16Tom Uren: either like for me I wonder why you would bother doing it right what are you achieving I think the Russian playbook it falls totally in line with that so if it was Russia I could entirely believe it Iran I could also believe that as well but it just seems strange that the targeting is not focused on the US yeah one of the things I mentioned in the piece is that Russia actually has a track record of pretending to be other cyber actors. So they've in the past actually hijacked Iranian malware for both collection and to just muddy attribution. And they've also attacked the Winter Olympics and pretended to be North Korea.

12:05Tom Uren: So I would be totally unsurprised if, you know, maybe the first attack was Iranian, the ones on the military bases. That would kind of make sense. and then Russia seizes an opportunity. But, I mean, who knows is the question. I just think that it's hard, very hard, no matter who is responsible, to stop them by sending stern letters.

12:32Amberleigh Jack: Tom, I want to move on to your second piece. A couple of reports have come out that have looked into Chinese threat actors and China is not really stealthy or fast and noisy, the kind of everything, depending on which direction you're looking. So I guess to start with, tell me about this Vapor Panda group that is kind of joining in on what I hear pretty much everyone at the moment is using, which is the pen testing framework, Artex, to go wild. What are they doing?

13:07Tom Uren: Yeah, so it definitely appears that Artex is flavor of the month. Like you said, a pen testing framework. And they've been using it to just scale up what they're doing. So CrowdStrike produced this report. There's a threat actor they call Vapor Panda. It is attacking all the usual suspects, so US think tanks, defense groups, foreign affairs ministries of all sorts of countries. and CrowdStrike reckoned that a single person, a single operator can now run many simultaneous engagements hacking different targets at the same time and the framework RTX will just come back to the operator when it needs to make a decision.

13:54Tom Uren: Yeah, right. And so they say that they observed this campaign over 11 days and during that time they attacked 200 organisations. organizations now not always successfully in fact it seems like they could only confirm success in about five percent of cases something around the order of 10 organizations were actually hacked some of them extensively so you you do get mileage uh 10 organizations in 11 days that

14:21Amberleigh Jack: actually seems pretty good to me yeah yeah but of course you don't get something for nothing

14:26Tom Uren: so RTX is extremely noisy and like that makes sense if you're trying to hack really fast and you're trying it in a kind of trial and error iterative approach of course you're going to make a lot of noise so it that report talks about just a single incident where RTX is trying to get access through a web server and it says that basically RTX was falling all over itself trying many, many different things and it was very, very noisy, logged up the wazoo. So that's the downside. And it seems that that approach of we'll just do everything faster, damn the consequences, like full speed ahead, matches what we know of some of the freelance cyber espionage groups.

15:20Tom Uren: There have been some leaks that I've written about over the years where you get a very clear picture of them, hack first and try and find out who wants that intelligence or potential intelligence later. And so some of the examples I've written about, they hacked the head of NATO, got some of his email and then they were shopping it around for, shopping it around to different intel shops and they're going, yeah, no, we're not interested. So it feels like that kind of hacking.

15:51Amberleigh Jack: Yeah, the worth a shot kind of hack.

15:54Tom Uren: Yeah, grab what you can. Will anyone buy it? I don't know. But, you know, we've got it. It's a potential sale.

16:01Amberleigh Jack: Yeah, yeah. And then in contrast, Tom, you've taken a look at this network that's used by Vault Typhoon, who kind of take this very, you know, slowly, slowly, catchy monkey, very stealthy kind of approach. So tell me a little bit about the differences there.

16:19Tom Uren: Yeah, so Vault Typhoon is the group that is compromising US critical infrastructure. And it looks like it's preparing for disruption in the event of a military conflict. So it's entirely the goal is to get access and maintain access and do nothing until you need to use it. So maintaining is very, very important. It's like kind of priority number one. And I suppose an equal priority might be understand the network so we can actually do something when the time arises. But there's no point understanding the network if you don't have access. So they have created a covert network that Lumen Technologies, their research or spread into a lab, Black Lotus Labs, called Silent Train.

17:14Tom Uren: So that network, it's kind of fascinating to see how much effort they've gone to make it stealthy and what they have done. So they've used previous, Vault Typhoon, that is, has used previous covert networks that are comprised of, you know, botnets, network of compromised devices. And those have been discovered and dismantled. So Silent Train is the latest iteration and it does not exist normally but they create chains of compromised devices as and if they need to communicate with a device. So it's create on demand and tear down on demand. So it's more like a phone call.

17:59Amberleigh Jack: Yeah, right. And so they know how to compromise particular devices.

18:05Tom Uren: Each of those sets of devices has a particular role in the network and they can set up a chain within a couple of minutes and do what they need to do and tear it down within 10 minutes. That's the shortest that Black Lotus reported. Yeah. And when they tear it down, they remove all the special source that they put on the compromised devices. So they use SSH. They set up SSH services. They use temporary keys. And they just remove that from the device so that when it's gone, it's as if they've never been there.

18:43Amberleigh Jack: Interesting.

18:44Tom Uren: And so that is the exact opposite of what Vapor Panda is doing. And it just struck me that you've got these two extremes that China is operating at. And it seems like it's getting air quotes better depending upon how you measure it. So if faster is your metric, they are getting faster. And if more stealthy is your metric, they are getting more stealthy. They're just not doing both at the same time. And it very much depends on what the needs of that particular actor are or what their operational priorities are.

19:18Amberleigh Jack: Kind of interestingly as well, you point out that Volt iPhone, the activity of, you know, silencer and Volt iPhone is kind of 9 till 10.

19:29Tom Uren: Yes.

19:30Amberleigh Jack: Kind of working hours. So very much people awake clocking and going to work kind of hours. Yeah.

19:37Tom Uren: So once upon a time I wrote a piece that said that AI would benefit China in terms of hacking because they had a higher risk appetite. They were willing to, in general, accept faster activity and be caught. like being caught was not such a problem and um it turns out that it was kind of right but also incomplete i guess not necessarily wrong but incomplete so we have seen some chinese actors vapor panda pick up ai and just hack hell for leather and in terms of pushback from the u.s or from anyone. I just don't see anything significant happening. But we also see them double down, invest in the exact opposite, right?

20:32Tom Uren: So it's not that they've got a single strategy, quiet and stealthy versus noisy and fast. They're employing all strategies at the same time.

20:42Amberleigh Jack: So for anyone that is worried about AI taking their jobs, looks like there's at least one place that's still...

20:50Tom Uren: well I suppose I didn't answer your question now that I remember and the question is why manual

20:55Amberleigh Jack: operations and it's because they don't trust AI to do it yeah I think AI probably would do it but

21:02Tom Uren: if you're Vault Typhoon you operate slowly you make absolutely sure that you're not making mistakes and until you pick can be guaranteed that AI will not make mistakes you will not use AI

21:12Amberleigh Jack: all right Tom it has been so much fun talking to you today and of course you can read and subscribe to Tom's newsletter over at risky.biz. But Tom, have a great week and I will see you the same time next week.

21:24Tom Uren: Thanks, Amberley.