Canada Warns of Cyber Threats from the Islamic Republic, China, and Russia

The Communications Security Establishment of Canada, in its latest report, identified hackers affiliated with the governments of Iran, China, and Russia as cyber threats against Canada. The report, published on Wednesday, November 1, highlights China's covert activities under the guise of the 'Chinese Aggressive Hacking Campaign' as the most active state-sponsored cyber threat to Canada. In this new assessment, Iran's actions are referred to as 'a threat,' while Russia's cyber program is accused of 'attempting to destabilize and confront Canada and its allies.' The report describes the 'extensive and aggressive cyber program of the People's Republic of China' as 'the most complex and active state-sponsored cyber threat to Canada.' The organization mentioned activities such as 'espionage, intellectual property theft, malicious infiltration, and transnational repression' against 'high-level political and business entities' as 'targets of China's cyber actions.' Recently, several U.S. security agencies, along with Canada and Australia, also warned about the access of Islamic Republic cyber agents to critical infrastructure networks. In a joint advisory released on Wednesday, October 17, by three U.S. security agencies, including the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), and the Cybersecurity and Infrastructure Security Agency, along with several security agencies from Canada and Australia, the threat posed by Iranian cyber agents to several critical infrastructures was highlighted. These security agencies stated that Islamic Republic cyber attackers have targeted several critical infrastructure sectors, including health, government centers, information technology, engineering, and energy, exposing them to damage. They specified that attackers have attempted to guess common user passwords using methods such as 'brute force' attacks to decrypt sensitive data and 'password spraying' attacks. According to these security agencies from the U.S., Canada, and Australia, the next step for Iranian cyber attackers is to sell stolen information to cybercriminals for further sabotage. The advisory issued by the security agencies suggested strategies to counter the tactics of cyber attackers, including continuous monitoring and increased security accuracy of networks, educating users about cyber threats, and using strong passwords. The advisory warned network security defenders that the harmful actions of Iranian cyber attackers could lead to permanent damage to sensitive systems. Earlier, Microsoft released a report on digital threats on Tuesday, October 24. The report stated that the governments of Iran, Russia, and China increasingly rely on criminal networks to conduct cyber espionage and hacking operations against the United States and other countries. According to the Associated Press, the growing collaboration between authoritarian governments and cybercriminals has raised concerns among national security officials and cybersecurity experts. They noted that this indicates increasingly blurred lines between the actions of Beijing or the Kremlin aimed at undermining rivals and the illegal activities of groups that are typically more interested in financial gain. For example, Microsoft analysts found that a criminal hacker group with ties to Iran attempted to sell hacked personal information by infiltrating an Israeli dating site or extorting money through it. Microsoft concluded that the hackers had two objectives: to embarrass the Israelis and to make money. In another instance, investigators identified a Russian criminal network that infiltrated more than 50 electronic devices of the Ukrainian army in July 2023, apparently seeking access to information that could assist Russia's attack on Ukraine, but regardless of any payments that may have been made by Russia, there was no clear financial motive for this group. The Associated Press described this situation as a kind of 'marriage of convenience with benefits for both parties.' The governments of Russia, China, Iran, and North Korea can increase the impact of their cyber activities without additional costs, and criminals also receive new ways to gain more profit and promises of support from governments. Tom Burt, Microsoft's vice president of security and customer trust, said, 'We are witnessing this trend toward the merging of nation-state and criminal activities in each of these countries.' He emphasized that while there is still no evidence that Russia, China, and Iran share their resources or work with common criminal networks, the increasing use of private 'mercenary' hackers indicates how far America's enemies will go in weaponizing the internet. According to Microsoft's assessment of security threats from July 2023 to June 2024, Russia has focused most of its cyber operations on Ukraine, attempting to infiltrate military and government systems and spreading misinformation to undermine support for Ukraine's allies in the war against Russia, while Ukraine has responded with its own cyber efforts, including taking some Russian media offline last week. Networks associated with Russia, China, and Iran have also targeted American voters by using fake websites and social media accounts to spread misleading information about the 2024 elections. Russia targets Kamala Harris's campaign headquarters while Iran attempts to counter Donald Trump, the Republican candidate. U.S. federal officials also accuse the Iranian government of secretly supporting protests in the U.S. against the war in Gaza. Burt believes that Russia and Iran will increase the pace of cyber operations targeting the United States as the election day approaches. Meanwhile, China has focused on electoral competitions for Congress or state and local offices, and according to Microsoft's findings, networks associated with Beijing continue to target Taiwan and other countries in the region. A spokesperson for the Chinese Embassy in Washington dismissed the allegations of China's partnership with cybercriminals as baseless and accused the United States of spreading 'misinformation about so-called Chinese hacking threats.' The governments of Russia and Iran also denied allegations of using cyber operations to target American citizens. Recently, U.S. federal officials announced plans to seize hundreds of domain names used by Russia for cybercriminal operations and hacking, but the Atlantic Digital Forensics Laboratory found that these domains can be easily and quickly replaced. For example, researchers at this laboratory noticed 12 websites created to replace several domains seized by the Department of Justice just one day after the seizure, and they are still operational after a month.