Sponsored by Spectra Group
—————————————————————————————————————————————————————————————————————————————————————————————————————————————–
26 Sep 24. Global: Rise in cyber attacks against critical infrastructure will elevate operational, security risks. On 25 September, the US Cybersecurity and Infrastructure Security Agency (CISA) warned that threat actors are increasingly infiltrating critical national infrastructure (CNI) using unsophisticated attack vectors. The advisory reported that actors have capitalised on inadequate security measures, such as exploiting stolen and weak credentials in brute force attacks. This enables them to infiltrate industrial control systems (ICS) within CNI, possibly intending to disrupt operational continuity, including halting water and electricity provisions. The warning follows a cyber attack against a water treatment facility in Arkansas (US) on 22 September, which forced the facility to switch to manual operations. Although the attack did not affect water quality or provisions, it underscores the potentially life-threatening consequences that these attacks can have. Cyber operations from politically and financially motivated actors against ICS environments have markedly increased since early 2024, sustaining prolonged security and operational risks to CNI. (Source: Sibylline)
24 Sep 24. Smiths Detection, a global leader in threat detection and security screening technologies, and a business of Smiths Group, in partnership with Riskaware, an incident modelling specialist, have today launched UrbanAware, an end-to-end platform to augment, integrate and digitise the delivery of chemical, biological, radiological and nuclear (CBRN) hazard intelligence in real time during an incident.
This joint solution not only closes the gap between data collection, analysis and strategic awareness of CBRN threats, it also brings insights closer to the tactical edge, enabling stakeholders to quickly identify and understand chemical and other hazards in the field. Threats can be seen in real time on a map in relation to the team’s position, thus providing critical and potentially life-saving intelligence. Likely next stages of a chemical attack or accidental industrial release can also be forecast using the simulation capabilities.
Dr Sarah Robinson, Global Industry Director – Defence at Smiths Detection, said: “Our partnership represents a joint mission to create safer spaces and address complex global challenges in order to protect people, environments, infrastructure and societies worldwide. First responders and military planners need to act quickly when faced with disaster management and UrbanAware enables incredibly fast access to critical information. When combined with sensor data, it becomes a very powerful tool as a situation unfolds – supporting faster, more informed response strategies.”
Landscape and population considerations make it challenging to evaluate the potential impact of any incident and determine the best course of action. As the name suggests, UrbanAware is optimised for these complex urban environments where the topography of streets and buildings influences dispersion of airborne hazards. Typical use cases range from planning evacuation routes in a civil emergency to establishing optimal cordon areas based on predictive hazard modelling.
Underpinning Riskaware’s CBRN system is the Hazard Assessment Simulation and Prediction (HASP) Suite, which was developed over two decades by the Defence Science and Technology Laboratory (Dstl) and is licensed to Riskaware by Ploughshare. The HASP Suite was originally developed to provide rapid hazard prediction in complex urban environments in a matter of minutes, greatly improving upon previous models. It also takes into consideration the interactions between indoor and outdoor dispersion and is able to estimate source parameters, such as location, discharge time, and the amount of substance released. Integrating these robust capabilities with Smith Detection’s well established chemical sensor gives defence and security organisations a rich hazard modelling solution which surpasses any traditional options.
Dr James Christley, Senior Principal Scientist, Dstl, said: “Sustained Defence investment in science and technology consistently produces innovation that protects lives. We’re pleased that Dstl’s work developed originally for UK Defence will be exploited to benefit a wider audience.”
Simon Agass, Riskaware Business Development Director, added: “We’ve worked with multiple military agencies and have seen that the available CBRN solutions are highly manual and not fit for purpose in today’s threat landscape. Bringing together our comprehensive CBRN modelling capabilities with Smith Detection sensor technology provides a much-needed, end-to-end CBRN incident response capability that saves critical time, informs targeted action and protects more people.” (Source: BUSINESS WIRE)
25 Sep 24. MilDef ARMOR IT, at AUSA 2024, the largest U.S. army and defense exhibition. October 14-16 MilDef will be exhibiting at the Association of the U.S. Army’s Annual Meeting and Exposition in Washington D.C. MilDef will showcase rugged IT solutions for the digitalized battlefield including a new dismounted soldier concept, the next generation of intelligent displays and a NIAP certified KVM switch.
AUSA is the place to address top US and global military leaders on MilDef’s cutting edge Tactical IT for digitalization of armed forces. This year’s AUSA theme is “Transforming for a Complex World”.
MilDef design, produce and deliver long life cycle products & solutions for a tactical environment. The offer includes a wide selection of IT platforms including computer, display, network equipment and peripheral devices. At AUSA MilDef will present:
- Dismounted Solider System (DSS) – suite is built on the T.A.D. End User Device (Tactical Android Device), MilDef DSS HUB and the MilDef OneCis software – for seamless situational awareness in tactical environment and with long product life cycle.
- Cyber security – Showcasing latest progress within cyber security, including tempest computers, NIAP certified KVM switch, next-generation firewall (NGFW) in-vehicle deployment.
- Command post – Selection of MilDef’s portfolio of rugged mobile laptops & workstations.
- Solutions – Showcasing MilDef system integration in battle ready customer cases.
- Product stage experience – Demonstrations of a wide selection of the MilDef tactical product range.
“We have never presented such a strong line up of products and solutions at the AUSA show. It´s a perfect platform for MilDef to team up with key players that are devoted to build the future army, in the US, in coalition forces and NATO-markets. Our offering help accelerate the much-needed digitalization of battle-ready capabilities,” says Fredrik Persson, CTO/Deputy CEO MilDef.
Through long-term relationships and close customer interaction MilDef provides products, services and knowledge that turn into unique customer solution combinations that solves strategically important customer specific challanges. MilDef’s rugged military-off-the-shelf (MOTS) building blocks are used to forge reliable systems that will be supported over many years. The offering includes a wide selection of SWaP-C-optimized platforms including computer, display, network equipment and peripheral devices. The units can be delivered in a standardized form factor like the modular 19”/2 MOTS unit, or highly customized units specifically designed to customer specifications.
AUSA takes place Oct 14-16 Washington DC, Walter E. Washington Convention Center, booth 7941.
24 Sept 24. DARPA, DSTL and DRDC form US-UK-Canada AI collaboration.
The US, UK, and Canada have formed a collaboration of DARPA, DSTL and DRDC to reduce duplication of efforts in AI research.
Currently, the Five Eyes intelligence community consists of the UK, US, Canada, Australia and New Zealand. Credit: Vasin Lee / Shutterstock.
The UK Ministry of Defence (MoD), the US Defense Advanced Research Projects Agency (DARPA), and the Canadian Department of National Defence have formalised a trilateral collaboration to drive forward critical artificial intelligence (AI) and cybersecurity systems, the research outfits announced on 20 September 2024.
The MoD’s Defence Science and Technology Laboratory (Dstl) will lead the UK’s efforts, with Defence Research and Development Canada (DRDC) taking charge in Canada. According to the MoD, this agreement is pivotal for cementing the close ties among the nations and further integrating their research and development (R&D) efforts. The collaboration aims to reduce duplication of research by sharing key insights and technologies across borders.
In a recent statement, Dr Nick Joad, Director of Science and Technology at the UK Ministry of Defence, emphasised the importance of the partnership, stating the collaboration is “one of our most vital and enduring partnerships”. He added that advancing areas such as cybersecurity and AI is critical for maintaining national defence and ensuring security in an evolving global landscape.
Among the first projects under this initiative is the CASTLE (Cyber Agents for Security Testing and Learning Environments) programme, which focuses on using AI to defend against advanced cyber threats autonomously. AI-driven systems are increasingly essential to mitigating the surge in cyberattacks, particularly as malicious actors now leverage AI to launch more frequent and sophisticated attacks. DARPA notes that CASTLE is designed to enable AI to autonomously detect, classify, and respond to cyber threats, reducing reliance on human operators, who can no longer keep pace with the volume of threats.
The partnership will also address other areas of AI integration in defence. DARPA Director Stefanie Tompkins stressed the significance of trustworthy AI, citing the need to create resilient systems that can withstand attacks by skilled adversaries. Developing AI systems capable of rapid decision-making in battlefield scenarios while ensuring safety and trust is a central goal. She further noted that international collaboration is a “big step toward enhancing our understanding in the outlined research and development thrust areas” and is crucial for developing advanced technologies.
The GlobalData report on AI in defence supports this approach, highlighting the rapid growth in AI-related defence technologies. According to GlobalData, the AI market is expected to reach $908.7bn by 2030, driven by a 35.2% compound annual growth rate. AI is increasingly seen as a critical tool for modern warfare, automating key functions such as intelligence, surveillance, and reconnaissance (ISR), command and control, and simulation.
The report also points out that AI poses ethical and security challenges. It raises concerns about lethal autonomous weapons, which could be used to identify and eliminate threats without human intervention. Despite these concerns, the urgency of developing cutting-edge AI technologies is being felt globally, particularly given rising geopolitical tensions and the current war in Ukraine. As nations race to gain an advantage in AI development, the UK, US, and Canada are positioning themselves as leaders in this field.
Dr Paul Hollinshead, Chief Executive of Dstl, underscored the importance of leveraging this partnership to ensure the UK remains secure. “Together, we are driving value for money for our respective taxpayers while creating mission critical capabilities through science and technology, keeping our countries and our people safe,” Hollinshead said.
19 Sep 24. Indra and Thales Strengthen the Intelligence of the Army’s BMS.
- The Army has operated with the Battlefield Management System (BMS) developed by Indra and Thales since 2021 with excellent results
- The two companies will now endow it with greater processing capacity and an improved performance to operate in tactical environments in which increasingly intelligent platforms and systems are exchanging a growing volume of data to gain an advantage over the adversary
- Indra and Thales are also striving to lighten the system’s architecture so it can be installed on tablets, giving greater mobility to the units, which won’t have to depend solely on the system installed on board their vehicles
- The BMS system, which ensures maximum interoperability with allied armies and constitutes one of the most advanced solutions of its kind in the world, enables commanders to make the right decisions faster
Indra and Thales are strengthening the capacity of the Spanish Army’s BMS (Battlefield Management System) and preparing it to operate in highly digitalized scenarios in which its data exchange and degree of coordination are extremely high and key to gaining an advantage over the adversary.
The two companies will evolve the system, which they were tasked with developing. It went into operation in 2021. It’s become one of the most advanced of its kind and a benchmark for armies around the world.
The BMS enables commanders to oversee and issue orders in real time, helping them to rapidly make the right decisions, and provides units deployed in the field with a complete view of the mission on digital mapping, allowing them to exchange tactical information, images and text messages to enhance their coordination and boost their effectiveness.
Improved processing capacity and performance
The current aim of this evolution is to increase the system’s processing capacity and performance so that it can handle more information and provide the army with greater situational awareness and coordination, thereby adapting it to a context in which the volume of data exchanged by platforms and weapon systems is constantly growing.
Antonio Hernández Bejarano, Indra’s director of Business Development for Electronic Combat Management, explained that “the improvements will also enable us to exploit the capabilities of the new means of transmission, maximizing the available bandwidth while providing the ability, in a transparent manner, to dynamically adapt the information flows so as to work in contested environments in which the adversary attempts to prevent communications”.
Juan José Forteza, Thales Projects Director, emphasized that “the system has been designed to guarantee interoperability with other allied armies in alignment with NATO’s FMN (Federated Mission Networking) standards, which facilitate the integration of the different command and control networks of allied countries, a crucial factor within the current context”.
The two companies will also lighten the system’s architecture so that it can be installed on tablets, allowing it to comply with high mobility requirements. Another benefit to be added will be the integration of the BMS into SIGLE, the Army’s Logistics Management System, in order to reduce the workload associated with armored vehicle maintenance and improve the upkeep of vehicles and tanks throughout their life cycle, thereby increasing their availability and the safety of their crews.
The BMS system has performed excellently during real missions of the utmost complexity, including NATO’s Enhanced Forward Presence (EFP) Mission, in which the Spanish Army was deployed in Latvia with Pizarro infantry fighting vehicles and Leopard tanks, among other means equipped with the battlefield management system. (Source: ASD Network)
20 Sept. 24. Cyber Update Key points.
- A newly disclosed cyber operation has heightened the espionage risks stemming from the Chinese state-sponsored group ‘Earth Kasha’ (see Sibylline Cyber Daily Analytical Update – 16 September 2024).
- An attack chain exploited multiple zero-day vulnerabilities prior to its detection in June, raising financial risks stemming from the financially motivated group ‘Void Banshee’ (see Sibylline Cyber Daily Analytical Update – 17 September 2024).
- Ransomware groups’ shifting tactics towards double extortion attacks using cloud management services will increase the financial risks facing firms (see Sibylline Cyber Daily Analytical Update – 18 September 2024).
- A recent botnet takedown by the US authorities points to elevated security risks stemming from the Chinese state-sponsored group ‘Flax Typhoon’ (see Sibylline Cyber Daily Analytical Update – 19 September 2024 and our Technical analysis below).
- The likely resumption of operations by the cyber criminal group ‘TeamTNT’ will increase the financial risks facing global firms.
Technical analysis of weekly stories
The Chinese state-sponsored group Flax Typhoon has been infiltrating critical national infrastructure (CNI) in Taiwan and the US to develop a multi-tiered botnet (‘Raptor Train’) since at least 2020. US security agencies dismantled the botnet in mid-September. Flax Typhoon reportedly exploited several software vulnerabilities to gain access to targeted systems. Raptor Train is composed of three interconnected tiers, centrally operated by management nodes in the third tier. Conversely, the first tier primarily comprises Internet-of-Things (IoT) devices and small office/home office (SOHO) routers; it communicates with tier three via the command-and-control (C2) infrastructure hosted on tier two. Raptor Train enabled Flax Typhoon to re-route traffic and install malware on compromised systems. Namely, Flax Typhoon deployed the ‘Nosedive’ payload on some tier one devices, providing the group with the ability to disrupt compromised systems via distributed denial-of-service (DDoS) attacks. Although the group did not conduct any disruptive attacks prior to the botnet’s takedown, we assess that there is a realistic possibility that it developed the botnet to conduct future disruptive operations. Raptor Train compromised around 260,000 devices before the takedown, highlighting both the scale and high sophistication of this operation. Notably, the botnet regularly added new devices to tier one, underscoring the threat actors’ ability to exploit software vulnerabilities quickly in order to propagate the botnet. Additionally, the threat actors adopted several anti-forensics mechanisms which markedly prolonged detection evasion.
The cyber criminal group TeamTNT has likely been conducting operations in a series of highly sophisticated crypto jacking campaigns since 2023. The threat actors use brute force attacks against VPS cloud infrastructure as initial attack vectors to hijack vulnerable user accounts and to access targeted systems. They then deploy a malicious script to disable native security tools and erase activity history for detection evasion. They also simultaneously interrupt existing crypto mining processes before running their own crypto mining scripts. They also deploy a rootkit (‘Diamorphine’) to obtain full control of compromised systems and to execute further malicious activities. Notably, the threat actors conduct post-exploitation activities to ensure persistence on compromised systems and to hinder system recovery. This includes re-downloading a copy of the main script every 30 minutes and actively preventing system administrators from rebooting or modifying files on compromised systems. These system lockdown mechanisms underscore the high sophistication of the threat actors’ tactics, techniques and procedures (TTPs), particularly the group’s advanced detection-evasion and persistence capabilities. Additionally, the group installs a backdoor for continuous access to infected systems via secure shell (SSH).
Some non-exhaustive recommendations to mitigate against these threats include:
- Monitor devices and networks for suspicious activity.
- Add available Indicators-of-Compromise (IoCs) to your organisation’s security detection systems to detect potentially malicious samples on the network.
- Adopt behaviour-based end-point detection and response (EDR) solutions, prioritising the detection of the initial stages of a compromise.
- Ensure adequate security monitoring and detection capabilities, particularly for all external-facing services, devices and ports.
- Employ complex passwords for edge devices and staff accounts to mitigate against brute force and other password-focused cyber attacks.
Our cyber word(s) of the week: Internet-of-Things (IoT)
(Source: Sibylline)
23 Sep 24. Kromek selected for UK Government Radiological Nuclear Detection Framework. Kromek (AIM: KMK), a leading developer of radiation and bio-detection technology solutions for the advanced imaging and CBRN detection segments, ishas been selected as a supplier under the UK Government’s Radiological Nuclear Detection Framework (the “Framework”) for the procurement of radiological nuclear (“RN”) detection equipment and supporting services for the Home Office. The Framework was established to co-ordinate the RN detection procurement requirements and capabilities of the Home Office, Counter Terrorism Police and other public bodies to support Home Office strategic aims and to deliver enhancements to the UK’s end-to-end system for domestic nuclear security. Kromek applied for three of the four Framework categories, covering the supply of handheld, wearable and large volume static radiation detectors, and was successfully approved and awarded a Framework contract. Accordingly, Kromek is pre-qualified to be selected for orders in these categories, which over the four-year term of the Framework have a combined maximum procurement value of £84m. The Group will provide further updates as and when there is progress in respect of any contracts within these three Framework categories.
Arnab Basu, CEO of Kromek, said: “We are delighted to have become one of the few companies approved for the supply of radiological nuclear detection equipment under this important Home Office initiative. We have been providing our detectors to the UK government for several years and it is great to see the continued expansion of programmes that will enhance the UK’s protection against radiological threats. Alongside our recent selection under the UK Government Resilience Framework for supplying emergency services operators and our contract award from the Ministry of Defence, we are experiencing excellent momentum in this area of our business, and we look forward to reporting on further progress.”
—————————————————————————————————————————————————————————————————————————————————————————————————————————————
Spectra Group (UK) Ltd
Spectra Group (UK) Ltd, internationally renowned award-winning information security and communications specialist with a proven record of accomplishment.
Spectra is a dynamic, agile and security-accredited organisation that offers secure Hosted and Managed Solutions and Cyber Advisory Services with a track record of delivering on time, to spec and on budget.
With over 15 years of experience in delivering solutions for governments around the globe, elite militaries and private enterprises of all sizes, Spectra’s platinum and gold-level partnerships with third-party vendors ensure the supply of best value leading-edge technology.
Spectra was awarded the prestigious Queen’s Award for Enterprise (Innovation) in 2019 for SlingShot.
In November 2017, Spectra Group (UK) Ltd announced its listing as a Top 100 Government SME Supplier by the UK Crown Commercial Services.
Spectra’s CEO, Simon Davies, was awarded 2017 Businessman of the Year by Battlespace magazine.
Founded in 2002, the Company is based in Hereford, UK and holds ISO 9001:2015, ISO 27001:2013
———————————————————————————————————————————————————————————————————————————————————————————————————————————-