The Chinese cyber-espionage organization known as Ink Dragon has extended their activities into Europe and started attacking public sector systems. They are known experts in stealth and sophistication. Based on reports from Check Point Research and The Hacker News, the group has advanced systems of espionage for hacking into public servers and obtaining prolonged access for government espionage.
Ink Dragon: An agent of the Chinese state?
Ink Dragon is believed to be an agent of the Chinese state and has, for the past few years, devoted efforts toward targeting espionage, not financial gain. This strategy has also targeted other public sector entities and international or intergovernmental policy organizations.
Increasing scope and sophistication in attacks
As pointed out by Check Point Research, the latest version of Ink Dragon has undoubtedly expanded the scope and sophistication of their activities. It is evident that the group is now employing a relayed network architecture that includes more command and control servers, and is, therefore, more obfuscated and harder to detect.
Attacks to require deploying spear phishing emails entwined with malicious documents. Once the attackers gain IT access control, they drop their malware, highly customizable to remotely upgrade to a newer module to be able to zero in on a specific stream of communications, and report on sensitive information and communications.
The focus of the campaign has to do with the European Government and public entities
The cyberattacks aimed at public sector networks are obviously daunting Cyberattacks on public sector networks can jeopardize sensitive information, damage systems, and aggravate the breakdown of trust in the public sector. Ink Dragon has the capability to alter negotiations, policies, and the very framework of a strategic plan.
Ink dragon says
“These attacks are part of a growing trend of state-sponsored espionage aimed at long-term intelligence gathering.”
The risk is not simply technical. It is becoming common for state-sponsored groups to attack infrastructure and government organizations. Analysts emphasize that these actors are not trying to disrupt activities in the short term but are trying to conduct long-term intelligence gathering, making disruptions even harder to detect and stop.
The key to long-term intelligence gathering
- Develop additional email protection and filtering to stop prospective spear phishing attempts. Train employees to be aware of and detect social engineering phishing attempts.
- Restrict access to one subnet that communicates with other subnets to limit the scope of the access to the other subnets.
- Attackers with good intent will exploit every weakness in the software to attack other advanced defenses, thus the need for constant patching.
- Threat intelligence is shared for advanced attackers and defenses through formal government partnerships.
- Ineffective standard security measures are being used against the more advanced attacker, thereby deriving the need for proactive defenses and rapid response. Improvements are being made in other advanced defenses.
- Cyber espionage is still evolving and thus needs a coordinated effort to deploy effective defenses incorporating the surveillance of social media, Darkweb, and other information flows to create an effective preventative and responsive measure. Espionage cyber defenses are now a priority for governments in the European Union.
The European Union needs to share, analyze, and improve cyber partnerships with other governments and organizations in the European Union, focusing on cyber defenses.
Countering threats that are state-sponsored and cyber in nature is more than just defending against cyber attacks and securing technological assets. It also involves a strong commitment and availability of cybersecurity assets, knowledge of potential attack vectors, and strong attack/defensive strategies. The cyber campaign involving Ink Dragon demonstrates that great and serious risks exist, and the time to defend against such risks is now, before its too late.
