teissTalk: The Log4j marathon - where are we and what comes next?

teissTalk host Geoff White was joined by Sarah Armstrong Smith, Chief Security Advisor, Microsoft as lead guest; Garry Scobie, Deputy Chief Information Security Officer, The University of Edinburgh; and Jamie Moles, Senior Technical Marketing Manager, ExtraHop.

Views on the Ukrainian cyber war

Over 24 trillion telemetry signals are analysed by Microsoft every 24 hours. The company has spotted a huge spike in nation state activity earlier last year – many of them attributed to Russia. In terms of targets, there has been a move away from government espionage to IT operators. Ukraine has always been Russia’s training ground for developing malware, but attacks really started to increase against critical infrastructure there this January.

Fox Blade, a never-before-seen piece of “wiper” malware against Ukrainian infrastructure was unleashed some hours before the military attack on Ukraine was launched. As a result, within three hours, Microsoft’s virus detection systems had been updated to block the code.

Thankfully, the fact that the Russian state showed its willingness to push boundaries and become increasingly destructive prior to the war led to Nato and allied nations ramping up collaboration in sharing threat intelligence between states and across the public and private sectors before the outbreak of the war. Although cyber attacks by Russia against Ukraine are much weaker than anticipated, a massive cyber-attack is still not off the table. (Microsoft, as a commercial entity, never attributes attacks but gives them names of the elements in the Periodic Table.)

Russia doesn’t seem to have deployed a range of cyber weapons in the war that they certainly are in the possession of. A lot of what Ukraine has is Soviet legacy infrastructure, which works in the favour of the Russians. For malicious actors, it’s a prerequisite to have a deep understanding of the infrastructure they seek to attack, and former Soviet states, unlike western public and private entities, do certainly have that knowledge.