Title: Cybersecurity Professionals Face Increasing Real-Life Threats from Hackers
Robert M Lee, the CEO of cybersecurity company Dragos, recently experienced a chilling encounter with cybercriminals. After breaking into Dragos’s employee email account, an organized hacking group threatened to release the company’s data unless a ransom was paid. When Lee refused to negotiate, the hackers escalated the situation by finding personal information about his son, including his passport, school, and telephone number. The message was clear: pay up or risk harm to your family.
According to several Western cybersecurity experts interviewed by the Financial Times, online threats have become increasingly tangible in recent times. Computer engineers, called in to combat hacking groups, are now becoming targets themselves.
The criminal group that targeted Lee, whose name he chose not to disclose, was known for engaging in “swatting” – a dangerous practice where someone falsely reports an armed attack, leading to a police SWAT team being dispatched to the victim’s home. Lee was advised by local authorities to lie down on the floor during such an incident.
These threats are diverse and often inventive. For instance, a Ukrainian hacker sent a gram of heroin to the home of Brian Krebs, a journalist turned cybersecurity analyst. The hacker followed up by sending a large bouquet in the shape of a cross to Krebs’s home. In other cases, victims have been instructed to send money to the bank accounts of cybersecurity professionals in an attempt to frame them. A North Korean hacking group even posed as security researchers on LinkedIn and sent malware disguised as an encryption key to their contacts.
Charles Carmakal, the CTO for Mandiant Consulting, which investigates major breaches, including recent ones at the State Department and other US agencies, emphasized the need for constant vigilance. Carmakal stated that he avoids visiting certain countries due to his outspokenness about offensive operations originating from those regions. He understands the risk of becoming a victim himself.
The ability of criminals from Eastern Europe, China, or North Korea to target security professionals in Western Europe or the US highlights the transnational nature of an industry that profits billions of dollars from its victims. Carmakal noted that these threats often come from criminals rather than governments, as the latter tends to focus on espionage or disinformation campaigns and move on to new operations when thwarted.
These cybercriminals are typically young individuals with no rules of engagement, often teenagers or people in their twenties. They have an unlimited amount of free time and relentlessly push boundaries, causing significant distress to their victims.
For cybersecurity professionals outside the US, the threats feel even more real. One researcher, who preferred to remain anonymous, returned home to find his house expertly searched by “well-trained, discreet, and extremely professional” men. They disabled his home security but missed a nanny-cam his wife had recently installed. Prior to the search, he had identified a Russian government agency responsible for an espionage operation against a NATO government’s email systems. Following the incident, his bank account was hacked, his company’s tax documents were tampered with and released on the dark web, and his family photographs were traded as trophies on hacker networks.
Another researcher from a different Eastern European country shared a similar experience. He was followed on a skiing trip, received threatening phone calls, and had to reassure his wife after she received doctored pictures of him with a female employee. He described the situation as textbook harassment and extortion.
Cybersecurity analysts try not to provoke or mock the hackers they identify, focusing their reports on the technical aspects of the breaches. Some, like Rafe Pilling from SecureWorks, protect junior employees by acting as the face of the organization.
However, some analysts caution that the deep involvement of Western companies in Ukraine’s cybersecurity exacerbates the situation. Ukraine has faced relentless and sophisticated cyber attacks, leading to concerns that the threats faced by cybersecurity professionals will only worsen. As one researcher who had his home searched warned, “Someone is going to get killed.”
[Video: The ongoing battle to beat crypto thieves | FT Tech]