Internet Newcomers – Easy Malware Prey

This post is also available in: עברית (Hebrew)

Security researchers are increasingly seeing in countries outside the West to discover the newest, most creative and potentially most dangerous types of cyberattacks being deployed.

As developing economies rush to go online, they provide a fertile testing ground for hackers trying their skills in an environment in which they can evade detection before deploying them against a company or state that has more advanced defenses.

A recent cyberattack in India used malware that could learn as it was spreading, and altered its methods to stay in the system for as long as possible. Those were “early indicators” of A.I., according to the cybersecurity company Darktrace. The malware could figure out its surroundings and mimic the behavior of the system’s users, though Darktrace said the firm had found the program before it could do any damage.

“India is a place where newer A.I. attacks might be seen for the first time, simply because it is an ideal testing ground for those sorts of attacks,” Nicole Eagan, CEO Darktrace, told the New York Times. At times, these attacks are simply targeting more susceptible victims. While companies in the United States will often employ half a dozen security firms’ products as defensive measures, a similar company elsewhere may have just one line of defense — if any.

In the case of attacks carried out by a nation-state, companies in the United States can hope to receive a warning or assistance from the federal government, while companies elsewhere will often be left to fend for themselves. Cybersecurity experts now speculate that a February 2016 attack on the central bank of Bangladesh, believed to have been carried out by hackers linked to North Korea, was a precursor to similar attacks on banks in Vietnam and Ecuador.

The hackers managed to steal $81 million from the Bangladesh Bank. What interested cybersecurity experts was that attackers had taken advantage of a previously unexplored weakness in the bank’s computers by undermining its accounts on Swift, the international money transfer system that banks use to move billions of dollars among themselves each day. It was an unprecedented form of cyberattack. But since then, the cybersecurity firm Symantec has found the method used against banks in 31 countries.

“What was concerning was that this attack, once it got into the network, used A.I. techniques, like trying to learn the behaviors of employees on the network, to remain undetected for as long as possible,” Ms. Eagan said. She said she saw a future in which countries raced against one another to hire people skilled in developing complex algorithms that could be used to run such malware. Ms. Eagan’s company, which has headquarters in Cambridge, England, and San Francisco, has increasingly found hacking incidents in India since it expanded there.

As other cybersecurity companies enter Southeast Asia, Africa and other parts of the world where they have not had much presence, they will continue to discover new types of malware being tested in those markets, said Allan Liska, a senior threat intelligence analyst at Recorded Future, a cybersecurity firm based in Somerville, Mass. “For several years, Taiwan and South Korea have been proven testing grounds for some of the more advanced groups in China,” Mr. Liska said. “Those countries have high-speed internet, widespread internet penetration and not a lot of security infrastructure in place.” He added, “We see a pattern among the attackers. They test something, make improvements, and then six weeks later test again before launching it at their true targets.”

Countries across Southeast Asia and the Middle East that have come online over the last decade have been tempting targets for hackers, said Chris Rock, an Australian security researcher and CEO of the cybersecurity firm Kustodian. “They’re a testing ground for different kinds of environments,” he said. “For hackers, they can be low-hanging fruit.”

Doing tests in a country that presumably has fewer defenses is a double-edged sword, Mr. Rock said. On one hand, attackers can hone their skills. On the other hand, they risk being discovered. Once a cybersecurity firm has the signature of an attack, it can build defenses against it, and spread those defenses among its clients.