Think tank report labels NSO, Lazarus, as 'cyber mercenaries'
(2023/12/13)
- Reference: 1702447528
- News link: https://www.theregister.co.uk/2023/12/13/cyber_mercenary_orf_report/
- Source link:
Cybercrime gangs like the notorious Lazarus group and spyware vendors like Israel's NSO should be considered cyber mercenaries – and become the subject of a concerted international response – according to a Monday report from Delhi-based think tank Observer Research Foundation (ORF).
Author Fitri Bintang Timur [1]argued the term mercenary applies because, as amendments to the Geneva Convention put it, mercenaries are "an entity having the motivation to gain financial or material compensation in return for their willingness to fight for the recruiter's country."
The modern equivalent is those who carry out their operations using information technology and networks – hence the term cyber mercenaries. Such groups have been noted and studied by groups like Citizen Lab and Amnesty International since the early 2010s but are often considered mere criminals.
[2]
Timur argued that Lazarus Group earned the dubious title of cyber mercenary by working to develop and distribute malware on behalf of the North Korean government. She asserted that NSO Group joined the club by peddling its Pegasus spyware to governments willing to purchase and deploy it despite being a legitimate (if controversial) business. Other cyber mercenary operations offer hackers-for-hire.
[3]
[4]
The report asserted that the market for cyber mercenaries is growing, as it is useful for state actors to improve their offensive capabilities while maintaining "plausible deniability through the avoidance of identification."
[5]Spyware slinger QuaDream's reported demise may be the canary in the coal mine
[6]Indian politicians say Apple warned them of state-sponsored attacks
[7]Pegasus-pusher NSO gets new owner keen on the commercial spyware biz
[8]EU proposes spyware Tech Lab to keep Big Brother governments in check
Cyber mercenaries are also seen as cost effective. They don't require a human resource department, training, or other personnel costs. Nations that can’t afford an offensive cyber-ops crew may therefore hire cyber mercenaries to get into the game.
While some work has been done to curb such actors, Timur suggested more needs to done. She called for legislation that aligns the use of intelligence and digital forensic tools with human rights obligations.
She also states that standards must be set so that acts conducted in the name of national security also respect human rights declarations. Timur noted in her report that peaceful countries use legislative loopholes to "harbor cyber-mercenary subsidiaries and research centers" – an action that can turn sour, for instance when information is leaked or otherwise used for questionable purposes.
[9]
For example, in the case of NSO Group, the EU Commission chose not to interfere with individual member states' use of its notorious Pegasus malware as it was categorized as a "national security" tool. Yet the software was used to target government officials, journalists, businesspeople, activists, academics, and other targets that posed little plausible threat to safety – but may have been irritants to politicians.
The report concludes by calling for citizens to demand accountability from governments and businesses who engage cyber mercenaries. Timur noted that civil society groups have taken action through lawsuits to demand better transparency. ®
Get our [10]Tech Resources
[1] https://www.orfonline.org/research/cyber-mercenaries
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZXmO2fWVzjd5CE6IhsQ-HgAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZXmO2fWVzjd5CE6IhsQ-HgAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZXmO2fWVzjd5CE6IhsQ-HgAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2023/04/19/quadream_nso_spyware/
[6] https://www.theregister.com/2023/11/01/india_apple_state_attack_warnings/
[7] https://www.theregister.com/2023/05/30/nso_owner_hacking/
[8] https://www.theregister.com/2023/05/09/pega_commitee_report/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZXmO2fWVzjd5CE6IhsQ-HgAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
Author Fitri Bintang Timur [1]argued the term mercenary applies because, as amendments to the Geneva Convention put it, mercenaries are "an entity having the motivation to gain financial or material compensation in return for their willingness to fight for the recruiter's country."
The modern equivalent is those who carry out their operations using information technology and networks – hence the term cyber mercenaries. Such groups have been noted and studied by groups like Citizen Lab and Amnesty International since the early 2010s but are often considered mere criminals.
[2]
Timur argued that Lazarus Group earned the dubious title of cyber mercenary by working to develop and distribute malware on behalf of the North Korean government. She asserted that NSO Group joined the club by peddling its Pegasus spyware to governments willing to purchase and deploy it despite being a legitimate (if controversial) business. Other cyber mercenary operations offer hackers-for-hire.
[3]
[4]
The report asserted that the market for cyber mercenaries is growing, as it is useful for state actors to improve their offensive capabilities while maintaining "plausible deniability through the avoidance of identification."
[5]Spyware slinger QuaDream's reported demise may be the canary in the coal mine
[6]Indian politicians say Apple warned them of state-sponsored attacks
[7]Pegasus-pusher NSO gets new owner keen on the commercial spyware biz
[8]EU proposes spyware Tech Lab to keep Big Brother governments in check
Cyber mercenaries are also seen as cost effective. They don't require a human resource department, training, or other personnel costs. Nations that can’t afford an offensive cyber-ops crew may therefore hire cyber mercenaries to get into the game.
While some work has been done to curb such actors, Timur suggested more needs to done. She called for legislation that aligns the use of intelligence and digital forensic tools with human rights obligations.
She also states that standards must be set so that acts conducted in the name of national security also respect human rights declarations. Timur noted in her report that peaceful countries use legislative loopholes to "harbor cyber-mercenary subsidiaries and research centers" – an action that can turn sour, for instance when information is leaked or otherwise used for questionable purposes.
[9]
For example, in the case of NSO Group, the EU Commission chose not to interfere with individual member states' use of its notorious Pegasus malware as it was categorized as a "national security" tool. Yet the software was used to target government officials, journalists, businesspeople, activists, academics, and other targets that posed little plausible threat to safety – but may have been irritants to politicians.
The report concludes by calling for citizens to demand accountability from governments and businesses who engage cyber mercenaries. Timur noted that civil society groups have taken action through lawsuits to demand better transparency. ®
Get our [10]Tech Resources
[1] https://www.orfonline.org/research/cyber-mercenaries
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZXmO2fWVzjd5CE6IhsQ-HgAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZXmO2fWVzjd5CE6IhsQ-HgAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZXmO2fWVzjd5CE6IhsQ-HgAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2023/04/19/quadream_nso_spyware/
[6] https://www.theregister.com/2023/11/01/india_apple_state_attack_warnings/
[7] https://www.theregister.com/2023/05/30/nso_owner_hacking/
[8] https://www.theregister.com/2023/05/09/pega_commitee_report/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZXmO2fWVzjd5CE6IhsQ-HgAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
Jellied Eel
So the story is really about governmental abuse, but that's boring, so the Reg threw in NSO's name to generate some clicks.
Not really.. NSO is just one of the more notorious. Article makes some good points given the way infosec is increasingly being weaponised by both state and non-state actors. Some of the tech is covered by export controls, some isn't, but the problems seem more about the application. It seems much like regulation of PMCs, or espionage in general. Cyber attacks can be very damaging, but seem to exist in a bit of a grey area wrt international laws and the laws of war.
Cyber Wagner?
HuBo
Ah! Cyber-mercenarism does surely better explain the Lazarus Blacksmith's use of DLang (from Dec. 11 article) given North Korea's rather low apparent level of tech adoption (except for hypersonic missiles). It is particularly sad when compared to South Korea's many high-tech achievements and generally much more comfortable lifestyle. All this to desperately hang on to an obsolete political system where dictatorship of the proletariat has long ago degenerated into dictatorship of the life-long dictator.
In any instance, cyber mercenaries might want to insist on being paid in US dollars (like Javier Milei?).
So the story is really about governmental abuse, but that's boring, so the Reg threw in NSO's name to generate some clicks.