1 00:00:00,000 --> 00:00:01,800 In this lesson, we are going to focus 2 00:00:01,800 --> 00:00:04,650 on one of the most sophisticated types of threat actors, 3 00:00:04,650 --> 00:00:07,110 that being nation-state actors. 4 00:00:07,110 --> 00:00:09,660 Nation-state actors are groups or individuals 5 00:00:09,660 --> 00:00:11,160 that are sponsored by a government 6 00:00:11,160 --> 00:00:13,110 to conduct cyber operations 7 00:00:13,110 --> 00:00:16,680 against other nations, organizations, or individuals. 8 00:00:16,680 --> 00:00:19,380 These nation state actors are usually a part 9 00:00:19,380 --> 00:00:22,620 of a nation's intelligence or military organizations, 10 00:00:22,620 --> 00:00:24,120 although they may also operate 11 00:00:24,120 --> 00:00:27,210 as independent entities with state-backed resources 12 00:00:27,210 --> 00:00:30,180 so that the country can maintain plausible deniability 13 00:00:30,180 --> 00:00:31,590 for their attacks. 14 00:00:31,590 --> 00:00:33,450 Sometimes, these threat actors 15 00:00:33,450 --> 00:00:36,540 attempt what is known as a false flag attack. 16 00:00:36,540 --> 00:00:38,370 False flag attack refers to an attack 17 00:00:38,370 --> 00:00:40,500 that is orchestrated in such a way 18 00:00:40,500 --> 00:00:43,380 that it appears to originate from a different source 19 00:00:43,380 --> 00:00:45,870 or group than the actual perpetrators, 20 00:00:45,870 --> 00:00:48,330 with the intent to mislead investigators 21 00:00:48,330 --> 00:00:50,610 and attribute the attack to someone else. 22 00:00:50,610 --> 00:00:53,100 For example, one suspected false flag attack 23 00:00:53,100 --> 00:00:55,140 occurred during a malware attack 24 00:00:55,140 --> 00:00:57,570 focused on the 2016 Winter Olympics 25 00:00:57,570 --> 00:00:59,880 that were being held in South Korea. 26 00:00:59,880 --> 00:01:01,920 Initially, indicators seemed to point 27 00:01:01,920 --> 00:01:04,470 towards the North Korean nation-state actors 28 00:01:04,470 --> 00:01:05,820 as being the culprits, 29 00:01:05,820 --> 00:01:08,160 and this assumption was highly probable, 30 00:01:08,160 --> 00:01:10,530 given the historical tension between North Korea 31 00:01:10,530 --> 00:01:13,620 and South Korea over the past 70 years. 32 00:01:13,620 --> 00:01:16,350 During the investigator's initial triage analysis, 33 00:01:16,350 --> 00:01:17,670 they saw that the malware 34 00:01:17,670 --> 00:01:19,980 resembled pieces of previous malware 35 00:01:19,980 --> 00:01:22,920 used by North Korean nation-state actors. 36 00:01:22,920 --> 00:01:26,130 But as the cybersecurity investigators and researchers 37 00:01:26,130 --> 00:01:28,350 dug further into the malware's code, 38 00:01:28,350 --> 00:01:30,810 they discovered some subtle clues that pointed 39 00:01:30,810 --> 00:01:34,080 to the real source of the attack, Russian threat actors 40 00:01:34,080 --> 00:01:36,600 who were attempting to disguise their operations 41 00:01:36,600 --> 00:01:40,530 by mimicking known North Korean state actors' techniques. 42 00:01:40,530 --> 00:01:42,750 This made the attribution especially challenging 43 00:01:42,750 --> 00:01:45,210 for investigators, but it showcases the lengths 44 00:01:45,210 --> 00:01:47,250 that these nation state actors will go 45 00:01:47,250 --> 00:01:49,590 in order to achieve their objectives. 46 00:01:49,590 --> 00:01:51,300 You'll find that nation state actors 47 00:01:51,300 --> 00:01:53,190 are some of the most highly sophisticated 48 00:01:53,190 --> 00:01:55,260 and highly capable threat actors 49 00:01:55,260 --> 00:01:57,960 that you will face as a cybersecurity professional. 50 00:01:57,960 --> 00:02:01,440 Nation-state actors possess advanced technical skills 51 00:02:01,440 --> 00:02:04,140 and extensive resources, and they are capable 52 00:02:04,140 --> 00:02:07,470 of conducting complex, coordinated cyber operations 53 00:02:07,470 --> 00:02:09,600 that employ a variety of techniques, 54 00:02:09,600 --> 00:02:12,840 such as creating custom malware, using zero-day exploits, 55 00:02:12,840 --> 00:02:15,063 and becoming an advanced persistent threat. 56 00:02:15,930 --> 00:02:18,300 An advanced persistent threat, or APT, 57 00:02:18,300 --> 00:02:20,850 is a term that used to be used synonymously 58 00:02:20,850 --> 00:02:22,320 with a nation-state actor 59 00:02:22,320 --> 00:02:25,020 because of their long-term persistence and stealth. 60 00:02:25,020 --> 00:02:27,270 These days, though, organized cybercrime groups 61 00:02:27,270 --> 00:02:29,790 are also sometimes referred to as an APT 62 00:02:29,790 --> 00:02:31,860 due to their high levels of sophistication 63 00:02:31,860 --> 00:02:33,870 and technical capabilities. 64 00:02:33,870 --> 00:02:36,090 Whenever you hear the term advanced persistent threat, 65 00:02:36,090 --> 00:02:38,880 I want you to remember that advanced persistent threat 66 00:02:38,880 --> 00:02:41,550 is a prolonged and targeted cyberattack 67 00:02:41,550 --> 00:02:45,150 in which an intruder gains unauthorized access to a network 68 00:02:45,150 --> 00:02:48,930 and remains undetected for an extended period of time 69 00:02:48,930 --> 00:02:52,470 while trying to steal data or monitor network activities 70 00:02:52,470 --> 00:02:54,660 rather than cause immediate damage. 71 00:02:54,660 --> 00:02:56,130 These advanced persistent threats 72 00:02:56,130 --> 00:02:59,040 are often sponsored by a nation state or its proxies, 73 00:02:59,040 --> 00:03:00,840 like organized cybercrime groups. 74 00:03:00,840 --> 00:03:02,820 For this reason, nation-state actors 75 00:03:02,820 --> 00:03:04,350 and advanced persistent threats 76 00:03:04,350 --> 00:03:06,510 are one of the most dangerous threat actors 77 00:03:06,510 --> 00:03:09,990 that we face out there, because of the amount of resources 78 00:03:09,990 --> 00:03:12,600 and funding available to them. 79 00:03:12,600 --> 00:03:15,390 So what motivates a nation-state actor? 80 00:03:15,390 --> 00:03:17,850 Simply put, nation-state actors are motivated 81 00:03:17,850 --> 00:03:20,430 to achieve their long-term strategic goals. 82 00:03:20,430 --> 00:03:22,290 They're not seeking financial gain. 83 00:03:22,290 --> 00:03:24,990 Instead, these groups are funded by their governments 84 00:03:24,990 --> 00:03:28,110 to conduct cyber operations that can help their governments 85 00:03:28,110 --> 00:03:30,150 to achieve political objectives, 86 00:03:30,150 --> 00:03:31,890 such as gathering intelligence, 87 00:03:31,890 --> 00:03:33,900 disrupting critical infrastructure, 88 00:03:33,900 --> 00:03:36,690 and influencing their political processes. 89 00:03:36,690 --> 00:03:40,260 These nation state actors may also engage in cyber espionage 90 00:03:40,260 --> 00:03:42,180 to steal intellectual property 91 00:03:42,180 --> 00:03:45,420 or gain a competitive advantage in key industries. 92 00:03:45,420 --> 00:03:47,430 Most nation-state actors are not focused 93 00:03:47,430 --> 00:03:49,350 on the financial gain, with the exception 94 00:03:49,350 --> 00:03:52,050 of the Democratic People's Republic of Korea, 95 00:03:52,050 --> 00:03:55,020 or more commonly referred to simply as North Korea. 96 00:03:55,020 --> 00:03:57,780 Due to North Korea's isolated economic position 97 00:03:57,780 --> 00:03:59,400 and the sanctions imposed on it 98 00:03:59,400 --> 00:04:01,290 from numerous countries around the world, 99 00:04:01,290 --> 00:04:03,480 North Korea state actors have been charged 100 00:04:03,480 --> 00:04:05,250 with conducting cyber operations 101 00:04:05,250 --> 00:04:07,650 to gain additional financial resources 102 00:04:07,650 --> 00:04:09,810 to support the Kim regime. 103 00:04:09,810 --> 00:04:12,750 North Korean cyberattacks often target banks, 104 00:04:12,750 --> 00:04:15,990 cryptocurrency exchanges, and other financial institutions 105 00:04:15,990 --> 00:04:18,120 to alleviate economic pressure 106 00:04:18,120 --> 00:04:20,940 and fund their other state objectives. 107 00:04:20,940 --> 00:04:23,520 Another example of a very well-known nation-state attack 108 00:04:23,520 --> 00:04:27,030 was conducted back in 2011 with the Stuxnet worm. 109 00:04:27,030 --> 00:04:29,460 The Stuxnet worm creation has been attributed 110 00:04:29,460 --> 00:04:31,500 to the American and Israeli governments 111 00:04:31,500 --> 00:04:33,630 by cybersecurity researchers. 112 00:04:33,630 --> 00:04:35,970 This worm is a sophisticated piece of malware 113 00:04:35,970 --> 00:04:37,590 that was designed to sabotage 114 00:04:37,590 --> 00:04:40,200 the Iranian government nuclear program 115 00:04:40,200 --> 00:04:43,080 by causing physical damage to the centrifuges 116 00:04:43,080 --> 00:04:46,170 used in their uranium enrichment process. 117 00:04:46,170 --> 00:04:47,381 The Stuxnet worm operated 118 00:04:47,381 --> 00:04:49,470 by exploiting zero-day vulnerabilities 119 00:04:49,470 --> 00:04:51,630 in the Windows operating system 120 00:04:51,630 --> 00:04:54,810 that was used to run the nuclear enrichment centrifuges, 121 00:04:54,810 --> 00:04:56,460 and the worm was able to spread 122 00:04:56,460 --> 00:04:58,590 between machines without detection. 123 00:04:58,590 --> 00:05:01,710 Remarkably, the designers of Stuxnet knew 124 00:05:01,710 --> 00:05:05,130 that the nuclear centrifuges were part of an air gap network 125 00:05:05,130 --> 00:05:06,600 to increase its security, 126 00:05:06,600 --> 00:05:08,940 so all of the sensitive systems were isolated 127 00:05:08,940 --> 00:05:10,500 from unsecured networks, 128 00:05:10,500 --> 00:05:13,830 but Stuxnet was designed to infect USB drives, 129 00:05:13,830 --> 00:05:16,650 with the hopes that an employee at the enrichment facility 130 00:05:16,650 --> 00:05:18,540 would unknowingly transfer the worm 131 00:05:18,540 --> 00:05:20,250 into the secure network environment 132 00:05:20,250 --> 00:05:23,070 by connecting the USB drive to the system 133 00:05:23,070 --> 00:05:25,440 to compromise it from within. 134 00:05:25,440 --> 00:05:27,810 But even technologically sophisticated countries, 135 00:05:27,810 --> 00:05:28,980 like the United States, 136 00:05:28,980 --> 00:05:31,440 aren't immune to nation-state attackers. 137 00:05:31,440 --> 00:05:34,110 You may already be aware that there was a lot of debate 138 00:05:34,110 --> 00:05:38,040 over the highly contested 2016 US presidential election 139 00:05:38,040 --> 00:05:40,710 between Donald Trump and Hillary Clinton. 140 00:05:40,710 --> 00:05:43,530 Accounting to independent cybersecurity researchers, 141 00:05:43,530 --> 00:05:46,050 it is suspected that the Russian government 142 00:05:46,050 --> 00:05:48,270 used a wide range of cyber attacks 143 00:05:48,270 --> 00:05:50,730 from across its various nation-state actors 144 00:05:50,730 --> 00:05:53,400 to influence this presidential election. 145 00:05:53,400 --> 00:05:56,220 According to the US government's intelligence community, 146 00:05:56,220 --> 00:05:59,460 a series of cyberattacks and disinformation campaigns 147 00:05:59,460 --> 00:06:02,010 during the election period can be attributed back 148 00:06:02,010 --> 00:06:05,550 to Russian nation-state actors, whose goal was to undermine 149 00:06:05,550 --> 00:06:08,730 the United States' democratic electoral process, 150 00:06:08,730 --> 00:06:10,710 damage Hillary Clinton's candidacy, 151 00:06:10,710 --> 00:06:12,930 and eventually support Donald Trump's campaign 152 00:06:12,930 --> 00:06:14,910 to gain the presidency. 153 00:06:14,910 --> 00:06:18,120 So remember, a nation-state actor is a group or individual 154 00:06:18,120 --> 00:06:19,560 that is sponsored by a government 155 00:06:19,560 --> 00:06:21,330 to conduct cyber operations 156 00:06:21,330 --> 00:06:24,900 against other nations, organizations, or individuals. 157 00:06:24,900 --> 00:06:28,350 Sometimes, they may also operate as independent entities 158 00:06:28,350 --> 00:06:29,940 with state-backed resources 159 00:06:29,940 --> 00:06:32,880 so the country can maintain plausible deniability 160 00:06:32,880 --> 00:06:35,953 for their attacks when conducting a false flag attack. 161 00:06:35,953 --> 00:06:38,040 A false flag attack refers to an attack 162 00:06:38,040 --> 00:06:40,710 that is orchestrated in such a way that it appears 163 00:06:40,710 --> 00:06:43,230 to originate from a different source or group 164 00:06:43,230 --> 00:06:44,970 than the actual perpetrators, 165 00:06:44,970 --> 00:06:47,580 with the intent to mislead investigators 166 00:06:47,580 --> 00:06:49,920 and attribute the attack to someone else. 167 00:06:49,920 --> 00:06:52,426 These nation-state actors represent the significant 168 00:06:52,426 --> 00:06:54,540 and sophisticated cyber threat 169 00:06:54,540 --> 00:06:57,600 that underscores the increasing use of cyberspace 170 00:06:57,600 --> 00:07:01,533 as a battleground for a nation's geopolitical conflicts.