Case Studies & Analyses

Mass Shooting at Bondi Beach targeting Chanukah event

Incident Date : 2025 | Topic : Event,Physical,Shooting | Region : Australia | Tag : NA

SUMMARY OF EVENTS

At approximately 18:44 local time on Sunday 14 December 2025, two armed gunmen carried out a mass shooting targeting a crowd attending a Chanukah event at Bondi Beach, Australia. Bondi Beach is located in the eastern suburbs of Sydney and is the closest major and most iconic beach to Sydney’s central business district (CBD).
The attack resulted in 16 fatalities, to date, including one of the perpetrators, and at least 29 people injured. The second gunman is reported to be in critical condition. Among the wounded are two police officers and at least one child.
More than 1,000 people were reportedly in attendance at the “Chanukah by the Sea” event, which marked the first day of Chanukah, the eight-day Jewish Festival of Lights. News reports indicate that there was also a Bar Mitzvah celebration taking place at the Bondi Pavilion at the time of the shooting.
Multiple videos circulating in the media show the attackers firing into the crowds from a concrete pedestrian bridge at the northern end of the beach. The bridge connects Campbell Parade, the main road running the length of the beachfront, over parking areas to the grassy zones, beach, and shoreline.
The latest reports claim that the guns used by the assailants appeared to be semiautomatic and footage showed what appeared to be a bolt-action rifle and shotgun shells at the scene. Additional reports indicate that as many as 50 bullets were fired. The exact types of firearms have not been released, to date. Based on ASERO’s expertise and analysis of available images, it appears as though the weapons used were long barrel hunting rifles with a scope.
Witnesses reported that a police officer who happened to be nearby returned fire on the attackers, leading to a shootout. It is unclear, nor has it been reported, as to whether there was a security presence at the Chanukah event itself
Reporting on the duration of the incident remains inconsistent. However, it is reasonable to assume that several very long minutes elapsed between the initial reports of gunfire and the arrival of a police response, during which time the assailants were able to fire multiple rounds into the crowd.
At some point, one of the gunmen moved from the bridge to the footpath level, where he was confronted by a member of the public. Footage shows Ahmed al Ahmed, a 43-year-old fruit shop owner, hiding behind a car before rushing one of the s hooters, wrestling the rifle away, and pointing it back at the assailant. The disarmed attacker backed away toward a bridge, where the second shooter continued firing from a walkway. He then rearms and both shooters come under fire from responding police.
Australian Prime Minister Anthony Albanese described the incident as a “targeted attack on Jewish Australians on the first day of Chanukah.”
By approximately 19:30 local time, video footage showing two men lying face down on the pedestrian bridge was circulating through social media. The assailants are believed to be father and son. The father, Sajid Akram, was killed by police in an exchange of gunfire and his son, 24-year old Naveed Akram, is in critical but stable condition. Sajid Akram legally owned six firearms and reportedly belonged to a recreational gun club. He and his son lived in suburban Sydney.
The Australian Security Intelligence Organisation (ASIO) has stated that Naveed Akram came to their attention in October 2019. While he was known to them, he was defined as ‘not an immediate threat perspective.’
Authorities reportedly removed several improvised explosive devices (IEDs) from a nearby vehicle linked to the deceased gunman. Police are still looking into the possibility that other people had been involved.
The incident has been officially declared as a terrorist attack.
Following the Port Arthur massacre in 1996, Australia implemented the National Firearms Agreement (NFA), a comprehensive set of gun law reforms restricting semiautomatic weapons and toughening up licensing requirements. These regulations have long been recognized as among the most stringent, and effective, in the world.
There has been a significant and alarming increase in the number of targeted antisemitic attacks in Australia since 7 October 2023. On 4 December 2024, an arson attack at the Adass Israel Synagogue of Melbourne resulted in a fire which injured one synagogue member and caused significant damage to the building. The Australian government and its intelligence service found connections between the attack, which was also declared an act of terrorism, and the Iranian regime’s IRGC.

INSIGHTS AND PRELIMINARY LESSONS LEARNED

Based on our understanding of how such events are typically managed, the local Jewish community would normally notify law enforcement about the forthcoming event and request a police presence. While this would be the expected practice, the facts in this case are not yet confirmed.
The Bondi Beach Police Station is located in very close proximity to Bondi Beach and the site of the shooting.
Based on the information available to date, this attack appears to represent a serious failure on the part of local authorities and law enforcement. The combination of the holiday season, widely recognized as a heightened threat period, together with a significant increase in targeted antisemitic attacks and rhetoric nationally, and growing hostility linked to immigrant communities predominantly originating from Muslim-majority countries, should have clearly identified this event as sensitive and at elevated risk of attack. It is evident that either no formal assessment of the event was conducted in advance, or that any assessment undertaken failed to accurately interpret the prevailing sentiment on the ground and the associated threat level. As a direct result of this failure, sixteen people are dead, predominantly Australian citizens, and dozens of others are injured.
In addition to a visible police presence at and around the event site, emergency responders, such as ambulances, should also have been pre-positioned to enable a rapid response in the event of an attack.
A mass shooting used as a terrorist modus operandi is characterized as an indiscriminate shooting attack. This type of attack is typically highly effective, particularly when unchallenged, as appeared to be the case for a significant period during this incident. Had the off-duty police officer and the civilian who intervened not taken action, it is highly likely that the casualty count would have been substantially higher.
The assailants appeared to be calm, well prepared and trained. They positioned themselves to gain a clear vantage point and fired into the crowd without hesitation.
This is not the first instance of Australia being targeted by large-scale terrorism. In 2017, authorities disrupted a plot to explode a commercial aircraft departing Australia using explosive devices concealed inside a meat grinder. The intended target was reportedly an Etihad Airways flight from Sydney to Abu Dhabi carrying approximately 400 passengers. The plan was allegedly thwarted when the luggage containing the device was deemed too heavy to be checked in. The perpetrators were Lebanese-Australian brothers, and at the time the plot was described by authorities as “one of the most sophisticated terrorist plots ever attempted on Australian soil.”
The implications of this attack extend well beyond a targeted antisemitic incident. The timing is particularly significant. Terrorist actors have historically sought to exploit dates of heightened symbolic or emotional resonance, including religious holidays and peak holiday seasons. On the same day as the Bondi Beach attack, German authorities announced the arrest of five individuals suspected of planning an attack on a Christmas market in Bavaria. In recent years, there has been a discernible increase in attacks and disrupted plots during this holiday period.
As seen in previous attacks, the selection of the target was both deliberate and strategically attractive. Bondi Beach is exceptionally crowded in December, coinciding with the height of the Australian summer, and is a major draw for both tourists and local residents during the festive season. In addition, the Chanukah by the Sea event is a long-standing annual tradition for the Jewish community, marking the first night of Chanukah, making it a predictable and easily discoverable target for any would-be assailant.
We recognize that a visible police presence serves not only as a protective measure but also as a deterrent. It cannot be ruled out that the presence of law enforcement may have caused the assailants to reconsider or abandon the attack. Video footage suggests the attackers were not conducting a suicide-style operation. Notably, one assailant disengaged and retreated toward his accomplice after being disarmed, supporting our assessment that a visible police deployment at the scene may have disrupted or deterred the attack.
Based entirely on our own conjecture at this time, we speculate that the type of ammunition used in the attack may have been 7.62mm ammunition, which is available and used for hunting in Australia. The effective distance for 7.62mm ammunition generally ranges from 150 to 400 yards (approx. 135 – 365 meters), depending on the cartridge type. We note that 7.62mm ammunition is also extensively used for military purposes.

A well-trained and unchallenged shooter using a bolt-action rifle with 7.62mm ammunition could be expected to fire approximately 10–20 rounds per minute. Although the exact duration of the attack remains unconfirmed, it can be reasonably assumed that it likely continued for several minutes, during which the assailants had ample opportunity to cause substantial harm, particularly in the absence of an immediate police response.

Massive Cyber Breach at Iberia Airlines Puts Traveler Information at Risk

Incident Date : 2025 | Topic : Aviation,Cyber | Region : Europe | Tag : NA

EVENT SUMMARY

▪ On 29 November 2025, Spanish airline Iberia admitted that hackers had accessed confidential customer information.

▪ The timing of the disclosure is notable. About a week before Iberia’s “customer notifications” went out, a threat actor claimed on dark web forums to be selling 77 GB of alleged Iberia data for $150,000.

▪ The following week, the Everest ransomware gang claimed responsibility for the attack, reportedly accessing nearly 600 gigabytes of data, including approximately 5 million passenger records including: names and email addresses; birthdates and contact details; travel and booking information, including booking references; Iberia Club loyalty card identification numbers; masked credit card data (not full numbers) and, internal technical data for aircraft and engines.

▪ Everest, a known Russia-linked cybercriminal organization, emerged in December 2020 and quickly evolved from data exfiltration to full ransomware with dual AES/DES encryption.

▪ Everest modus operandi includes hybrid ransomware, Initial Access Broker services and corporate insider recruitment offering cash/profit-sharing.

▪In October 2025, Everest claimed to run ransomware attacks resulting in compromised aviation systems at London Heathrow, Brussels, and Berlin airports. These reports remain unverified.

▪ Everest demanded $6 million from the airline to prevent the full data leak. They posted threats on the dark web and provided screenshots as proof of access.

▪ Iberia claims that the breach originated from a third-party supplier. While the supplier has not yet been identified, it is believed that an employee at the vendor company likely fell for a phishing scam.

▪ As far as we know, flight safety was not compromised , and no flight disruptions occurred as a result of the breach.

▪ Following the incident, Iberia sent an email to customers to apprise them of the situation and urged them to remain vigilant for suspicious communications and phishing attempts.

INSIGHTS

▪ The breach can result in reputational damage for Iberia and erode customer trust in the airline’s ability to protect their personal information. The sensitivity of the stolen data lies in the fact that it contains detailed personal and travel information, which could be exploited for identity theft, targeted attacks, or broader criminal activities if released.

▪This incident clearly demonstrates that the aviation domain remains an attractive target for cyber adversaries. Furthermore, as airlines become increasingly reliant on technology, the risk of cyber threats continues to increase.

▪According to recent reports on global threats, there has been a ‘600% increase in ransomware attacks in the aviation sector in one year.’ This alarming trend raises the specter that ransomware attacks in the aviation sector are likely to increase in the coming years.

▪Although this case study focuses on the theft and leakage of passenger data, including sensitive personal information, it is important to recognize that a successful breach of an airline’s security systems can have far more severe implications. In certain scenarios, such intrusions could escalate into safety or security hazards with the potential to result in loss of life.

▪Major players in the aviation ecosystem are increasingly recognizing the interconnectedness of their operations. Interfaces and interdependencies can pose grave risks. An attack on any system or network can trigger cascading effects across other systems, potentially leading to large-scale disruptions of airport, airline, and other aviation stakeholder operations.

▪According to Iberia, the attack that resulted in the leakage of sensitive information was executed through a breach in one of the airline’s suppliers. This underscores the vulnerability of Iberia’s broader ecosystem and reflects directly on the airline’s overall security posture.

▪This case study reinforces a well-established reality in the aviation industry: a significant portion of risk stems from the vulnerabilities of third-party suppliers, who operate within a complex and interconnected network of partners.

▪Third-party suppliers that provide customer service platforms, operational software, or other critical tools can be exploited by attackers, and a single compromise can cascade across multiple airlines or airports. Recent incidents, including ransomware attacks on operational software and breaches of cloud-based customer service systems, demonstrate the impact of these vulnerabilities.

o Collins Aerospace (2025) – In September 2025, a third-party attack on Collins Aerospace’s Muse software caused major disruptions at European airports, including London Heathrow, Brussels, and Berlin. The ransomware attack took check-in and boarding systems offline, forcing airports to revert to manual processes and resulting in delays, cancellations, and long passenger wait times. Everest claimed responsibility for the attack.
o Qantas Airlines (2025) – The hacker collective Scattered Lapsus$ Hunters stole 5.7 million customer records by targeting Salesforce, the airline’s third-party customer-service platform.
o Hawaiian Airlines (2025) – The cybercriminal group Scattered Spider hacked into the third-party platform used by the airline’s call center and is believed to have gained access to customers’ personal information.

LESSONS LEARNED AND RECOMMENDATIONS

▪It is essential for the aviation sector, and critical infrastructures in general, to ensure that their cybersecurity policies and strategies are continuously adapted to evolving threats and focused on mitigating threats and vulnerabilities that could be exploited by an adversary, including those originating through third-party vendors, as well as minimizing the level of damage which may be caused if a cyber-attack does occur.

▪When implementing an information security policy, continuity and the same level of protection for the information must be maintained both on the supplier’s side as well as the airline to prevent security breaches.

▪To address the challenge posed by increasing network and systems connectivity across airport stakeholder and their third-party vendors, it is necessary to understand and evaluate the risks to critical systems, which may be posed by other interconnected critical as well as essential and/or supporting systems, that result from interfaces and interdependencies related to data flows and the impacts they may have on overall airport and aviation operations.
To that end, entities must map their critical systems to properly understand their interdependencies and vulnerabilities, both internally and with external vendors, and to take proper measures to secure them.

▪ While current speculation suggests that an employee of a vendor company may have unknowingly fallen victim to a phishing scam, the possibility of an insider threat, such as the actions of a disgruntled employee, cannot be ruled out. Accordingly, measures to mitigate insider-threat risks should be implemented, including robust employee vetting and periodic re-vetting, targeted awareness programs, and clear processes for reporting unusual behaviors or concerning statements.

▪ It is essential to provide newly onboarded employees with training on threat awareness, including recognition of phishing attempts and other common attack vectors. Periodic refresher training should also be conducted to ensure staff remain informed about emerging trends and evolving threats. This training should be reinforced through an ongoing awareness program that embeds strong security practices and proper cyber hygiene into the organization’s daily working culture.

▪It is recommended to define and establish standard cybersecurity policies for third-party suppliers, adherence to which should be included in contracts signed between airport stakeholders and their respective vendors.

▪It is recommended to develop guidelines laying out the steps required to implement an entity’s, in this case an airline’s, cybersecurity strategy at the third-party vendor level.

ASERO offers unparalleled experience in defining entity assets and establishing cybersecurity policies and measures for critical infrastructure, with an emphasis on the aviation domain, including the supply chain. Our team recently completed a pioneering, large-scale project for a global aviation hub designed to map aviation ecosystem interdependencies, define and quantify a threat criteria, identify and classify critical and other systems, and propose a roadmap for implementation of security and mitigation measures over the short, medium, and long-term.

NATO’s Eastern Flank Strengthens Borders and Security in Response to Growing Hybrid Threats

Incident Date : 2025 | Topic : Critical Infrastructure,Cyber,Drones,Emergency Preparedness & Resilience Management,Event | Region : Europe | Tag : NA

In April 2025, Finnish President Alexander Stubb announced Finland’s intention to withdraw from the Ottawa Treaty, an international agreement prohibiting the possession, trade, and use of anti-personnel landmines. Finland’s Minister of Defense elaborated on the decision, stating that “leaving the Ottawa Treaty will allow us to respond more flexibly to changes in the regional security environment,” pointing to the fundamental shift in Europe’s security landscape, especially following Russia’s invasion of Ukraine. Tensions have continued to rise along Finland’s 1,340-kilometer border with Russia, particularly as, in late 2024 and early 2025, Russia began upgrading and reinforcing its nearby border bases, constructing new military warehouses and hangars focused on logistics and maintenance. This marks its first major investment in the area in years. Although most equipment from these bases continues to be sent to the Ukrainian front and the development is not viewed as an immediate threat, it nonetheless signals a shift in posture and warrants caution.

In doing so, Finland joins the Baltic states, Lithuania, Latvia, and Estonia, along with Poland, which announced their own intent to withdraw from the treaty several weeks earlier in a joint declaration. Though not officially stated, the goal appears to be to enable strategic flexibility in deploying landmines to protect their borders with Russia and its ally Belarus, with fears of a potential large-scale military incursion in the near future. These countries, forming NATO’s vulnerable eastern flank and encompassing strategic transit routes, have begun to deploy advanced, multilayered security systems along their borders with Russia, in addition to traditional fencing. These systems include the use of drones for surveillance, as well as the establishment of communication and electronic warfare systems aimed at countering GPS disruptions caused by Russian interference with NATO communications.

Another defensive step taken by Finland in early 2025 was the passing of a new Cyber Defense Law. This law requires providers of critical infrastructure, such as transportation, finance, and healthcare, to implement routine security procedures for risk management, vulnerability identification, and real-time reporting of significant breaches or cyberattacks to authorities. Following this move, Russia intensified its hybrid campaign against Finland, including cyberattacks on the energy grid and public sector, often coordinated with disinformation efforts aimed at weakening public trust and disrupting national stability. These attacks follow a pattern of disruptions that began shortly after Finland joined NATO in 2023.

These defensive measures by Finland and its neighbors bordering Russia come during an ongoing and troubling rise in suspected Russian sabotage efforts across Europe, particularly in countries bordering Russia. Russia’s actions along the border, including military expansion, are part of a broader hybrid warfare strategy, intended to destabilize NATO countries through ambiguous disruptive activities that fall short of clear-cut military aggression. As previously noted in articles and declared by NATO officials, Russia continues employ hybrid tactics such as cyberattacks, disinformation, strategic military buildups, and physical sabotage.

As security tensions rise across Europe, Finland and its NATO eastern flank neighbors have come to recognize that physical borders alone are insufficient. They are now working to build multilayered defense systems that integrate physical infrastructure, advanced technologies like

drones and electronic warfare, and modern legislation such as the new Cyber Defense Law. The increased Russian presence along the borders and ongoing hybrid attacks blur the lines of escalation and require a rapid response capability to maintain national stability and functionality during crises.

Additionally, the withdrawal from the international agreement banning the use, possession, and trade of landmines shows a shift in regional security policy. While this move aligns with emerging trends among NATO’s eastern members, it reignites debate over balancing between security needs and humanitarian obligations. In effect, this withdrawal reflects a fundamental change in how democratic nations are dealing with such threats, driven by a concrete sense of danger. These countries no longer see the treaty as adequately addressing today’s security challenges and are prioritizing strategic flexibility over humanitarian commitments in a shifting geopolitical reality.

In light of the above, critical sectors – such as transportation, energy, healthcare, and finance – in Eastern and Central Europe remain under ongoing threat from Russia and have proven particularly vulnerable to hybrid attacks that include both physical sabotage and cyber intrusions. This reality demands a renewed security policy and tighter management of supply chains, alongside stronger cyber defense. To effectively address these evolving threats, governments across the region, together with private sector partners, must adopt a multilayered security approach, combining cyber defense, physical security, intelligence sharing, and the implementation of advanced risk management strategies. The need to protect critical infrastructure against complex, unpredictable threats with potentially far-reaching impacts has become urgent and essential to strengthening national resilience and civilian security in today’s Europe.

At ASERO Worldwide, our extensive experience in protecting critical infrastructure, enhancing cyber resilience, and conducting threat analysis and response planning enables us to deliver holistic security solutions tailored to today’s evolving threat environment.

Roadmap for Dealing with Ransomware

Incident Date : 2025 | Topic : Cyber | Region : Africa,Asia,Europe,Latin America,Middle East,North America | Tag : NA

Ransomware is a type of malicious software that encrypts data or locks users out of their systems, demanding a ransom, usually in cryptocurrency, for restoration. If the ransom goes unpaid, attackers may permanently block access and/or leak sensitive information online. These attacks typically spread through phishing emails with malicious links or attachments, or by exploiting vulnerabilities in system infrastructure.

Ransomware has become one of the most pervasive and destructive cybersecurity threats, targeting organizations across all sectors. In recent years, the frequency and sophistication of ransomware attacks have increased dramatically. Cybercriminals are leveraging advanced technologies such as artificial intelligence and automation to enhance the precision, scale, and speed of their operations. The consequences of a ransomware attack extend beyond data loss, potentially causing severe financial damage, reputational harm, operational disruptions, and long-term threats to business continuity.

Organized Syndicates vs. Independent Attackers

Ransomware groups often function like structured enterprises and business entities, with clear roles and responsibilities. Many operate under the Ransomware-as-a-Service (RaaS) model, in which developers create ransomware tools and lease them to affiliates who carry out the attacks. Profits are shared between the two parties. These groups frequently collaborate – sharing stolen data, infrastructure, and techniques to increase efficiency and scale.

In contrast, individual hackers or small groups operate on a smaller scale, using off-the-shelf ransomware kits or exploiting known vulnerabilities. While they lack the sophistication and coordination of organized syndicates, they often move quickly, selling stolen data for immediate profit and keeping all the earnings for themselves.

Most Common Types of Ransomware

Crypto ransomware is among the most destructive, encrypting vital files on a victim’s system and rendering them inaccessible without a decryption key. Locker ransomware goes a step further by locking users out of their entire system, often displaying a ransom message with a countdown timer to pressure payment. Scareware uses fake alerts or warnings to trick users into believing their system is infected, prompting them to pay for a fake solution—sometimes freezing the system or flooding it with pop-ups. Doxware, or leakware, not only encrypts data but also threatens to publish sensitive personal or business information if the ransom isn’t paid. Lastly, Ransomware-as-a-Service (RaaS) operates as a criminal business model, where developers lease out ransomware tools to affiliates, who then carry out attacks and share a portion of the ransom with the developers.

Tactical Steps for Dealing with Ransomware Attacks

To effectively address ransomware attacks, it is crucial to implement a structured, comprehensive defense plan from prevention and detection to response and post-incident recovery.

1.Identification

– Identify the assets (data, personnel, devices, systems, and facilities) that enable the organization to achieve business purposes.
– Manage the assets according to their relative importance to business objectives and the organization’s risk strategy.

2. Prevention

– Regular Software Updates:
Keep systems and applications up to date with the latest security patches.
– Cybersecurity Hygiene:
– Deploy endpoint protection, firewalls, and intrusion detection systems (IDS).
– Use protective Domain Name System (DNS) services to block malicious sites.
– Employee Training:
– Train staff to identify phishing attempts, suspicious links, and social engineering tactics.
– Conduct regular awareness and simulation exercises.
– Email Security Protocols:
– Implement DKIM, SPF, and DMARC to validate incoming emails and reduce spoofing.
– Third-Party Risk Management:
– Monitor vendor and partner cybersecurity practices to identify and mitigate potential vulnerabilities.

3. Detection

– Use Endpoint Detection and Response (EDR) tools to identify and monitor unusual system behavior.
– Watch for red flags such as:
– Sluggish system performance
– Unexpected file encryption
– Unauthorized network access
– Identify and isolate affected systems as early as possible.

4. Response

– Isolate Infected Systems:
Disconnect compromised devices to stop the ransomware from spreading.
– Activate an Incident Response Plan:
Ensure clear roles, escalation protocols, and communication channels are in place.
– Engage Authorities:
Report the incident to the appropriate authorities in accordance with local regulations and standards and seek official guidance. Additionally, notify your insurance provider to initiate any necessary claims or support.
– If a Ransom Payment is Decided Upon, Address the Following:
– Attacker Profiling: Assess whether you or your negotiator has prior experience with the attacker, and analyze their identity, reputation in the ransomware ecosystem, experience, and reliability.
– Insurance Coordination: Contact your cyber insurance provider and follow their specific instructions regarding the incident and potential payment.
– Legal Consultation: Seek legal advice based on the local jurisdiction of the incident to understand what is legally permitted or prohibited when communicating or negotiating with the attacker.
– Engage a Specialized Incident Recovery Firm: Hire a company that specializes in incident recovery, with significant experience in ransomware attacks. They should determine how the breach occurred, confirm whether vulnerabilities have been closed, and check if any malware was left behind that could cause future damage.
– Find an Experienced Negotiator: Find an Experienced Negotiator: Engage an intermediary with extensive experience in ransomware negotiations, preferably someone who has established trust or prior dealings with the specific syndicate involved.
– Use a Crypto Broker for Payment: If payment is agreed upon, employ a broker to handle the transfer. The broker should be capable of checking addresses against blacklists, complying with relevant jurisdictional regulations, and executing the transfer in the appropriate cryptocurrency.
– Debrief and Organizational Review: Conduct a thorough debrief of the incident to identify systemic weaknesses.

5. Recovery

– Restore Systems from Clean Backups:
Ensure backups are stored securely and tested regularly for integrity.
– Post-Incident Hardening:
After recovery, enhance security protocols to prevent future incidents.

When dealing with ransomware attacks, it is essential to have a well-organized plan in place, both for prevention and for a quick, effective response should an attack occur. During a ransomware incident, it’s equally important to enlist the support of an experienced mediator with robust cybersecurity expertise. A professional mediator ensures proper crisis management, may know the attacker group from previous incidents, helps avoid unnecessary ransom payments, and supports the rapid recovery of affected systems, all in accordance with local regulations.

At ASERO, we provide expert guidance throughout every stage of a ransomware event – from prevention and preparedness to real-time crisis response and post-incident recovery – ensuring your organization remains resilient in the face of evolving cyber threats.

Common themes emerge from the ongoing wildfires in Los Angeles and the New Years terror attack in New Orleans

Incident Date : 2025 | Topic : Emergency Preparedness & Resilience Management | Region : North America | Tag : NA

When we look at issues related to safety and security, we, as practioners, often find ourselves making connections between dots that are not always evidently related but from which important insights and lessons learned may be drawn.

We’d like to draw important connections between the New Years Day terrorist ramming attack in New Orleans and the ongoing fires raging through Los Angeles.

At approximately 03:15am on New Years Day, a driver in a rented pickup truck rammed into a crowd celebrating on Bourbon Street, the most well-known street in New Orleans and historic tourist destination, killing 15 and injuring 35 others. Importantly, bollards which had been previously in place along Bourbon Street had been removed for replacement and there were no barriers in place along the sidewalks through which the assailant was able to enter the closed off street and plow into the crowd.

In Los Angeles, a series of catastrophic wildfires have been ongoing since 7 January exacerbated by drought conditions, low himidity and hurricane-force Santa Ana winds. To date, at least 24 people have been killed and 180,000 evacuated. Over 12,000 structures have been damaged or destroyed and thousands upon thousands of acres have been scorched. It was reported that the Santa Ynez Reservoir, located in the Palisades Highlands, had been drained and closed for repairs when the blaze first broke out, so it could not be used to help battle the flames, though it is located in the middle of the Palisades where the worst of the fires continues to burn.

Firstly, we recognize that we are looking at two very different events. The first a manmade, deliberate and malicious attack which was carefully planned and leveraged on vulnerabilities identified during reconnaissance. The second is a natural disaster. And it is important to differentiate between the two.

Natural disasters do not carry out reconnaissance. That said, they do occur as a result of a confluence of factors which must align in order to allow what began as an occurrence to grow into a disaster. We know that many natural events happen but very few grow to the scale of a disaster and even fewer to the catastrophe we are currently seeing in Los Angeles. In most cases, people are never made aware of natural occurences which could have escalated to the scale of a disaster because the compounding factors required to grow an event into a disaster were not there. Many fires break out, but they do not grow to this magnitude as a result of many interrelated factors, some natural such as weather conditions and others related to the resources we put in place and which come into play to prevent the fire from growing and spreading. One of these factors may be a reservoir. We cannot exclude the reservoir as a component, even a small one, which could have made a difference in the overall picture of what we are seeing on the ground in Los Angeles.

Despite their differences, it is important to recognize that both of these events are examples of national resilience. The first against terrorism and the second wildfire and a resilient nation can and should prepare for both, particularly when faced when scenarios and outcomes we cannot tolerate.

With that, we’d like to also note the significant overlaps between the two. The first area in which we find commonality between the two events is the methodology that was lacking and that was vitally needed to prevent, mitigate or respond effectively. And that methodology is consistent whether we are discussing terrorism or manmade disasters. Identify relevant threats and risks and then determine which among those you cannot tolerate. Then identify the solution or the measures, processes or resources required to minimize the likelihood of those intolerable risks and make sure to have them in place.

A second similarity is the need for a process to ensure that what has been decided is actually implemented and maintained. For example, if bollards are removed, it is necessary to install an interim solution to mitigate gaps in the security infrastructure. Similarly, if a reservoir must undergo refurbishment, it is necessary to ensure that there is sufficient redundancy or an alternative water source in place to combat wildfire.

ASERO offers unparalleled experience in risk management not only in combatting the threat of terrorism but also overall preparedness and resilience against natural disasters aimed at ensuring continuity of operations.

It is important to note that these points are not only relevant for those responsible for resilience on a national level. You may be responsible for ensuring continuity of business within your own enterprise. The same principles should be applied.

Cyber-attack targets Japan Airlines

Incident Date : 2024 | Topic : Aviation,Cyber | Region : Asia | Tag : NA

KEY EVENTS

▪ In the morning hours of 26 December 2024, Japan Airlines (JAL) was hit by a DDoS cyber
attack. The problem started when the company’s network connecting internal and external
systems began malfunctioning, specifically related to the luggage check-in system. Japan
Airlines is Japan’s second largest carrier.

▪ In response, the airline temporarily suspended
all domestic and international ticket sales for the rest of the day. By the evening, the airline announced that 27 December flights were scheduled to operate as normal. The attack resulted in a delay of 24 domestic flights for more than 30 minutes. Japan Post Co. reported that both mail and parcel deliveries were also affected by the flight disruptions.

▪ The airline identified the cause as an attack intended to overwhelm the network with massive
transmissions of data, which is a Distributed Denial of Service(DDoS): An attack that floods a
system or network with traffic until the target cannot respond or crashes.

▪ According to Japan Airlines, the carrier was able to stop the attack and restore its systems
hours later. The attack did not involve a virus or cause any customer data leaks. Flight safety
was not impacted.

▪ This is not the first time concerns have been raised regarding Japan’s cybersecurity,
particularly as the nation is taking steps toward boosting its defense capabilities and
tightening relations with the United States and other Western allies.
In June 2024, it came to light that the Japan Aerospace Exploration Agency (JAXA) had been
targeted in a series of cyber attacks over the course of the previous year. While no sensitive
data was obtained by the hackers, the agency has begun an investigation to determine the
scope of the damage caused by the attacks and taken measures to shut down the systems
that may have been involved in the incidents.
In July 2023, the Port of Nagoya, which is responsible for roughly 10 percent of Japan’s total
trade volume and a key hub for Toyota Motor Corporation’s car exports, was targeted in a

crippling ransomware attack that paralyzed operations at the container terminal for three
days.

INSIGHTS

▪ The incident clearly demonstrates that the aviation domain remains an attractive target for
cyber adversaries. Furthermore, as airlines become increasingly reliant on technology, the
risk of cyber threats continues to increase.
An 11 December 2024 report published by global commercial law firm Clyde & Co revealed a
surge in ransomware attacks among other cyber threats against the aviation industry.
According to the report, cyberattacks in the aviation industry rose by 131% from 2022 to 2023,
with most attacks targeting airspace users, which of course includes airlines.

▪ The DDoS attack on JAL coincides with one of the most active travel times in Japan and the
global peak year-end holiday travel season. We have seen that holiday periods, particularly
Christmas – New Years, are more attractive to adversaries in both the cyber and physical
domains, looking to carry out high profile attacks with large scale ramifications.
In the cyber domain, for example, cyber risks are especially high during the holidays due to
such factors as distracted shoppers and employees, heightened network traffic and an influx
of phishing opportunities.

▪ As the fourth largest economy in the world and a pivotal center for cutting-edge technology,
Japan makes a prime and attractive target for cyber adversaries. We also cannot disregard
the role of geopolitics in understanding why Japan has been increasingly targeted in large
scale cyber attacks against its critical infrastructure.
Japan has long been engaged in a territorial dispute with Russia over the Kuril Islands, or
Northern Territories in Japan. Furthermore, since the onset of Russia’s war against in Ukraine
in 2022, the Japanese government has demonstrated consistent support for Ukraine, sending

the country military equipment and humanitarian assistance. In July 2024, Japan pledged
US$6.3 billion in aid to Ukraine, making it the second largest bilateral donor after the United
States.
In addition, Japan’s cabinet most recently approved a new US$55.13 billion defense budget,
primarily to fund new security and defense policies and initiatives announced in December
2022. These policies are driven in large part of geopolitical shifts which have taken place in
China, North Korea and Ukraine, amid growing regional challenges and potential risks
including China’s increased maritime presence in the East China Sea and military exercises

around Taiwan and North Korea’s efforts to further nuclear weapons and missile capabilities.
Finally, taking in consideration shared common goals in the Indo-Pacific region and
deterrence of aggression from China, Russia and North Korea, relations between Japan and
the United States have reached unprecedented heights.

It stands to reason that these geopolitical factors have likely heightened Japan’s cyber threat
profile from state actors including China, Russia and North Korea, with which relations have
become increasing antagonistic.

▪ Traditional enterprises like airlines have been an attractive target for cyber attacks as many
often rely on legacy software which can be out-of-date or have existing vulnerabilities that
were not patched and that may be exploited. In recent years, there have been numerous

sophistication and complexity. Some relevant examples include:

o Milan airports (28 December 2024) – The same cyber attack vector that ws used
against JAL was used by a hacked group by the name of NoName057(16) claimed
responsibility for a series of DDoS cyber attacks targeting the websites of Italy/Milan’s
two main airports as well as those of the Foreign Ministry and the public transport
networks in Siena and Turin. The operator of both Malpensa Airport and Milan-Linate
Airport announced that the attack was mitigated in less than two hours and that
flights were continued as normal.

o Leonardo Russian flight booking system (2023) – The Russian flight booking system
was hit by a massive DDoS attack claimed by the Ukrainian hacktivist group IT Army.
The incident lasted for roughly an hour and impacted Leonardo customer operations
including air carriers Rossiya Airlines, Pobeda and Aeroflot. The incident caused
delays on departures from Moscow’s Sheremetyevo International Airport, Russia’s
busiest airport.

o EasyJet (2020) – A major data breach exposed personal data of nine million customers
including bank details.

o Air Canada (2018) – Air Canada requested that 1.7 million mobile app accountholders
reset their passwords after it detected unusual login behavior which may have
exposed 20,000 accounts, including customer passport details as well as app profile
data containing a person’s name, address and email address.

o British Airways (2018) – British Airways announced that the personal and financial
information of 380,000 of their passengers had been hacked. Passenger names,
home addresses and credit card data were all stolen during the 15-day security
breach. A script running on BA’s baggage claim information page had been changed
just before the breach began. The new script was designed to capture the personal
and financial data customers entered including names and home addresses, as well
as credit card numbers, expiry dates and CVV codes. That information was then
relayed to a database under the hacker’s control. In this attack, hackers were able to
gain access to sensitive information without disturbing the flow of commerce or
raising suspicion.

o Cathay Pacific (2018) – Cathay Pacific acknowledged that the personal data of up to
9.4 million passengers, including passport numbers, was accessed by unauthorized
personnel. The discovery that some of its information systems had been
compromised was made amid routine ‘ongoing IT security processes.’ Data accessed
included passenger names; nationalities; dates of birth; phone numbers; email
addresses; physical addresses; 860,000 passport numbers; 245,000 Hong Kong ID
card numbers, frequent flyer program membership numbers; customer service
remarks; and historical travel data.

o LOT Polish Airways (2015) – Hackers used a distributed denial-of-service (DDoS)
attack on information technology (IT) systems to breach ground computers. As a
result, LOT was unable to issue flight plans for outbound flights from its Warsaw hub,
forcing the carrier to cancel roughly 20 foreign and domestic flights and grounding
1,400 passengers. The DDoS attack flooded the computer servers with so many
communication requests that it overloaded servers, rendering them nonfunctional.

RECOMMENDATIONS:
▪ This attack highlights the importance of putting in place robust cybersecurity measures and
adherence to cybersecurity hygiene. ASERO applauds the airline’s ability to detect, respond
to and recover from the attack within a matter of hours and minimal disruption to airline and
flight operations. that attack targeted the network which acts as the connector between internal and external

▪ It is important to recognize the cyber domain as a new battlefield by which state actors can
affect political change.

▪ We know that cyber adversaries are continually developing new tactics and discovering new
vectors for targeting critical sector systems and networks. It is necessary for the aviation
industry and critical infrastructures in general to ensure that they, too, are adapting their
cybersecurity policies and strategies to meet evolving threats and minimizing identified
vulnerabilities which may be exploited by an adversary.

▪ While we cannot be certain as to how the hackers penetrated the airline’s system, we know
that attack targeted the network which acts as the connector between internal and external
systems. It is important to understand where within the overall aviation cyber ecosystem this
network lies and what it is connected to.

Today, major players in the aviation ecosystem are becoming increasingly aware of how
interconnected their operations are and that often inadequately understood interfaces and
interdependencies between information infrastructures, networks and systems have the
potential to pose a grave risk. An attack on one system or network, whether critical,
important or supporting, could cause cascading effects on other systems, leading to large
scale turmoil and even disruption of critical aviation operations, e.g. airport, airline and other
aviation stakeholder operations.
In order to meet this challenge, it is necessary to understand and evaluate the risks to critical
systems, which may be posed by other interconnected critical as well as important and/or
supporting systems, that result from interfaces and interdependencies related to data flows
and the impacts they may have on overall airport and aviation operations.
To that end, entities must map their critical systems in order to properly understand where
their interdependencies and vulnerabilities lie and to take appropriate measures aimed at
securing them.

▪ It is necessary to construct and deploy an entity-wide Security Operations Center (SOC),
inclusive of Security Incident and Event Management (SIEM), with the aim of detecting and
responding to any system or network anomalies. A dedicated cyber security specialist, i.e.
not any IT employee, should be charged with drafting SOC procedures and identifying relevant
anomalies requiring additional inspection.

▪ It is important to ensure proper segmentation between administrative networks and
operational or sensitive networks. This will prevent scenarios in which an adversary is able to
successfully utilize access to the administrative networks to access sensitive information or
even pose safety or security risks.

▪ Cyber security should be an integral component of all training and awareness campaigns for
all entities. It is also important to ensure that third party service providers are made aware of
and trained on the importance of ensuring optimal cyber security.

▪ It is necessary to implement a robust cybersecurity hygiene practices and procedures, as well
as Quality Assurance program (QA) to include procedures for conducting annual internal and
external audits and a tabletop and red teaming exercise regime to ensure optimal
preparedness, identify gaps and measure return on security investment.

ASERO offers unparalleled experience in defining cyber assets and establishing cyber security
policies and measures for critical infrastructure, with an emphasis on the aviation domain. Our
team recently completed a pioneering, large scale project for a global airport hub designed to
map aviation ecosystem interdependencies, define and quantify a threat criteria, identify and
classify critical and other systems and propose a roadmap for implementation of security and
mitigation measures over the short-, medium-, and long-term.

MI5’s Stark Warning: Adapting to the Evolving Threat Landscape

Incident Date : 2024 | Topic : Critical Infrastructure,Cyber,Physical,Social Media | Region : Europe | Tag : NA

In his 8^th October threat update, MI5 director-General Ken McCallum detailed the challenges facing both the United Kingdom and West as a whole, outlining a rapidly evolving multi-faceted security environment. McCallum’s address highlighted the need for adaptability to counter an array of security challenges ranging from espionage and terrorism, to cyber threats. His insights affirm the vital importance of strong collaboration between private and public sectors; cooperation of governments, businesses, and communities being essential to safeguard national security from both state and non-state hostile actors.

McCallum raised the threat posed by state backed espionage, particularly from Iran, China, and Russia. These powers have deployed sophisticated infiltration methods to exploit existing western vulnerabilities, especially in critical national infrastructure and democratic institutions. Reports of Chinese linked cyber-attacks on western institutions evidence the sophistication of these efforts, with similar efforts by Russia seen in their long-standing attempts to undermine democratic processes via disinformation campaigns and cyber infiltrations.

These hostile actions have rippling effects for Western security, for example the 2024 Romanian Presidential election saw extensive Russian interference via social media influence campaigns by over 100 influencers on platforms like Tik Tok, boosting right wing Pro-Putin candidate Calin Georgescu to victory. Romania’s Constitutional Court has since annulled the election, given the nature of the victory; however the fact Russia was able to influence and shape a NATO member state’s presidential election outcome is cause for great concern as without the courts decision, the result had potential to undermine Romania’s position in the Alliance and therefore NATO’s Eastern European defensive posture.

McCallum’s words warn that modern espionage is not limited to traditional intelligence methods, rather encompassing a range of digital and human tactics alike. Only through close cooperation and deeper understanding of the new intelligence landscape can it be countered, McCallum advocating for more programs similar to the Five Eyes Alliance, an intelligence cooperation initiative between Australia, Canada, New Zealand, UK, and the United States, as a crucial necessity in countering the emerging and present threat.

Beyond state threats, McCallum draws attention to the ever-present concern of terrorism. He points out that while operational activity of Islamist networks has declined in recent times due to Western counter terror efforts, Islamist groups are rapidly adapting to utilise modern technology and online platforms to radicalise and recruit worldwide, with the likes of ISIS and Al-Qaeda renewing their efforts to prepare for future attacks. In a similar fashion, the far-right are also utilising online methods to recruit and inspire future lone wolf terror attacks, with MI5 efforts being split in a 75%-25% rate between Islamist and Far-Right groups.

McCallum emphasised that 13% of those being investigated by MI5 for involvement in terrorism are minors under 18, constituting a threefold increase between 2021-2024. This demonstrates how these groups use of social media is having an influential impact on young people, this generation heavily interacting with social media, often being a central element of their everyday activities.

McCallum continued, stating these threats are not limited to ideology or region but are international given the nature of the globalised interconnected technology and networks being used. As such the ability for national homeland security organisations and intelligence agencies to detect and prevent attacks is not only reliant on international cooperation, but also the employment of non-traditional counter terrorism measures. Community engagement and comprehensive deradicalisation programs are now an essential pillar of counterterrorism in reducing the spread of extremist ideologies – a trend that will continue to grow, mandating enhancement in capabilities to deliver such programs.

McCallum also pressed the importance of defending the cyber domain, cyber defence being a critical front in national security. Intellectual property theft, ransomware campaigns, and cyber-attacks on critical infrastructure pose absolute risks to economic resilience and national stability. McCallum points to numerous ransomware campaigns, targeting government systems, hospitals, and supply chains to emphasise the urgent need to reenforce Western cyber defence as a matter of critical national security. Such an effort requires strong collaboration between private and public sectors, private entities often being the prime targets for cyber attacks given the privatisation of most critical infrastructures in the West, especially in the UK. As such, private companies must be open to sharing intelligence and vulnerabilities with the government to ensure critical private assets are protected, with greater cyber comprehension being instilled across the board. Initiatives akin to the UK’s National Cyber Security Centre partnership program to develop industry capabilities in cyber security being strongly advocated for.

Convergence of espionage, terror, and cyber threats create a complex security challenge for Western nations. McCallum’s reminder of this emphasises a comprehensive international effort across multiple sectors is required to address these threats. Governments must prioritise investments in security infrastructure and intelligence methods, while private entities and individuals must also be proactive in adopting measures to protect their assets and data – especially in the critical industries of health, aviation, and energy.

McCallum’s sobering address details a threat landscape full of danger, mandating an immediate call to action. Modern age threats defy borders, with rapidly evolving technologies leading to evolving vulnerabilities. Maintaining security in such an environment demands innovation and proactive action to ensure total security.

ASERO offers a wide range of security solutions which can aid the public and private sector counter this evolving threat landscape. Counter-hostile disinformation capabilities offer resilience to the democratic processes of western democracies, enabling governments and their citizens to enjoy free and fair elections without threat of foreign manipulation.

Likewise, ASERO social media monitoring capabilities offer solutions in countering the ever-growing threat posed by Islamist and far-right extremists in their quest to radicalise Western youth and recruit them to nefarious causes.

Similarly, extensive industry experience in aviation security, critical infrastructure defence, and overall cyber security allows ASERO to deliver comprehensive capability development to private and public sectors, enabling resilience against attempts to undermine critical functions to national security, ensuring normality and stability prevails.

Critical Infrastructure at Risk: DHL Plane Crash and Hybrid Warfare Threats

Incident Date : 2024 | Topic : Airport,Aviation,Critical Infrastructure,Physical,Terror | Region : Europe | Tag : NA

On November 25, 2024, a DHL cargo plane tragically crashed near Vilnius International Airport, Lithuania. The aircraft, en route from Leipzig, Germany, went down just short of the runway, striking a residential area and sparking a fire. The crash resulted in the death of one crew member and left three others injured. While Lithuanian authorities have yet to confirm the cause, Western investigators have not ruled out terrorism, pointing to a broader context of growing geopolitical tensions and security risks. This crash is part of an escalating series of incidents, including suspected arsons and sabotages, with some Western officials speculating on potential Russian involvement.

In July 2024, two separate incidents in Germany and the UK raised alarm: DHL packages bound for the United States and other Western nations were found to contain incendiary devices disguised as electric massagers. These devices, filled with highly flammable magnesium-based material, seemed designed to test the viability of smuggling incendiaries aboard long-haul flights. The devastating potential of these devices was clear — had they ignited mid-flight, the results could have been catastrophic, leading to significant loss of life and potentially downing entire planes. Although no direct connection has been established between these incendiary devices and the plane crash, the proximity of these events underscores the growing threat to air travel security.

Risk Analysis and Security Implications

The security risks to both cargo and passenger planes are profound. Even a small amount of explosive material in a critical location on board could lead to disaster. Given the frequency of DHL flights between Eastern Europe and North America, the threat of disruption from hostile actors poses not only a major security risk but also severe geopolitical ramifications.

This ongoing risk emphasizes the need for enhanced safety protocols and rigorous inspections of cargo planes. These checks should incorporate advanced technological solutions and more comprehensive screening measures. Failure to do so could result in a high level of destruction, potentially on a massive scale.

The Hybrid War Context of Russia

To fully understand the threat posed by incidents such as the Vilnius plane crash, one must consider them within the broader context of hybrid warfare. Hybrid warfare blends conventional military tactics with cyberattacks and psychological operations to destabilize countries. Since Russia’s invasion of Ukraine, Europe has seen an uptick in cyberattacks, sabotage, and acts of arson, many of which appear aimed at destabilizing the West. These actions serve to undermine critical infrastructure, sow discord among NATO members, and weaken support for Ukraine.

The crash of the DHL cargo plane could be part of this broader strategy to disrupt Western stability. While the motivations behind these actions remain unclear, the possibility of foreign-backed sabotage cannot be dismissed. Darius Jauniskis, head of Lithuania’s Counterintelligence Service, stated, “We cannot reject the possibility of terrorism… but at the moment we can’t make attributions or point fingers because we don’t have such information.” He warned that this crash could be tied to a larger campaign of disruption, though he urged caution due to a lack of conclusive evidence.

The Need for Protection of Critical Infrastructure

In light of these evolving security challenges, the protection of critical infrastructure has never been more crucial. Critical infrastructure, including airports, airfields, power plants, storage facilities, and air transportation networks, forms the backbone of national security and economic stability.

European countries, particularly those in the Baltic region, must develop multi-dimensional defense strategies. These strategies should include enhanced screening procedures for cargo and passengers, investment in technological advancements for monitoring suspicious shipments, and specialized training for security and intelligence personnel. Protection of critical infrastructure requires both immediate action and long-term strategic foresight, with a focus on international collaboration and the proactive identification of emerging threats.

As the threat landscape evolves, ASERO plays a crucial role in safeguarding national and corporate assets. With over 20 years of experience in homeland security, ASERO offers solutions in infrastructure protection, supply chain security, aviation security, cybersecurity, social media analysis, and emergency preparedness. ASERO’s team of experts collaborates with governments and businesses to tackle complex security challenges, providing tailored solutions to meet specific security needs.

Confronting Modern Threats: Intelligence Services Leaders Highlight Security Imperatives

Incident Date : 2024 | Topic : Physical | Region : Europe | Tag : Case Study

In a rare public meeting, MI6 and CIA chiefs, Richard Moore and Bill Burns, leaders of the UK and US foreign intelligence services, drew focus on the “unprecedented array of threats” facing the West and established global order, emphasising the West’s united stance, primarily citing Russian actions but also placing China on the radar.

Russia’s sabotage of strategic institutions and deployment of sophisticated intelligence operations as published in our previous reports, are only two features in Russia’s rotating armoury of threats; Physical threats towards the physical safety of personnel and infrastructure from direct military aggression to the Baltic states and recruitment of criminals for violent sabotage. – as with the London warehouse fire containing aid shipment for Ukraine. Nuclear blackmail posturing of both tactical and strategic weapons, energy infrastructure sabotage and disruption, naval action against internet infrastructure, weaponisation of migrant flows, political interference aimed towards division and destabilisation, maritime disruption, and cyber-attacks– the list goes on.

These threats are continuing to evolve. The fallout of the spike in major cyber-attacks by Unit 29155 of Russian Intelligence since 2022’s Ukraine invasion is now being revealed as worse and widespread than initially thought. Several EU and NATO countries as well as Asian and Latin American western allies have been targeted. Russia targeted multiple institutions, including government and civilian agencies, civil society associations, critical infrastructure, alongside the finance, transport, energy and health sectors – anything with links to supporting aid and the Ukrainian war effort, both direct and indirect. This highlights the absolute necessity for both private and public institutions to be attentive in evolving and developing their security measures to meet the dynamic threats of today’s geo-political arena, anyone being targetable.

This imperative is echoed by Moore and Burns. They implore proactive measures against Russian tactics, dismissing ideas of appeasement in face of Russian threats, especially nuclear. On the contrary, NATO assistance in Ukraine has proved successful in stemming Russian advances, causing Putin to issue nuclear threats, however Burns suggests “Putin’s a bully. He is going to sabre rattle from time to time” and while such behaviour is dangerous, can certainly be countered.

Burns points to the constant technological advancement of the West and its rapid technological deployments in Ukraine as a major reason for stemming Russia. Ukraine marks a new era of threats and ways of combatting them, seeing usage of commercial and military satellites, drone technology, social media, and extensive cyber warfare. Being able to evolve and develop new methods at a rapid pace and scale is essential in keeping this technological advantage and flexibility. This applies in both private and public sectors, Burns and Moore stating their partnership is augmented by a network with the private sector.

Although Russia is the loudest, it may not be the gravest threat. Burns and Moore stated that China is now considered the main intelligence and geopolitical challenge, reorganising their respective agencies to reflect it as a priority. Alongside emerging terror threats, this further emphasises the continuously growing range of threats to the everyday world order which must be met.

As Burns and Moore put it ‘There is no question that the international world order – the balanced system that has led to relative peace and stability and delivered rising living standards, opportunities and prosperity – is under threat in a way we haven’t seen since the Cold War.’ Ongoing political efforts to combat Russian sabotage in Europe, along with potential threats from other geopolitical challenges, underscore the severity of existing risks and the need for comprehensive protection and innovation in addressing global issues. To effectively safeguard your assets, private or public, it’s crucial to maintain a holistic view of all potential threats and their possible modus operandi, addressing them accordingly. As in Ukraine, Burns’ stance on keeping technological development going is essential in ensuring western civilisation keeps its edge against emerging threats and is an imperative for both private and public sectors. The fusion of effort by private and public sectors is a major asset in maintaining security resilience so that the global order can remain secure.

ASERO Worldwide specialises in recognising and addressing threats, developing tailored security solutions to mitigate security risks long term. Against an evolving plethora of threats on critical infrastructure, cyber assets, and physical safety to name a few, ASERO has the capability to evolve security strategy to meet the changing face of security as it develops, ensuring Burns’ vital technological edge is maintained and secured.

How ChatGPT is being used to facilitate cyberattacks

Incident Date : NA | Topic : Social Media | Region : Africa,Asia,Europe,Latin America,Middle East,North America | Tag : Case Study

As artificial intelligence (AI) continues to advance, new tools and technologies that are being developed have the potential to revolutionize various industries. Among these tools is ChatGPT.

ChatGPT is a large language model chatbot developed by OpenAI. It was designed to assist users in generating human-like text based on the input given. It can answer questions, provide information, and assist with various tasks. It has a remarkable ability to interact in conversational dialogue form and provide responses that can appear convincingly human.

Reinforcement Learning with Human Feedback (RLHF) is an additional layer of training that uses human feedback to help ChatGPT learn to follow directions and generate engaging and relevant responses.

While ChatGPT and other AI tools have the potential to transform industries like customer service and marketing, they also have the potential to be used for nefarious purposes.

So, what are the potential threats that can be created by cybercriminals by exploiting this resource?

It is critical to note that the use of AI tools like ChatGPT by cybercriminals is not a hypothetical scenario. In fact, there have already been instances where these types of tools have been used to facilitate cyber crimes. By using ChatGPT, for example, convincing phishing emails can be created in order to trick people into divulging sensitive information or clicking on malicious links. In most cases, ransomware gangs target a different geographical region than they are headquartered in, which results in natural language limitations that facilitate the identification of attacks. Attackers might use AI chatbots to form customized emails and texts in unfamiliar languages to increase their chances of success.

Apart from phishing, ChatGPT can be, under certain circumstances, used to identify vulnerabilities in smart contracts (A digital contract secured and enforced using blockchain technology).

ChatGPT, like other AI technologies, could also be used to generate fake news articles or other types of misinformation designed to spread propaganda or sow confusion.

Overall, cybercriminals’ use of AI tools represents a significant threat to individuals and organizations, as it allows them to carry out more sophisticated and difficult-to-detect attacks.

From a cybersecurity perspective, the most significant challenge created by ChatGPT and AI in general, is the ability for anyone, regardless of technical background, to create code to generate malware and ransomware on demand.

Protecting against AI-powered cybercrime will require responses at the individual, organizational and society-wide levels. New security tools will become more relevant than ever in the coming years as ChatGPT and other technologies continue to expand. Taking the necessary steps now can better protect your organization from such attacks before ChatGPT takes your users by surprise.

Ensuring security is highly intricate as it requires domain knowledge and the ability to evaluate the possibility of threats. ASERO Worldwide is an expert in cyber security, securing complex models, critical infrastructure protection, and critical information infrastructure protection.

Wake-Up Call: Russia’s recent assaults show that physical protection is still a concern

Incident Date : 2024 | Topic : Physical | Region : Europe | Tag : Case Study

A lone assailant, identified as a 26-year-old foreign national, was arrested and charged with terrorism in conjunction with a foiled June 2024 attempt to set fire to buses at a Prague depot using gasoline. According to Czech Prime Minister Petr Fiala, it is likely that Russia is behind the foiled arson attack as well as several similar incidents across Europe. This attack highlights an increasingly troubling trend of targeting physical assets, institutions, and infrastructure across Europe. In response, Czech Interior Minister Vít Rakušan stated that “We have been accustomed to Russian attacks on IT infrastructure, but now we are seeing a shift towards targeting physical assets as well.”

In a similar attack, a business in East London with ties to Ukraine was targeted in an arson attack in March 2024 which damaged two parcel delivery companies. Two men have been charged with aiding Russian intelligence services, which according to prosecutors involved in the case was likely the Wagner military group. They are alleged to have engaged in conduct targeting businesses that were linked to Ukraine in order to benefit the Russian state.

Russia is also believed to have been behind yet another example of this growing trend in which Warsaw’s largest shopping mall went up in flames in May 2024. And while these events might look minor in isolation, taken together they are tantamount to Russia’s ongoing hybrid war on the West, particularly when coupled with other incidents in Germany, Spain, and France, to name a few.

These events highlight a deliberate campaign to disrupt and damage critical institutions and assets, posing a serious threat to both domestic and international stability. The strength of democratic countries hinges on public confidence in the resilience of their institutions and the effectiveness of national security measures. Given this, attacks on domestic institutions can undermine government legitimacy and provoke internal instability.

While cyber threats remain a major concern, these recent physical security breaches underline that tangible asset protection is equally vital. A comprehensive security strategy must address both digital and physical threats to effectively safeguard infrastructure. Investing in advanced physical security solutions is crucial to fortify infrastructure and protect against escalating threats. By implementing robust physical security measures, organizations can enhance their resilience, ensure operational continuity, and maintain public trust in their ability to withstand and respond to emerging risks.

At ASERO, we advocate that effective infrastructure protection requires a comprehensive and tailored strategy. As a global homeland security consulting firm, we provide strategic solutions and tactical advice to governments and major corporations.

The Fight for Integrity: Wikipedia’s Battle Against Bias

Incident Date : 2024 | Topic : Social Media | Region : Africa,Asia,Europe,Latin America,Middle East,North America | Tag : Case Study

The Wikipedia community has taken a significant step in preserving the platform’s integrity by blocking 43 editors identified as recruits or straw puppets. These editors frequently abused their authority to influence content with hidden agendas. This decisive action underscores the continuous battle for truth and objectivity in one of the world’s most giant online encyclopaedias.

Wikipedia relies on a community of anonymous volunteer editors to maintain and update its vast information bank. This collaborative platform thrives on the principles of neutrality and verifiability, making it a critical resource for information. However, Wikipedia’s open nature can also make it vulnerable to manipulation attempts.

Notable examples of such bias have occurred in entries about public figures. For instance, the Wikipedia page of former U.S. Secretary of State Hillary Clinton was found to have been repeatedly edited to remove references to controversies and enhance her public image, often by accounts suspected to be linked to her campaign staff. In another case, U.S. presidential candidate Vivek Ramaswamy was accused of paying a Wikipedia editor to remove information from his pages shortly before announcing his candidacy in May 2023. The alleged aim was to downplay aspects of his background that might not appeal to conservative voters. While Ramaswamy denied manipulation, claiming he was correcting “factual distortions,” this incident highlights the potential for biased editing of public figures’ pages.

The recent blocking of 43 Wikipedia editors for abusing their authority brings to light a critical issue: information bias can easily distort public perception. This underscores the importance of maintaining the integrity of platforms like Wikipedia in an age where we rely on digital information to shape our opinions and decisions, making us more aware of the potential consequences of biased editing.

At ASERO, we recognize that information security extends beyond data protection. It also encompasses the protection of truth. The ongoing battle against bias on Wikipedia serves as a reminder for us to critically evaluate our information sources, empowering us to make informed decisions in this digital age.

In the Shadows: The Russian Espionage and State Secret Safeguards

Incident Date : 2024 | Topic : Critical Infrastructure,Physical | Region : Europe | Tag : Case Study

Along with a growing trend of sabotaging strategic institutions across Europe, as published in our previous reports, the threat of espionage has never been more pronounced. Since the Ukraine invasion, more Russian illegals have been exposed across Europe. The risks of such espionage are profound: undermining national security, influencing political decisions, and stealing technological and military secrets.

The recent exposure of Russian espionage activities in Slovenia highlights the sophistication of Russian intelligence operations in Europe. Artem Viktorovich Dultsev and Anna Valerevna Dultseva, posing as an ordinary Argentine couple in Ljubljana, were revealed by local intelligence forces as elite officers of Russia’s Foreign Intelligence Service. Their arrest in December 2022 marked a pivotal moment in Russia’s expanding shadow war with the West. Their base in Slovenia allowed for seamless travel and espionage activities across Europe, exploiting the nation’s limited counterintelligence capabilities.

Shortly after the Slovenia couple was arrested by Slovenia’s security services, another pair of suspected Russian illegals—a woman with a Greek passport and a man with a Brazilian passport—suddenly fled from Athens and Rio de Janeiro, leaving behind businesses and romantic partners who were unaware of their real identities.

Russian espionage agents often exploit seemingly innocuous individuals and situations. The infiltration of academic institutions and businesses by older Russian students further indicates a strategic move to embed spies deeply within European society. The Russian intelligence might use organized criminals and foreign nationals to carry out espionage, complicating counter-espionage efforts. Deep-cover agents, often referred to as ‘Illegals,’, usually pose as people with no connections to Russia and spend years embedding themselves in their target regions. They weave a network of information sources, spot potential recruits, and serve as intermediaries for spies under diplomatic cover, who are frequently under tight surveillance by their host nations.

While many European countries expel Russian diplomats over espionage concerns, their numbers in Austria have surged to over 500, with more than half being intelligence agents. Vienna has become a hub for Russian operations in Central Europe, supporting activities like assassinations, sabotage, and industrial espionage. An Austrian intelligence official stated, “We are now becoming a burden on our neighbors because Russia is using us as a base for operations.” These operations include financing and logistical support for assassinations, sabotage, and recruitment, as well as industrial espionage and influence operations.

The revelation of these deep-cover agents in various countries across Europe underscores the breadth of Russia’s espionage network. Russian espionage underscores the need for vigilant security measures to protect state secrets. Security professionals must adapt strategies to ensure national integrity and security in a complex geopolitical landscape.

ASERO Worldwide specializes in recognizing and addressing unusual or suspicious activities and implementing appropriate response measures to mitigate threats.

Hit Where It Hurts: The Need for Holistic Protection of Critical Infrastructures

Incident Date : 2024 | Topic : Critical Infrastructure | Region : Europe | Tag : Case Study

On July 26, 2024, just hours before the Paris 2024 Olympics opening ceremony, France’s high-speed rail network suffered coordinated arson attacks. The perpetrators targeted strategic signal boxes and cables on the Atlantique, Nord, and Est lines, causing widespread travel disruptions and stranding approximately 800,000 passengers, including Olympic athletes. Jean-Pierre Farandou, head of the state-owned rail company SNCF, stated that these attacks were strategically designed to maximize disruption by targeting key routes from multiple directions. French authorities launched a national investigation, with suspicion falling on ultra-left radicals due to the methods resembling previous attacks by this group. French security experts expressed concerns that the perpetrators might have received internal assistance from individuals within the railway network or possibly obtained information from foreign states familiar with the French system.

During the Olympic Games, the timing and extent of the damage were designed to create global resonance and serve as an ideological protest. The fact that the arson attacks targeted only infrastructure indicates that the perpetrators had no intention of killing or injuring people, suggesting a strategic and symbolic motive. The extent of the damage suggests the attackers possessed detailed knowledge of the railway network’s vulnerabilities, knowing precisely where to strike to cause widespread disruption. The possibility of internal help with inside knowledge, as suspected by French security experts, suggests significant vulnerabilities within the railway network’s personnel and security protocols. The sabotage was meticulously pre-planned and highly organized, with fires breaking out simultaneously at three different points on the tracks. This level of coordination strongly indicates that a single structured entity was behind the attack, rather than disparate individuals. The sabotage was successful and highly effective, disrupting the rail network, causing delays and cancellations of numerous journeys, and impacting millions of people in Paris, throughout France, and Europe.

When we think of sabotaging critical infrastructure, we usually imagine cyber attacks, powerful bombs, or other sophisticated methods. However, this incident demonstrates that significant damage can be inflicted with just the right knowledge and basic tools. Adversaries don’t need high-tech capabilities or access to combat means; understanding vulnerabilities is enough. This reality emphasizes the urgent need for holistic and comprehensive security strategies that address all potential weaknesses to ensure the resilience and protection of our critical infrastructures.

We should not be surprised if this effective attack against France’s major rail system will inspire others and will be followed by copycat attacks against transportation or other means of infrastructure.

At ASERO, we understand the complex nature of modern threats. Our holistic threat assessments leverage multidisciplinary expertise to identify and mitigate vulnerabilities across all facets of your operations. We provide robust, comprehensive protection solutions that safeguard against the full spectrum of potential threats.

Navigating Cyber Threats: Key Lessons from a Major Security Breach

Incident Date : 2024 | Topic : Cyber | Region : North America | Tag : Case Study

SolarWinds is a major software company headquartered in Oklahoma, specializing in system management tools for network and infrastructure monitoring. The company serves hundreds of thousands of organizations worldwide, offering a range of technical services. One of its key products is the Orion IT performance monitoring system.

In December 2020, SolarWinds discovered that a group of hackers gained access to the networks, systems, and data of thousands of SolarWinds customers. Investigations revealed that attackers had begun their preparations nearly two years earlier, in 2019. That year, they stole an employee’s information and gained access to the SolarWinds network. Over several months, they repeatedly entered and exited the network, obtaining more access permissions each time. The attackers downloaded approximately 7 million emails from 70 managers and employees and copied source code. It was found that more than 18,000 of SolarWinds’ customers had inadvertently downloaded manipulated versions of their software. By doing so, the attackers accessed SolarWinds’s customer information technology systems, which they could then use to install even more malware to spy on other companies and organizations.

The attackers used a sequence of steps that well demonstrates what is often named “cybersecurity kill chain methodology”, the model which describes the stages perpetrators follow while carrying out cyber-attacks, from initial reconnaissance to data exfiltration.

The attackers began with reconnaissance, collecting detailed insights into SolarWinds’ software development and distribution methods. This was followed by weaponization, where they embedded malicious code (SUNBURST) into legitimate software updates. These updates were then delivered to unsuspecting clients as regular updates. Upon installation, the malware exploited system vulnerabilities to create backdoors, establishing stealthy persistence within the networks. The installed malware connected to attacker-controlled servers to receive commands and exfiltrate data, effectively taking control over the compromised systems. Through these actions, the attackers not only stole sensitive information but also gained the potential to disrupt operations, emphasizing the attack’s sophistication and the critical need to detect and mitigate threats at each stage of the kill chain to prevent such significant breaches.

Another insight from this cyber incident is that SolarWinds was presumably chosen because it provides services to numerous governments, corporations, and organizations. This highlights the crucial need for companies and governments not only to secure their own assets but also to ensure the cybersecurity standards of external vendors they rely on. In addition, during the investigation of the attack, it was revealed that SolarWinds had previously received concerning intelligence which was not adequately prioritized.

Months before the attack, both the U.S. Department of Justice and cybersecurity firm Palo Alto Networks had informed SolarWinds of unusual external communications from their Orion software. This highlights the importance for service providers to critical entities, such as government agencies, technology giants, and policy institutions focused on national security, to maintain a heightened awareness of any suspicious activities and to attentively consider any alarming feedback from their clients, especially when handling sensitive data.

It is suspected that this major cyber-attack was carried out by a group backed by the Russian government, aiming to infiltrate United States federal government organizations that were SolarWinds’ customers. The astonishing level of time, funding, and precision invested in executing the attack emphasizes its complexity and meticulous planning. Given the scale and sophistication of this cyber-attack, it is plausible to assume that such operations may have been and are likely financed by government-level resources.

ASERO is uniquely positioned to help prevent cyber incidents like those experienced by SolarWinds, thanks to its team of globally recognized cyber security pioneers. ASERO stands at the forefront of cybersecurity with a team of world-leading experts and a proven track record. Our advanced cybersecurity strategies, customized for entities like government agencies and major corporations, leverage the latest technological practices to safeguard critical infrastructures. Our services include cybersecurity risk assessments, penetration testing, and the development of robust security policies and procedures, ensuring comprehensive protection against today’s evolving cyber threats.

Another Less Discussed Aspect of the Red Sea Crisis

Incident Date : 2024 | Topic : Transit | Region : Middle East | Tag : Case Study

The Red Sea, a vital waterway for shipping goods between Europe, Asia, and Africa, has become a hotspot for conflict. Since October 19, 2023, Houthis, a Yemeni rebel group backed by Iran, have been launching attacks on commercial ships traveling through the Red Sea.

Houthi militants have fired on various countries’ merchant vessels, particularly in the Bab-el-Mandeb, which, as the southern maritime gateway to the Egyptian Suez Canal, is a a chokepoint of the global economy. As a result, vessels cannot access Egypt’s Suez Canal to cut between Asia and Europe and, instead, must sail thousands of miles around Africa to move goods.

The Houthis have attacked numerous civilian-operated cargo ships near the Yemeni coast and while they claim their attacks are in response to Israel’s actions in the Gaza Strip and that they will continue to attack until Israel ceases its war against Hamas, many of the targeted ships do not appear to be related to Israel.

Connecting the conflict in Bab-el-Mandeb to the conflict in Gaza creates a complex situation with far-reaching consequences.

While the Red Sea crisis poses a significant threat to global trade and regional stability, it is also crucial to acknowledge a less discussed aspect – its potential financial impact on shipping companies. This paper explores the complex relationship between the crisis and the financial well-being of these companies.

The Pre-Crisis Landscape: Overcapacity and Reduced Profitability

Prior to the escalation of Houthi attacks in the Red Sea, the global shipping industry was already facing challenges due to overcapacity. In shipping terms, this is defined as a scenario whereby there are more ships than there is cargo. This overcapacity resulted in:

Decreased profitability: With more ships competing for fewer contracts, freight rates (the cost of shipping goods) declined significantly. This negatively impacted the revenue and profitability of shipping companies.
Reduced share value: As profitability dropped, the market value of companies in the shipping industry alsodecreased.

Data and analysis support this observation. For instance, The Maritime Executive forecasted containership overcapacity to last until 2030 or beyond, and S&P Global reported a 71% decline in freight rates in 2023 compared to 2022.

The Red Sea Crisis: A Potential Opportunity?

The diversion of shipping routes due to the Houthi attacks has had a paradoxical effect on the financial situation of some shipping companies. While the crisis is undoubtedly a negative development for global trade and regional stability, it has inadvertently created a situation whereby:

Increased demand & limited supply: By diverting ships away from the Red Sea, the available supply of vessels on other routes has decreased. This, coupled with unchanged demand, has created an imbalance resulting in a surge in freight rates, with the cost to ship a container from China to the Mediterranean jumping by 44% to $2,413.
Potential for increased profit: Shipping companies have the ability to pass on these higher costs to consumers, potentially leading to increased profit margins.

“For them [shipping companies], this is going to deliver increased profitability that they didn’t expect to have,” said Michelle Wiese Bockmann, a senior shipping analyst at Lloyd’s List Intelligence.

“The longer they have to divert, the higher their freight rates. They are definitely winners.”

As an example, the share price of ZIM, an Israeli shipping company, surged by 50% following the escalation of attacks. Similarly, shares of Maersk and Hapag-Lloyd, two of the largest container shipping companies, have also seen significant increases of about 20% and 17%, respectively.

The combined market capitalization of the world’s largest publicly traded shipping companies has jumped by about $22 billion since Dec. 12, when the assaults really ramped up.

The phenomenon of rising shipping rates amidst supply chain disruptions is not new. Historical precedents, such as the closure of the Suez Canal during the 1967 war, have shown that geopolitical crises can lead to “golden ages” for shipping, where operators and owners reap significant profits due to skyrocketing freight rates.

The Red Sea crisis is undeniably a significant event with global implications, warranting serious attention due to its impact on international trade and security. However, as demonstrated, shipping companies have managed to “benefit”from the ensuing consequences of the conflict. While such benefits highlight the adaptability and resilience of the shipping industry, they also remind us of the intricate interplay between geopolitical events and global commerce. This scenario serves as a testament to the multifaceted nature of international crises, where adverse conditions can simultaneously generate unforeseen opportunities for specific sectors.

ASERO is an expert in risk assessment, offering best practice solutions that draw on our wealth of experience from several successful national and large-scale projects in the public and private sectors around the globe. In addition to our risk assessment proficiency, ASERO has developed a robust approach for guiding government agencies, major corporations, and critical industries through the challenges of responding to and recovering from severe natural and man-made emergencies.

Securing Peace of Mind: The Essential Role of Safe Havens in High-Profile Homes

Incident Date : 2024 | Topic : Physical,VIP | Region : Europe,Middle East | Tag : Case Study

The recent robbery on December 27, at the home of Jack Grealish, a renowned Manchester City football player, has cast a glaring spotlight on the security vulnerabilities faced by high-profile individuals. In a distressing turn of events, about ten members of Grealish’s family, including his parents and fiancée Sasha Attwood, were present in the house, absorbed in watching a match on television, when the burglary occurred. The family, alerted by noises upstairs and the barking of their dogs, promptly pressed a panic alarm. Despite their quick response, the burglars managed to flee with an estimated £1 million worth of jewellery and watches, leaving the culprits still at large. This incident is not an isolated one; other football stars like Eran Zehavi, the Israeli player, and various celebrities have faced similar invasions, underscoring the urgent need for enhanced security in the homes of those in the public eye.

This growing trend of targeted home invasions among celebrities and sports figures like Grealish brings to the forefront the critical importance of establishing a safe haven within one’s residence. Such a haven is essential, particularly in homes where the presence of valuable assets and high-profile residents increases the risk of such threats. A safe haven serves as a sanctuary, a fortified part of the home designed to offer protection against a range of potential dangers, from burglaries to natural disasters.

The concept of a safe haven goes beyond the mere installation of a secure door or alarm system. It involves a comprehensive approach to safety, taking into account various factors that influence the level of security required. The nature of the threat, whether it’s a potential break-in or a natural disaster, must be thoroughly assessed. The safe haven’s design should also be influenced by the activities typically carried out in the home and the general security landscape of the neighborhood.

Equally important is the consideration of the response time of local security forces. The distance from emergency services and their average response times are crucial in shaping the features and capabilities of the safe haven. The value of the property and possessions within the home also dictate the extent of security measures needed. Furthermore, the design must accommodate the number of people regularly residing in the house, ensuring their safety and comfort in times of emergency.

Advanced security features are imperative for a safe haven, especially in scenarios where intruders might resort to extreme measures such as arson or armed entry. This includes the incorporation of fire-resistant materials, independent ventilation systems, bulletproof walls, and windows. The integration of modern technology is also vital, with high-definition surveillance cameras, biometric security systems, and remote monitoring capabilities forming the backbone of a sophisticated and responsive security setup.

In the face of escalating security threats to high-profile individuals, the need for expertly crafted safe havens is more critical than ever. This is where ASERO’s unparalleled expertise becomes invaluable. Specializing in complex infrastructure security, personal protection, and advanced technological solutions, ASERO offers a comprehensive approach to security. Our team’s deep domain knowledge and ability to assess and mitigate potential threats ensure that your safety is meticulously planned and executed.

For those seeking a security partner with a proven track record in protecting high-value residences and individuals, ASERO stands as a leader in the field. Let ASERO be your partner in ensuring not just security, but peace of mind in an increasingly uncertain world.

The implications of relying on foreign state-owned entities for critical infrastructure

Incident Date : 2022 | Topic : Critical Infrastructure | Region : Europe | Tag : Case Study

In November 2022, eight months into the war in Ukraine, Germany announced the takeover and nationalization of Gazprom Germania, a former subsidiary of Russian government majority-owned Gazprom, a multinational gas corporation which, until that point, indirectly controlled Germany’s largest gas storage facility located in northwestern Rehden. The now renamed Security Energy for Europe Gmbh (SEFE) is yet another step toward breaking away from Germany’s reliance on Russian energy.

In the years leading up to the war in Ukraine, Russia’s Gazprom has played an increasingly manipulative role in the supply chain driving Germany’s energy operations. In 2013, Russian natural gas exports to Germany grew to over 40 billion cubic meters (bcm). The lion’s share of those exports entered Germany through the twin Nord Stream pipelines on the Baltic seabed and then moving inland across Germany via the OPAL and NEL pipelines. At that time, Gazprom was the main shareholder, operator and gas supplier for each of those pipelines.

Over and above pipelines, Gazprom expanded its operations into gas storage capacities, which are a critical component of its export and transit operations in Germany. Substantial efforts were undertaken to develop underground gas storage facilities in Germany which could be linked with Gazprom’s pipeline holdings.

To that end, in 2013, Rehden, not only Germany’s largest gas storage facility but also the largest underground gas storage site in Western Europe with a capacity of 4.2 bcm, came under the full operational control of Gazprom.

Fast forward to 2022 and Russia’s invasion into Ukraine and we see a significant drop in national gas transports, leaving Germany, among other Western European countries, scrambling for solutions to fill their gas storage facilities. However, it is important to highlight that daily delivery records made public by Gazprom reveal that the energy giant had been reducing European natural gas supplies since the summer prior to the onset of the war. And well before Russia essentially cut off gas exports to Europe via the Nord Stream, Russia had only been routing roughly 20 percent of its maximum possible volume into Germany, citing advanced technical problems and unsubstantiated sanction-related delays in the delivery of a repaired turbine, explanations which German officials discard as a ploy for a political power play.

In fact, German State Secretary for Economic Affairs Oliver Krischer went so far as to accuse Gazpom of deliberately manipulating the German gas supply in preparation of the war. He made the claim that Gazprom deliberately allowed the Rehden storage facility to run empty throughout the winter season prior to the war ‘in order to increase dependency and vulnerability.’

This case draws attention to the potential implications of allowing a foreign entity, particularly a state owned foreign entity, to regulate critical infrastructure as a third party in another country. By giving Gazprom authority over vital natural gas storage facilities, Germany was left vulnerable to a plotting Putin.

The general consensus among regulators, government officials and even the public is that there is no real harm in allowing foreign governments to invest in local infrastructure via their state-owned entities, the rationale being that outside investment promotes funding in infrastructure projects which may otherwise be delayed or even held off indefinitely. Furthermore, the argument is often made that the country retains control over its own infrastructure by virtue of the fact that the installation itself resides there. And while these considerations are valid, we can see from this case study that allowing a state-owned foreign entity to regulate not only the entire critical natural gas supply chain but also the reserve capabilities of another country can actually weaken that country’s sovereignty vis-à-vis foreign influence and coercion.

We believe that this is a valuable lesson which must be made known to decision makers looking to allow foreign infrastructure investment. Had this outcome been considered by German decision makers in advance, some of the repercussions may have been avoided. Once it became known that Gazprom had deliberately allowed the Rehden storage facility to run empty, the German Federal Ministry of Economics prescribed minimum filling levels as part of a new Gas Storage Act. However, this measure was, as the saying goes, too little, too late. It is necessary to build in clauses like minimum filling levels into the licensing agreements well prior to commencement of construction. Failing to do so, in this case, left Germany vulnerable.

Click here to apply to receive our full case study analysis, including insights and recommendations.

Mail bomb attacks target Spain and Ukrainian diplomats

Incident Date : 2022 | Topic : Explosives | Region : Europe | Tag : Case Study

Between November 24 and December 2, 2022, a total of six letter bombs were sent to high profile targets in Spain including Prime Minister Pedro Sanchez, the Torrejon Air Base and the United States and Ukrainian Embassies in Madrid, among other sites connected to ardent Spanish support of Ukraine in Russia’s ongoing war. The defense minister, who recently announced that Spain would send six HAWK air defence systems to Ukraine, was also targeted in the attack, as was the headquarters of Instalaza in Zarazoga, a Spanish weapons manufacturer which supplies Ukraine with C90 rocket launchers.

Incidentally, the timing of the attack coincided with a visit carried out by Spain’s Defense Minister, Margarita Robles, to the Ukrainian port city of Odesa, where she met with her counterpart Oleskii Reznikov where she released a statement that the letter bombs would not deter Spain’s support for Ukraine.

Most of the letter bombs were detected and defused, though one devise ignited and slightly injured a Ukrainian Embassy employee. And while no suspect has been named in the attacks, it is believed that the letters appeared to have been sent from within Spain. All of the letter bombs were contained in similar brown envelopes which contained loose gunpowder and an electrical ignition mechanism.

Coinciding with this wave of letter bombs in Spain and the ignition of one of the letter bombs at the Ukrainian Embassy in Madrid, more than a dozen packages containing explosives or animal parts, like the eyes of cows and pigs, were sent to Ukrainian diplomats throughout the world. According to Ukraine’s Ministry of Foreign Affairs, embassies in Hungary, the Netherlands, Poland, Croatia, Italy, Austria and the consulates general in Naples and Krakow received suspicious packages. All packages were reportedly ‘soaked in a liquid of a characteristics color and had a corresponding smell.’

ASERO speculates that these attacks were not initiated by a state-sponsored agent. Instead, taking into account the ease with which this modus operandi may be carried out, we suspect that this is a lone perpetrator or otherwise unaffiliated group of disgruntled individuals.

What we are seeing here is the initial wave of letter bombs originating in Spain, almost immediately followed by a copy-cat of sorts, which spreads outward into Europe sending a series of false letter bombs and animal parts to a series of Ukrainian diplomatic targets.

This is not the first time letter bombs have been used as a means of inciting fear and reaching high profile targets. In fact, the first recorded use of what would be considered today a conventional mail bomb attack dates all the way back to the November 1712 Bandbox Plot whereby a hatbox was configured to fire a number of loaded and cocked pistols upon opening in an attempt to assassinate Robert Harley, Earl of Oxford and the British Lord Treasurer.

We are all much more familiar with more recent case studies involving mail bombs including the universally known case of Ted Kaczynski, aka the Unibomber, who sent multiple mail bombs between 1978 and 1994 which resulted in the death or injury of over a dozen victims; the October 2018 spate of pipe bombs mailed to known and high profile Democrats and Trump critics including Barak Obama, Hillary Clinton, CNN news offices, millionaire philanthropist George Soros and actor Roert De Niro, among other figures; and, a campaign launched by what is referred to as the New IRA which claimed responsibility in 2019 for four parcel bombs containing homemade explosive devices sent to London City and London Heathrow Airports, Waterloo Station and the University of Glasgow, among other incidents.

In addition to explosive devises, the mail has also been used as a conduit to carry out biological and chemical attacks against specific and high profile targets. In January 2021, Dr. Anthony Fauci, Director of the National Institute of Allergy and Infectious Diseases, who played a pivotal role in establishing US policy vis-à-vis the Covid-19 pandemic, opened a letter which contained a white powder. While the powder turned out to be benign, Dr. Fauci had initially feared it was either anthrax or ricin. There are numerous anthrax hoaxes involving the use of white powder sent via mail to high-profile targets including Donald Trump’s campaign office and Texas Senator Ted Cruz.

The objectives of these attacks is ostensibly to incite fear and to draw attention to the instigator’s cause or plight.

However, it is important for us to remember that these attacks also have the potential to cause widespread panic, damage on a large scale and, most importantly, loss of life.

In September 1972, Ami Shechori, the Israeli Agricultural Attache to England was killed by the explosion of a letter bomb addressed to him. The letter bomb was one of a series of similar bombs sent from Amsterdam to Israeli embassies around the world and addressed to individual embassy staffers. This wave of letter bombs was carried out just two weeks after the massacre of Israeli athletes at the Munich Olympics. The Palestinian terrorist organization Black September claimed responsibility for both.

In 2001, just one week after the 9/11 attacks, anthrax-lined letters appeared in the US mail over the course of several weeks. The letters, which had a Trenton, New Jersey postmark, were sent to publications and news stations including ABC News, the New York Post, NBC News and CBS news. High profile news media and political figures were also targeted including National Enquirer publisher Bob Stevens, who died three days later from inhalation of the anthrax spores, Democratic Senators Tom Daschle and Patrick Leahy.

In total, five people died and at least 17 more fell seriously ill as a result of exposure to the anthrax and what remains today the worst biological attack in US history. It also prompted widespread hysteria and disrupted daily life and governance in the United States. In the years since the anthrax attack, it is estimated that the United States has invested over $50 billion in protection measures against biological threats.

Often times, there will be a wave of attacks involving explosives or purportedly harmful substances sent through the mail followed by a momentary spike in fear, awareness and enhanced security measures before we all quickly forget that it happened. However, we must remember that because this modus operandi is effective in garnering attention, if only in the short term, is relatively easy to carry out and has the potential to cause significant damage, we are likely to continue to see it being used by different types of adversaries going forward.

As a result, we must equip ourselves with the necessary tools to deal with this type of threat. The most important thing we can do is to promote awareness of and to the threat. Doing so can result in the early detection of a mail bomb which could have the potential to cause large scale damage or even loss of life.

The second thing, which both complements and strengthens awareness, is proper training to detect potentially suspicious mail, particularly when tasked with sorting through large volumes of mail, as is the case with many of the targets in these attacks. Training should consist of a combination of tools which provide a layered approach to threat detection including a cognitive approach involving the identification of suspicious indicators and the use of technology such as x-ray and sniffer sensor and detection devices, among others.

Click here to apply to receive our full case study analysis, including insights and recommendations.

The assassination of former Japanese Prime Minister Shinzo Abe

Incident Date : 2022 | Topic : Shooting | Region : Asia | Tag : Case Study

At approximately 11:30am local time on July 8 2022, former Japanese Prime Minister Shinzo Abe was shot from behind by a lone gunman while giving an election campaign speech in the southern city of Nara, east of Osaka.He was pronounced dead at 17:03 local time.

Police arrested 41-year-old Tetsuya Yamagami at the scene and he admitted to shooting Abe.Yamagami used a homemade gun to carry out the shooting motivated, according to reports, by his belief that Abe was linked to a specific, possibly religious, group he hated. Police have not released the name of the group.

In the immediate aftermath of the attack, Abe was evacuated from the scene by ambulance and then airlifted to Nara Medical University hospital via helicopter.

According to reports, while Yamagami denied political motivations for carrying out the shooting, he did tell police investigators that the attack had been planned for months.Investigative sources have also indicated that Yamagami went to Okayama one day prior, where Abe was giving another campaign speech though the reason is not known.

The weapon used in the shooting appeared to be a handmade gun with cylindrical metal barrels wrapped in black tape that measured 40 centimeters long and 20 centimeters wide.

Police confiscated several other handmade weapons after a search of the suspect’s house.According to some reports, explosives were also found on the premises.

Shootings are extremely rare in Japan due to strict gun ownership laws.According to the National Police Agency, Japan reported 10 firearm related incidents in 2021, with one fatality, which is a small number relative to Japan’s large population.

Japanese officials, including former Prime Ministers, are protected by a special branch of the Tokyo Police.These plainclothes officers, called SPs (Security Police), typically stay close to the dignitary to safeguard against physical threats. Dignitaries in Japan typically travel with modest security details focused primarily on direct physical threats.

According to reports, Abe was protected at the rally by one armed specialized police officer and some other local offices. Nara police have not stated how many police officers were deployed for Abe’s security.

When he was shot, Abe was standing at an intersection outside of a train station.He was facing a crowd of hundreds while, at the same time, buses and vans passed behind him on the road where the assailant appeared.

Photos circulated in the aftermath of the shooting show that the suspect was able to reach within a few meters of Abe without any sort of checks or barriers.

The security plan for the campaign event was drafted by the Nara prefectural police and will be reviewed by Japan’s National Police Agency.

Abe was the longest serving Prime Minister of Japan, stepping down rather recently, in 2020, citing health issues.He was still among the most prominent and influential politicians in Japan. While we do not know if there was any intelligence regarding threats against Abe, dignitary protection requires, at least, a base level of security, particularly when there are a relatively few number of targets and a wide range of potential motives. In this case, that base level of security obviously failed.
Even if there were constraints on the number of trained security officers who could travel with Abe, the number of deployed security personnel on the ground could and should have been supplemented by local law enforcement.Had a sufficient number of security personnel been deployed, and properly deployed, it may have deterred or foiled the attack. Video footage appears to show that while there was security deployed around Abe, there was no one facing backward where people and vehicles were moving freely.
According to reports, no one, including security personnel on site, understood what was happening until the second shot was fired.Based on video footage of the assassination, the first shot appeared to have missed Abe. Had security reacted to the first gunshot, the outcome of this attack could have been different. The lack of an immediate response is an indication of the level of training and emergency planning.
We believe that as a result of strict gun laws combined with the extremely low incidents of gun crimes or political violence, it appears as though armed assaults are not high on the plausible threat criteria for Japanese law enforcement.That said, this incident demonstrates that even strict gun laws and the rarity of events clearly do not preclude the possibility of an armed assault, in this case using an improvised homemade weapon. While the use of improvised weapons are not always an effective modus operandi, the situation on the ground changes when an assailant is able to get within such close proximity of the ‘target,’ i.e., the dignitary, and a single shot may be all that is needed.
A number of parallels may be drawn between the assassination of former Prime Minister Shinzo Abe and the assassination of Israel’s Prime Minister Yitzhak Rabin on November 4, 1995 immediately following a rally in Tel Aviv in support of the Oslo peace process.Rabin was en route to his vehicle when he was shot from behind by a lone gunman who was able to enter what should have been a protected zone behind the venue. The Rabin assassination was a watershed event for how protective security is carried out in Israel.

We know that a visible security or police presence has a deterrence effect on potential assailants. Just weeks before the assassination of Israeli Prime Minister Yitzhak Rabin, Yigal Amir, Rabin’s assassin, attempted to enter an engagement attended by Rabin, though he was deterred by a visible security presence. During the post-attack investigation, Yigal Amir acknowledged that had security told him to leave the premises on the night of the assassination, he would have left without incident.

Click here to apply to receive our full case study analysis, including insights and recommendations.

Pro-Russian hacking group claims responsibility for disruption of US airport websites

Incident Date : 2022 | Topic : Airport,Aviation,Cyber | Region : Europe,North America | Tag : Case Study

On Monday October 10 several U.S. airport websites were temporarily inaccessible or otherwise disrupted as a result of a targeted DDoS attack reportedly carried out by Killnet, a politically motivated, pro-Russian hacker group.

Prior to the attack, Killnet published a target list on its Telegram channel as a call to arms for like-minded recruits. Among the airports targeted included some of the largest and busiest airports in the United States including Hartsfield-Jackson International in Atlanta, Los Angeles International (LAX), LaGuardia Airport in New York and Chicago O’Hare, among others.

While the incident may have caused inconvenience to people seeking travel information, Kiersten Todt, Chief of Staff of the US Cybersecurity and Infrastructure Security Agency (CISA) stated that there is ‘no concern about operations being disrupted,’ and no signs of impact to actual air travel were reported in the aftermath of the attack.

A DDoS attack involves flooding a computer network with simultaneous data transmissions, i.e., phony web traffic, with the aim of knocking it offline. As opposed to hacking attacks which involve breaking into networks, DDoS attacks aren’t aimed at accessing information. Instead, the objective is to disrupt the normal traffic of a targeted server, service or network by overwhelming the target and/or its surrounding infrastructure with a floor of internet traffic, thereby causing it to crash or become vulnerable from the volume of requests.

The Killnet hacker group has taken responsibility for a number of attacks targeting organizations in NATO countries since the onset of Russia’s incursion into Ukraine. Last week, the group claimed responsibility for knocking a number of US state government websites offline using the same DDoS cyberattack modus operandi. The group has also been blamed for briefly disrupting a US Congress website and for a number of cyber attacks targeting Lithuanian agencies, citing their involvement in the ongoing war.

This attack is yet another in an ever-growing list of incidents clearly demonstrating that even our most critical infrastructures are highly vulnerable to manipulation and exploitation. And while the impacts of this attack were minor, we must recognize that similar types of cyber attacks against key assets have the potential to cause catastrophic consequences. As a result, it is essential for everyone, not just critical infrastructures like airports and government bodies, but individuals and businesses alike, to take appropriate counter-measures aimed at securing their most critical networks and systems from relevant insider and external threats.

Click here to apply to receive our full case study analysis, including insights and recommendations.

Ericsson CEO reveals the company may have paid ISIS for access to transportation routes

Incident Date : 2022 | Topic : Terror | Region : Europe,North America | Tag : Case Study

On February 16, 2022, Swedish telecoms equipment maker Ericsson CEO Borje Ekholm released a statement in which he conceded that the company could have made payments to terrorist organization ISIS in Iraq in exchange for access to transport routes to evade local customs.

An internal investigation initiated in 2019 looked at the conduct of Ericsson employees, vendors and suppliers in Iraq during the period from 2011 – 2019 and found ‘serious breaches of compliance rules’ as well as evidence of corruption related misconducted including ‘making a monetary donation without a clear beneficiary; paying a supplier for work without a defined scope and documentation; using suppliers to make cash payments; funding inappropriate travel and expenses; and, improper use of sales agents and consultants.’

While the company identified ‘unusual expenses dating back to 2018,’ the probe could not ‘determine the final recipients’ of the money. However, there was evidence pointing to the use of alternative transport routes, some of which were controlled by terrorist groups, including ISIS, as a way to avoid Iraqi customs.

In response to the findings, several employees were ‘exited from the company’ amid a number of additional disciplinary and remedial actions.

In 2019, Ericsson paid over $1 billion in penalties to resolve bribery and corruption investigations by the United State Department of Justice (DoJ) and the Securities and Exchange Commission (SEC) over violations of the US Foreign Corrupt Practices Act in response to findings that Ericsson had made and falsely recorded tends of millions of dollars in bribes over a long period of time.

In response to the allegations, shares in the Stockholm-based company fell as much as 14.5 percent.

We know that the cargo supply chain has been both a conduit for carrying out terror attacks and a means by which to transport and smuggle goods and materials used to fund and commit acts of terror.
This most recent revelation from Ericsson CEO Borje Ekholm represents the exploitation of the supply chain route itself as a channel for funneling money to terrorist organizations.
We know that there are regions in the world where paying bribes in exchange for given benefits is commonplace. Bribes may be made by or on behalf of commercial entities or even sovereign nations.
This is not the first time that an alleged deal with a known terrorist entity has been reported in exchange for certain benefits.In December 2021, it was reported that an Italian government body will initiate a probe into documents which appear to confirm long-held accusations that Italy made a deal to not interfere with Palestinian terror attacks against Jewish and Israeli targets, including a 1982 assault on the Great Synagogue of Rome in which a two-year old boy was killed and 37 others injured, in exchange for not attacking other Italian interests.
It is highly likely that there are many similar cases involving bribery and corruption in exchange for access which will come to light in the aftermath of this most recent case, particularly given the competitive supply chain environment and the need to transport goods as quickly and directly as possible.
It is important to recognize that by making these deals, companies and even sovereign states are encouraging terrorism and terrorist groups and funding their operations, a move which will later likely come back to hurt them not just in possibly becoming the target of an attack but in the damage to reputation over and above the legal and personal implications for those involved.We can already see the economic impact that these allegations have had on Ericsson stock prices.
We clearly cannot rule out the likelihood that other companies or entities have made similar deals with known terrorist organizations to allow for the free movement of goods and merchandise through terrorist-controlled areas.
We must consider the implication of this incident, particularly in high traffic cargo transport regions and channels including the Bab el-Mandeb Strait separating Yemen on the Arabian Peninsula and Djibouti and Eritrea in the Horn of Africa, where roughly 6.2 million barrels of crude oil and petroleum products are transferred daily toward Europe, the United States and Asia, among other goods. This channel, among many others throughout the world, could turn into a hub for terrorists looking to fund their operations using monies paid out by supply chain giants to avoid customs, make quicker deliveries by accessing alternative routes or attaining immunity from piracy or other attacks. It is also important to consider how quickly a scenario like this could escalation from bribery to more sinister attacks.
Given the complexity of the supply chain, which includes the use of third parties such as vendors and suppliers, it is necessary to ensure that there are proper protocols in place as well as transparency with respect to how and where money is channeled.

Click here to apply to receive our full case study analysis, including insights and recommendations.

Cyber-attack against SITA

Incident Date : 2021 | Topic : Airport,Aviation | Region : North America | Tag : Case Study

Global airline technology provider, SITA, confirmed that its servers were breached in a cyber attack which led to a data security incident involving passenger data stored on SITA’s Passenger Service System servers in Atlanta, Georgia, which operates the passenger processes systems for airlines.

SITA serves as a communications and technology vendor for 90 percent of the world’s airlines. We know that the SITA PSS System, which operates passenger processing systems for airlines, holds data from airlines which are alliance members as well as direct customers. As a result, exposure of this passenger data poses a significant threat to both the company itself as well as its alliance members.

SITA has advised that it undertook immediate action in the aftermath of the incident and has contacted affected customers.

While SITA has not yet disclosed which airline data was affected, some carriers including Singapore Airlines, Thai, Malaysia Airlines, Finnair and Jeju Air issued statements regarding the breach, which appears to have targeted respective loyalty and frequent flyer programs. According to reports, Cathay Pacific, Air New Zealand and Lufthansa were also affected by the incident. It is believed that this attack resulted in a breach of roughly 500,000 frequent flyer members’ data.

News reports indicate that the attack was highly sophisticated; however, the attack vector remains under investigation by SITA’s Security Incident Response Team. The attack vector in the breach is not yet clear but it is clear that due to the sensitive nature of information held by SITA including passenger names, addresses and passport data, it would be an attractive target for cyber criminals.

This incident represents another in an increasing trend of attacks against third party supply chain providers and how entities can be made vulnerable based on their respective dependences upon to third party vendors. In hacking cases like these, the stolen data can directly impact other companies which cooperate both directly and indirectly with IATA.
This case brings to light a number of recent trends in cyber-attacks, most notably regarding personal data theft, inclusive of:
Ransomware – Computers may be infected by actions undertaken by users who were unknowingly outwitted by the attacker, e.g. virus encrypted computer files. In this case, the group then held the information ransom, demanding Bitcoin in exchange for the decryption key.
Data theft – An attacker gains access to and steals sensitive data and information. It is primarily carried out silently, meaning that the victim(s) is not aware that the information was stolen. In these cases, a relevant attack vector may be the Advanced Persistent Threat (APT), though this approach requires significant effort on the part of the attacker to successfully undertake.
Distributed Denial of Service – This attack, which is typically carried out against service providers including both government and private entities, results in the unavailability of networks and services which can cause significant interference to services.
Although the attackers were able to gain access to internal documents which may have included customer information, there is no evidence to indicate that said data has been compromised. To date, the attackers have not released information nor, to the best of our knowledge, have they sent demands to SITA in exchange for not releasing information.
Without doubt, SITA should be classified as an attractive target for cyber criminals due to the sensitive nature of information they hold, the strength of their branch within the industry and the magnitude of information we assume they hold.
Traditional enterprises like airlines have been an attractive target for cyber attacks as many often rely on legacy software which, as we know based on previous case studies, is sometimes out-of-date or may have existing vulnerabilities that were not patched and that may be exploited. In recent years, as many as hundreds of ‘technical glitches’ and cyber incidents have been reported in the aviation sector of varying levels of sophistication and complexity. Some relevant examples include:
Air Canada (2018) – Air Canada requested that 1.7 million mobile app accountholders reset their passwords after it detected unusual login behavior which may have exposed 20,000 accounts, including customer passport details as well as app profile data containing a person’s name, address and email address.
British Airways (September 2018) – British Airways announced that the personal and financial information of 380,000 of their passengers had been hacked. Passenger names, home addresses and credit card data were all stolen during the 15-day security breach. A script running on BA’s baggage claim information page had been changed just before the breach began. The new script was designed to capture the personal and financial data customers entered including names and home addresses, as well as credit card numbers, expiry dates and CVV codes. That information was then relayed to a database under the hacker’s control. In this attack, hackers were able to gain access to sensitive information without disturbing the flow of commerce or raising suspicion.

Cathay Pacific (2018) – Cathay Pacific acknowledged that the personal data of up to 9.4 million passengers, including passport numbers, was accessed by unauthorised personnel. The discovery that some of its information systems had been compromised was made amid routine ‘ongoing IT security processes.’ Data accessed included passenger names; nationalities; dates of birth; phone numbers; email addresses; physical addresses; 860,000 passport numbers; 245,000 Hong Kong ID card numbers, frequent flyer programme membership numbers; customer service remarks; and historical travel data.

Click here to apply to receive our full case study analysis, including insights and recommendations.

VIASAT Cyberattack

Incident Date : 2022 | Topic : Cyber | Region : Europe | Tag : Case Study

On February 24, 2022, as Russian troops moved into Ukraine, a massive cyber attack was caried out against the ground infrastructure of the KA-SAT satellite, owned by US company Viasat and responsible for beaming high speed internet to people across Europe, causing a huge loss in communications at the very outset of the war.

A subsequent investigation revealed that the attack was likely the result of a destructive wiper malware called ‘AcidRain’ which is designed to remotely erase vulnerable modems and routers. Traces of the malware and its operation point to Russian origin. It is important to highlight that this is the not the first time that a Russian cyber attack has preceded a physical attack or invasion. Russian cyber attacks immediately preceded both the 2008 Russo-Georgian War and the 2014 annexation of Crimea.

One reason why this attack is particularly significant is its spillover into the rest of Europe. While the attack targeted Ukraine, people using satellite internet connections were knocked offline all across Europe from Poland to France. A full month after the attack disruptions continue throughout Europe. Thousands remain offline, including critical infrastructure and roughly 2,000 wind turbines belonging to the German energy company Enercon are still disconnected in Germany and cannot be reset or controlled remotely. Many other European companies are racing to replace broken modems or fix connections with updates. Russia has also launched cyber-attacks against Ukraine in both 2015 and 2017 during periods of heightened conflict.

The spillover impact of this attack is a key example of incidental damage, whereby a relatively simple attack spreads, either intentionally or accidentally, far beyond its original target and has a wide and significant impact on state and critical infrastructure, such as Enercon wind turbines in Germany.

The risk of spillover is the key takeaway from this attack. While a cyber attack may target one country or one infrastructure, it may pose a far greater threat to neighboring countries or interdependent infrastructures. As such, ASERO recommends that countries and corporations pay close attention to and invest in protecting critical infrastructure from cyber threats, taking into account possible spillover effects and the need for backups and redundancy.

Click here to apply to receive our full case study analysis, including insights and recommendations.

The implications of the cyber breach against Shirbit insurance company

Incident Date : 2021 | Topic : Cyber | Region : Middle East | Tag : Case Study

On December 16, 2020 ASERO published a white paper on the Shirbit insurance company cyber breach which included a series of insights and recommendations in the aftermath of the significant attack. The following paper presents the financial implications on Shirbit in the months following the attack.

Shirbit, among the largest insurance firms in Israel and service provider for government ministries and critical infrastructures, was subject to a large scale cyber breach in November 2020 during which a group calling itself Black Shadow claimed to have taken possession of Shirbit’s client database which contains ID cards, drivers’ licenses, home addresses and phone numbers, marriage certificates, emails and other private client information.

On December 1, Shirbit and Israel National Cyber Directorate (INCD) began investigating the cyber event.

In the weeks following the attack, the Black Shadow group released information stolen from Shirbit. However, Shirbit stood by its decision to not pay the group’s ransom demands stating that “the company will not give in to this type of terror and will act within its means to defend the company’s clients and information.”

ATTACK IMPACT AND IMPLICATIONS

Financial reports published by Shirbit on Sunday April 4, 2021 revealed the extent of fourth quarter losses, effectively erasing annual 2020 profits. Overall 2020 profits dropped by approximate 90 percent.

Losses have been attributed to the inability of the company to renew its insurance policies in during the month of December after servers were shut down.

Four class-action lawsuits which amount to a total of 1.2 billion NIS ($360 USD million) have been filed against the company claiming that Shirbit did not address the security breach appropriately, thereby resulting in the widespread exposure of sensitive client information. Claims also state that Shirbit had cut back on cybersecurity costs at the expense of its customers and displayed a lack of transparency in managing the incident in its aftermath.

Company premiums showed an overall decline of 15 percent in 2020, down from 532 million NIS ($160 million) in 2019 to 453 million NIS ($136 million). In December, when the hack was first revealed, premiums declined by 8 percent compared to the corresponding fourth quarter of 2019.

Phoenix Insurance Ltd., a competitor and multi-line insurance, asset management and financial services is currently in talks to acquire Shirbit. It is important to be aware of the massive potential implications which may arise from a cyber attack of this nature, not just in terms of the impact on clients as a result of data breaches but also on a company or infrastructure’s financials and to take appropriate measures to secure sensitive information and databases accordingly.In this case, the overall impact of this data breach could be the acquisition of Shirbit.

Ransomware cyber-attack on Hillel Yaffe computer systems

Incident Date : 2021 | Topic : Cyber,Hospitality | Region : Middle East | Tag : Case Study

In recent years, there has been a 30 percent increase in ransomware attacks. Clearly, it is a growing threat which cannot be ignored.

A cyber attack on the computer systems in the Hillel Yaffe Medical Center in Israel on October 13, 2021 is yet another example of this increasingly sophisticated and alarming trend. According to reports, attackers took over the system and locked filed and information which they are now demanding payment to release. There is also concern that confidential patient information may have been leaked on a large scale during the attack.

The attack is being dealt with by the Israeli Ministry of Health and the Israel National Cyber Directorate though events and negotiations are still ongoing, and the extent of the damage and potential long-term ramifications remain unclear.

In the meanwhile, urgent medical services at the hospital continued as usual, as the center switched to alternative systems. Logging admissions have been carried out by hand. As an additional indirect impact, there are reportedly heavy delays in treatment due to doctors having to physically walk between departments to review test results usually accessed via computer systems.

ASERO believes that even though this incident is still ongoing, there are a number of valuable takeaways and lessons to be learned which may mitigate similar attacks from taking place in the future.

We know that critical infrastructure, including the health sector, is often an attractive target for capable adversaries to carry out anonymous cyber attacks, though the motives may vary. In fact, data published by Check Point in 2021 revealed an average of 1,443 attacks or attempted attacks against the health sector per week in Israel alone.

Attacking a hospital is both particularly attractive and dangerous due to concern for patient wellbeing, leaking confidential patient information and potential access to hospital research data, as we saw in attempts to breach Covid-19 vaccine research.

In recent years, cyber attacks against hospitals throughout the world have had dire consequences. In September 2020, hackers exploited a computer software vulnerability to take over computer systems in a large hospital in Dusseldorf, Germany. As a result of the attack, hospital staff was denied entry to critical information forcing the evacuation of patients to nearby hospitals and postponements of planned surgeries. We learn from this that cyber attacks against hospitals can be difficult to recover from. Moreover, they can have significant and even lasting impacts on not only the hospital itself but on patient wellbeing. It is also evident that it is incredibly difficult to recover or retrieve data or information once it has been stolen.

Cyber defense should be a key component of any national defense strategy with critical infrastructure prioritized at both the national and sectoral levels. Firstly, when protecting critical infrastructure, it is necessary to map interdependent or supporting infrastructures so as to better understand the potential impact an attack against a ‘second tier’ system could have on critical operations and then to engage relevant operators in ensuring proper oversight and implementation of security measures against cyber threats.

In addition, critical infrastructures should invest in proper back up systems. In this case, reports indicate that hospital operations were unaffected by the attack. Finally, it is necessary to prepare and exercise emergency and contingency plans including the ability to work offline and to maintain and back up critical information.

Click here to apply to receive our full case study analysis, including insights and recommendations.

NOTAM system outage affected 10,000 US flights

Incident Date : 2023 | Topic : Airport,Aviation,Cyber | Region : North America | Tag : Case Study

On Wednesday morning January 11, 2023, almost 10,000 United States flights were delayed or canceled as a result of a technical failure of the FAA Notice to Air Missions (NOTAM) system which caused disruption to flights for roughly 90 minutes and a cascade of further delays and cancellation of flights throughout the day.

The NOTAM system, first deployed in 1947, compiles and relays essential pre-flight information for pilots, airline dispatchers and others including safety issues at and around the nation’s airports such as potential bad weather on the planned flightpath, runway and taxiway changes at airports or closed airspace that must be avoided which are ‘essential to personnel concerned with flight operations, but not known far enough in advance to be publicized by other means.’

Although the direct cause of the outage has not yet been identified, it is well known that the system relies upon technology which, while generally reliable, is out of date. Apparently, the FAA has been working for years on a still in-progress NOTAM modernization effort including having transitioned to a cloud-based platform, ensuring sufficient redundancy and promoting US system compliance with the standards and recommendations issued by the International Civil Aviation Organization (ICAO).

Notwithstanding current reports, which state that there is no evidence to suggest that this incident was a cyberattack, we know that digital forensic investigations can take time and attributing the incident to a specific source is even more difficult. As such, we believe that it is still important to analyze this event, its immediate impact and subsequent domino effects and the responses taken by the FAA and airport and airline operators in the hours to follow from the lens and context of a deliberate attack so that we may take away valuable insights that may be parlayed into security measures going forward.

Again, there is no current evidence of a deliberate cyberattack. And as of Wednesday evening, some reports had linked the outage to a ‘damaged database file.’ However, we know that in recent years largescale cyberattacks, including state-sponsored attacks, have become an attractive and increasingly commonplace occurrence, particularly targeting aviation and other critical infrastructures. And many of these attacks have had impacts, albeit short term, on airport, air navigation services or airline operations or integrity.

For example, in June 2015, a DDos attack against LOT Polish Airlines jammed the airline systems for five hours, leaving the airline unable to send flight plans to the aircrafts before takeoff and resulting in dozens of flight cancellations and delays. In September 2018, Bristol Airport suffered a ransomware attack after which airport authorities were forced to take their screens offline, displaying an ‘out of service’ notice. While flights remained unaffected, the airport was forced to revert to whiteboards and extra staff to handle passenger confusion.

More recently, in 2021, several U.S. airport websites were temporarily inaccessible or otherwise disrupted as a result of a targeted DDoS attack reportedly carried out by Killnet, a politically motivated, pro-Russian hacker group.

When analyzing this event from the perspective of a potential cyberattack, we must look at how the NOTAM system, which has been moved in recent years from a manual system to an internet-based system with built-in redundancies is connected, what it is connected to and how information flows from its source to its endpoint within the overall airport and airline network. Most airlines subscribe to services that gather NOTAM information from the FAA and package it for each flight. Alerts can be tens or even hundreds of pages long written in a coded parallel language. In 2020, the total number of NOTAM issued exceeded 1.7 million.

According to the FAA website, digital NOTAMs and machine-to-machine data connections can be accessed through the NOTAM Distribution Service via the System Wide Information Management (SWIM) portal and the NOTAM Application Programming Interface (API). The objective of this update is to allow a single platform for all pilots, operators, dispatchers and software developers to find all FAA NOTAMs. We assume that messages pass from the NDS through the SWIM in a unidirectional manner.

However, and without delving too deep into the intricate and complex web of aviation networks, we must recognize that when an airport or airline service puts itself on the internet and connects with other systems and portals, it makes itself vulnerable to potential external penetration. We see that NOTAMs, in particular, are viewed in their millions per year, with an average of 35,000 NOTAMs issued daily. Furthermore, based on the nationwide impact of this incident, it is clear that the system is critical to maintaining routine airline operations, making it both vulnerable to and likely attractive for a large-scale targeted attacks. In addition, and over and above this direct flow of NOTAMs, we must also consider the cascading effect of an attack against the NOTAM system in terms of impacts on any interconnected or interdependent systems within the airline and airport networks.

ASERO believes that when looking at an incident of the magnitude of this most recent NOTAM event, it is important to look at the big picture beyond just what actually happened but also what could have happened and what can be done to prevent a worst-case security scenario going forward.

Click here to apply to receive our full case study analysis, including insights and recommendations.

Hacking group claims control of Belarusian railroads

Incident Date : 2022 | Topic : Cyber | Region : Europe | Tag : Case Study

On January 24, 2022, A group of pro-democracy hackers calling themselves ‘Cyber Partisans’ claimed to have infiltrated the Belarusian rail network, the country’s national rail system, in an effort to disrupt the movement of Russian troops into the country amid tensions over a renewed invasion of Ukraine.

The hackers reportedly encrypted internal databases and workstations that the Belarusian railways use to control traffic, customs and stations with malware which could result in delays to commercial and non-commercial trains. The group released screenshots appears to show their access to the railway’s backend systems.

In exchange for relinquishing control over the railway’s computer system, the Cyber Partisans are demanding that Belarus cease serving as a staging ground for the build up of Russian troops and military weaponry; and, for the release of 50 political prisoners currently held in Belarusian jails requiring medical assistance.

According to reports, the ransomware used by the hackers was specifically created but based on common practice. A spokesperson for Cyber Partisans stated that while the hackers permanently deleted some backup systems, others were mere encrypted and could be decrypted if the hackers provide the key. Using reversible encryption as opposed to wiping targeted machines would represent a new evolution in hacktivist tactics as it is the first time non-state actors developed ransomware purely to achieve political objectives.

The Cyber Partisans were quick to state that they did not yet target security or automation systems nor taken steps to paralyze trains by downing the signaling and emergency control systems. However, they maintain the capability to do so, should they choose to.

In the event that the backup servers are not properly maintained, cybersecurity experts have reported that the hackers could maintain control over the rail network indefinitely.

The Cyber Partisans, a group of about 25 anonymous IT experts and activists, have become well known in Belarus over the past two years and have been linked to a series of hacks against the government including a raid on the Belarus Ministry of Interior Affairs, giving them access to data on thousands of police officers who were otherwise looking to hide their identities due to a crackdown on civil protests as well as passport databases, files belonging to Belarusian KGB spies and security officials, police databases of informants and prison CCTV networks.

It remains unclear the extent to which the hack damaged railway operations or if they succeeded in achieving their goals.

This attack demonstrates that cyberattacks can be used for the purposes of achieving interstate political objectives. We must be wary of this modus operandi spreading to other groups as a means of political coercion.
This attack serves as an example of how the cyber domain is an increasingly attractive arena for attacks with political, commercial or other motivations. It furthermore demonstrates how a capable adversary can anonymously attack a facility as part of cyber warfare. We know that cyber warfare can often include targeting civilian sites, with a potentially large scale impact.
An adversary may be capable of carrying out attacks against targeted systems with varying degrees of aggression. In this case, rail services were impacted though we do not yet know the full extent of the damage or if the movement of Russian troops and weaponry were delayed in any way.

Click here to apply to receive our full case study analysis, including insights and recommendations.

The role of cyber warfare in the current war in Ukraine

Incident Date : 2022 | Topic : Cyber | Region : Europe | Tag : Case Study

Since the inception of the war in Ukraine, the country’s cyber security authority has reported that it is facing constant cyber attacks against government and infrastructure networks as part of what is being described as the first hybrid war.

In the first days following the onset of the war, both the Russian military and Russian hackers actively and simultaneously targeted Ukrainian infrastructure, particularly in the media and communication sectors. One week into Russia’s invasion of Ukraine, for example, an airstrike targeted Kyiv’s central TV broadcasting systems, crippling the country’s TV station, at the same time as wiper attacks were reportedly targeting communication and telecom companies in Kyiv. The intent of these attacks, which combined precision-guided munitions and cyberattacks, was ostensibly to create disorder and incite panic.

In the months since, Russian hackers have continually tried to cripple Ukraine’s military communications, cause blackouts, disrupt its banking, media and other sectors as well as crash government websites and undermine its defenses and public confidence during a time of extreme crisis.

The impacts of these attacks have ranged from temporarily preventing access to basic and critical services and the distribution of medicines, food and relief supplies to data theft and the promulgation of disinformation.

On the Ukrainian side, and in response to Russian cyber aggressions, cyber warriors have been recruited from around the globe to join a Ukrainian IT army that communicates through a Telegram channel. This is the first time a government has recruited independents into what is essentially a global volunteer organization that is being used as a state-sponsored cyber army.

It is very important to recognize that despite obvious and repeated efforts on Russia’s part to destroy communication channels and defense capabilities and to incite panic, disillusionment, and disinformation, cyber attacks to date have been largely unsuccessful in achieving anything more than some temporary disruption. Websites are quickly brought back online, people have not been prevented from accessing or withdrawing funds from the banking sector and the Ukrainian military has been able to rely on alternative modes of communication, when necessary.

There are a number of key insights which may be drawn from this realization. The first is that taking active cyber defense measures is clearly effective in warding off potentially large scale attacks against critical infrastructures. Building off this first insight, and taking into account the impacts of cyber attacks in this current war to date, it is clear that conducting effective offensive cyber operations is challenging, despite the fact that Russia has extensive cyber capabilities. We also note that Russia have refrained from carrying out cyber attacks against critical infrastructures in the West.

That said, it appears as though cyber attacks will become a growing feature of modern warfare. The Ukraine war has set a precedent, moving the fight into the cyber domain and blurring the line between soldiers on the front and citizens at home.

Click here to apply to receive our full case study analysis, including insights and recommendations.

Costa Rica Ransomware Attack

Incident Date : 2022 | Topic : Cyber | Region : Latin America | Tag : Case Study

During the course of May 2022, numerous cyber attacks were carried out against roughly 30 government agencies throughout Costa Rica.

President Alvarado’s outgoing government reported that the cyber attacks first targeted the Ministry Finance; however, after refusing to pay 10 million US dollars in ransom, additional attacks were carried out against other government offices including, but not limited to, the Ministry of Science, Technology and Telecommunications (MICITT), the Costa Rican Societal Security Fund (CCSS), the Ministry of Labor and Social Security, the Fund for Social Development and Family Allowances, and the Administrative Board of the Municipal Electricity Service of Cartago.

One key attack targeting the Ministry of Finance impacted the digital public platforms TIC@ and ATV (Virtual Tax Administration), which play a key role in collecting taxes and paying salaries. As a result, processes were shifted to manual operations, i.e., pen and paper, which resulted in bottlenecks throughout the public sector. Trade was paralyzed, citizens were unable to access online public services, private companies were unable to report earnings or charge the state for professional services, and thousands of employees went partially or entirely unpaid.

These attacks lasted for roughly one month and resulted in significant damage to the Costa Rican economy. In the first two days alone, the Costa Rican Chamber of Foreign Commerce estimated loses of over $125 million with a subsequent report of an additional $30 million in losses per additional day that the attacks continued.

The impact of these attacks caused the incoming President Chavez to declare a state of national emergency, seeking assistance from the governments of Israel and the United States, which have since aided in recovery and repair efforts.

It took almost two months following the attack for the ATV tax system to restart, only at which point employers were able to make payments. The Customs Control Information Technology (TICA) and EXONET, a platform used to manage and process tax exemption requests, were restarted at the same time.

The subsequent investigation revealed two perpetrators:

Conti Group. A pro-Russian criminal group dedicated to carrying out ransomware attacks, stealing files and documents from servers and then demanding a ransom in exchange for not releasing the stolen sensitive information. Their primary modus operandi is to infect computers with malware, giving them easy access to targeted systems. Once the group has accessed a compromised computer, they then encrypt data and employs a double extortion ransomware strategy, known as a two-step extortion scheme. According to this scheme, large quantities of information are exfiltrated from a computer system and the targeted files are then encrypted. Once this is carried out, the attackers are then able to threaten to publicly release the data unless they are paid a ransom. Following the ransom demand in exchange for the decryption key, the group then turns to extortion whereby a small amount of data will be released under threat of releasing additional material if a ransom is not paid.
Hive Ransomware Group. A criminal organization known for targeting public health organizations and institutions, particularly healthcare providers, energy providers, charities, and retailers across the globe. Hive uses several mechanisms to compromise business networks, including phishing messages with malicious attachments to gain access to a target computer network, extract copies of data, and then threaten to publish that data on a Tor website called HiveLeaks, unless a ransom is paid.

The attacks in Costa Rica clearly demonstrate that government institutions are not immune from cyber attacks, and that information and data systems are critical assets to any organization.

By acknowledging that critical government agencies and services are attractive targets for cyber assailants, we also understand that there is no substitute for the implementation of proper cyber protection measures, including procedures for securing critical assets and the incorporation of cyber defense into the national defense strategy.

To provide just a few recommendations, it is advisable to ensure that strong backup systems are in place to protect sensitive and classified data and information. It is also recommended to routinely check the availability of data and information in the backup system(s) as well as the ability to quickly load it onto an agency’s system in the event of an attack or other scenario whereby data, and thereby likely related services, becomes unavailable.

Click here to apply to receive our full case study analysis, including insights and recommendations.

SEARCH

Professional Articles

SEARCH

Professional Articles

Mass Shooting at Bondi Beach targeting Chanukah event

Massive Cyber Breach at Iberia Airlines Puts Traveler Information at Risk

NATO’s Eastern Flank Strengthens Borders and Security in Response to Growing Hybrid Threats

Roadmap for Dealing with Ransomware

Common themes emerge from the ongoing wildfires in Los Angeles and the New Years terror attack in New Orleans

Cyber-attack targets Japan Airlines

MI5’s Stark Warning: Adapting to the Evolving Threat Landscape

Critical Infrastructure at Risk: DHL Plane Crash and Hybrid Warfare Threats

Confronting Modern Threats: Intelligence Services Leaders Highlight Security Imperatives

How ChatGPT is being used to facilitate cyberattacks

Maritime Cyber-attack: DNV ShipManager Incident

Wake-Up Call: Russia’s recent assaults show that physical protection is still a concern

The Fight for Integrity: Wikipedia’s Battle Against Bias

In the Shadows: The Russian Espionage and State Secret Safeguards

Hit Where It Hurts: The Need for Holistic Protection of Critical Infrastructures

Navigating Cyber Threats: Key Lessons from a Major Security Breach

Another Less Discussed Aspect of the Red Sea Crisis

Securing Peace of Mind: The Essential Role of Safe Havens in High-Profile Homes

The implications of relying on foreign state-owned entities for critical infrastructure

Mail bomb attacks target Spain and Ukrainian diplomats

The assassination of former Japanese Prime Minister Shinzo Abe

Pro-Russian hacking group claims responsibility for disruption of US airport websites

Iranian cyber-attack on a US children’s

Ericsson CEO reveals the company may have paid ISIS for access to transportation routes

Cyber-attack against SITA

VIASAT Cyberattack

The implications of the cyber breach against Shirbit insurance company

Ransomware cyber-attack on Hillel Yaffe computer systems

NOTAM system outage affected 10,000 US flights

Hacking group claims control of Belarusian railroads

The role of cyber warfare in the current war in Ukraine

Costa Rica Ransomware Attack

Man Attempts to Board Ryanair Flight in Possession of Crude Improvised Explosive Device

Cyber Attack Against Boeing

Mass Shooting in Las Vegas

London Underground Bombing and the Dilemmas of Protecting Mass Transit Systems

Ramming Attacks in Barcelona and Cambrils, Spain

Ramming at Landgraff, Netherlands Music Festival

The drone threat to aircrafts

Families with Children Carry out Suicide Bombings in Indonesia

Manchester Airport incident

Mass shooting in Las Vegas

Cyber attack against Boeing

Terror attack on the London Underground

Reviewing the 18 attacks in Spain

Drone threats against the aviation domain

Families carry out separate suicide bombings in Indonesia

Attempted Drone Assassination of President Nicolás Maduro

Fake News Campaigns