From CUBA to Sudan – Threat to Sweden Security
Adding to the confusion is the involvement of a group known as Killnet, which has been linked to some attacks. Meanwhile, questions are being raised about the motives behind the attacks. Were they in response to Sweden’s application for NATO alliance, or were they related to the burning of a Quran by a far-right extremist in Sweden?
Several Swedish organisations have been targeted in these attacks, including those with servers hosted in IBM Cloud. Furthermore, an attack on Denmark was reportedly stopped in its initial phase, but the details surrounding this event are unclear.
As Sweden tries to grapple with this new threat, it is essential to understand the motivations and techniques of these cyber attackers. This blog post will explore the recent attacks and attempt to illuminate the ongoing situation. We will also look at the impact of these attacks on Sweden’s security posture and what can be done to prevent further incidents.
The Growing Threat of Cyberattacks in Sweden: A Overview
As cyberattacks become more sophisticated and frequent, Sweden is increasingly becoming a target. The recent attacks by the CUBA organisation, allegedly Russian e-criminals targeting Swedish national institutes, have raised concerns about the level of cyber threat the country faces. Additionally, the Anonymous Sudan group claiming to be politically motivated hackers from Sudan, have been conducting denial of service (DDoS) attacks against multiple organisations in Sweden. Complicating matters further, the situation is made more unclear by the claim that the Anonymous group has cancelled the activities of the Anonymous Sudan group, leading to questions about who is behind the attacks.
Further investigation has revealed that Killnet is believed to be behind some of the recent attacks in Sweden. The attack on Denmark was stopped in its initial phase, but the servers hosted in IBM Cloud believed to belong to Killnet, continue to threaten Sweden’s security. With such a range of actors and motivations, it is becoming increasingly difficult to determine who is behind these attacks and their ultimate goal.
Given the growing threat of cyberattacks in Sweden, organisations must remain vigilant and take steps to protect themselves. This includes implementing strong cybersecurity measures and continuously monitoring for potential threats. It also means working with law enforcement and other organisations to share information and coordinate attack responses. As the threat landscape continues to evolve, organisations in Sweden must take proactive steps to protect themselves and their sensitive data.
Anonymus Sudan Attacks
Scandinavian Airlines (SAS) recently experienced a security breach where its website was taken down by a group calling themselves Anonymous Sudan. During the attack, customers who attempted to log into the airline’s app were redirected and shown information from other passengers’ accounts. The incident happened shortly after a far-right politician burned a Quran near the Turkish embassy in Stockholm during a protest in January, an event a former contributor funded to the Russian state-funded outlet RT. In response to the book burning, Anonymous Sudan claimed to have carried out several denial-of-service attacks against various organisations in Sweden.
These alleged attacks have targeted Swedish airports, banks, railways, airlines, media, telecommunication providers, and organisations in the country’s health and education sectors. While these attempts did not cause significant downtime, Anonymous Sudan also claimed responsibility for knocking Sweden’s national broadcaster SVT offline around the same time as the attack on SAS.
Some experts, including Marcus Murray, founder of the Swedish cybersecurity firm Trusec, have cautioned that Anonymous Sudan could be a front for Russian operators. They suggest that the Quran burning may have presented an opportunity for Moscow to instigate tension between Sweden and Turkey in an attempt to derail Sweden’s bid to join NATO. Telegram chats revealed that at least one pro-Russian hacker group, UserSec, had pledged support for Anonymous Sudan.
Who are “Killnet”?
A rag-tag group of Russian hacktivists are using cyberattacks and defamation campaigns to target European governments, infrastructure, and even the prestigious Eurovision song contest to discourage support for Ukraine in the conflict.
Last summer, the pro-Kremlin hacking group known as Killnet unleashed a flurry of attacks against vital Western government networks and infrastructure, noisily proclaiming triumphs on social media and in Russian media while generating problems for Russia’s rivals’ security agencies.
Killnet significantly varies from the highly experienced hackers employed by Russia’s intelligence agencies, such as Fancy Bear and Sandworm, who achieved notoriety for their hacking of the American Democratic National Committee and the release of the deadly ransomware known as NotPetya, respectively. On the other hand, Killnet is more akin to a furious, nationalist online mob outfitted with subpar cyber-offensive means and strategies. It is incredibly effective at creating a narrative about the war.
DDoS Attacks
The gang gained notoriety for conducting distributed denial-of-service (DDoS) assaults and “defacing” websites by posting statements in favour of Russia on websites they hacked. It first surfaced as a hacker-for-hire provider in January. Still, the group rapidly became very loud in support of Russia’s invasion when tanks from that country entered Ukraine at the end of February.
It targeted more than ten Western nations in the previous year, including Estonia, most recently. In May, the group launched one of its more well-known attacks: a criticism of the Eurovision song contest. Due to Russia’s exclusion from the competition, the cyber collective tried a DDoS attack. Italy’s authorities stopped the attack only after the Senate and National Health Institute websites were attacked in retaliation.
Following Vilnius’ blockage of cargo to the Russian region of Kaliningrad in June of last year, KillNet’s targeting of Lithuania boosted it in the Russian media. Margiris Abukeviius, the nation’s Vice Minister of National Defense, claimed that the operation ultimately had “minimal success” because few websites were taken down, but the publicity it received was enormous. The organisation threatened to continue attacks unless Lithuania permitted the transportation of commodities to Kaliningrad in a video message that was widely shared online.
The Importance of Public Awareness and Education in Strengthening Sweden’s Cybersecurity
As cyber threats continue to grow in Sweden, public awareness and education have become increasingly crucial in strengthening the country’s cybersecurity. Recent incidents, such as the hacking of Scandinavian Airlines (SAS) by Anonymous Sudan, have highlighted the need for individuals and organisations to understand better the risks they face and take steps to protect themselves.
This includes using strong passwords, keeping software and systems up-to-date, and being cautious of suspicious emails or websites. Additionally, organisations can benefit from providing cybersecurity training to their employees and implementing security protocols and procedures to safeguard their systems and data.
Furthermore, raising public awareness about cyber threats can also help promote a cybersecurity culture and encourage individuals to take steps to protect themselves. This can involve educating individuals about cyber threats, the importance of regular software updates, and the risks associated with using unsecured networks or sharing personal information online.
As cyber threats evolve and become more sophisticated, Sweden must prioritise public awareness and education to strengthen its cybersecurity defences and protect against potential attacks.
Looking Ahead: What Does the Future Hold for Sweden’s Cybersecurity?
As Sweden looks ahead, it must improve its cybersecurity infrastructure and stay ahead of emerging threats. This may include investing in new technologies like AI and machine learning to enhance threat detection and response capabilities. It will also require collaboration between government agencies, businesses, and cybersecurity experts to share information and best practices.
Public awareness and education will also be critical in strengthening Sweden’s cybersecurity. By educating individuals on safe online practices and raising awareness of cyber threats, the country can better prepare its citizens to protect themselves and their data. This can include everything from promoting strong password hygiene to training employees to recognise and respond to phishing attempts.
As the cyber landscape evolves, Sweden must stay vigilant and proactive in protecting its critical infrastructure and sensitive information. Sweden can build a more resilient and secure digital future by taking a multi-faceted approach to cybersecurity.
Russian Hacking Group Claims Responsibility for Cyberattacks on Danish Websites
In January, a Russian hacking group claimed responsibility for a series of cyberattacks on the websites of the Danish central bank, seven private lenders, and the Danish Finance Ministry’s website. The group, NoName057, stated that the attacks responded to Denmark’s support for Ukraine in its ongoing conflict with Russia. The attacks targeted Danske Bank, Jyske Bank, Sydbank, Sparekassen Sjælland-Fyn, Bankinvest, Arbejdernes Landsbank, and Handelsbanken.
The attacks occurred over three days and resulted in either complete or partial inaccessibility to the banks’ websites. The group also claimed responsibility for an attack on Denmark’s National Bank. However, it was not publicised through its official channels as it did not significantly disrupt the global operations of the website.
Danish cyber security experts suspected the involvement of the Killnet hacking group in the attacks, as Killnet is a loosely affiliated group of volunteer hackers that has launched attacks against various organisations in Ukraine and countries that have sided with Ukraine since February.
The attacks on Denmark’s critical infrastructure demonstrate the vulnerability of countries to cyberattacks and the need for strong cybersecurity measures. It also highlights the importance of identifying and tracking hacking groups and international cooperation in preventing and responding to such attacks.
