Lithuania’s cyber chief unimpressed: attacks against NATO were PR stunts

Cybercriminals had promised to fight against the “doomsday clock” of world catastrophe, yet the NATO summit in Lithuania was uneventful from a cybersecurity standpoint, the country’s cybersecurity chief concludes. Moscow’s cyber puppets were motivated by making noise and feeding the propaganda machine.

Threat actors during the NATO event were loud in promoting their achievements, as a few local websites or apps briefly went down. Telegram channels were filled with joy. “Expect us,” they tweeted even before the event.

Cybernews also received self-praising emails. “We can no longer watch as the US and NATO lead society into World War III. The Doomsday Clock is already too close to midnight. The US and its satellites are recklessly pushing the world toward catastrophe. We are here to stop it!”.

While beneficial to Russian propaganda at home, not a single incident in the critical infrastructure took place, Lithuania's national cybersecurity center (NKSC) head Liudas Alisauskas noted.

“I would say it was pretty boring. We were hoping for some more action. We were preparing for bigger things,” Alisauskas stated.

Internet service providers did not report any anomalies to NKSC either, indicating that network traffic was not abnormal.

According to him, the news about numerous websites taken down was blown out of proportion. But there’s a lesson to be learned.

“Cybercriminals chose easy targets, the small services they could manage to disrupt, even if that had no real-life impact. The main goal was to receive praise, bonuses from their audience, or maybe to be loud to receive a payment.”

According to him, adversaries targeted organizations that did not have even the simplest anti-DDoS attack solutions in place. DDoS (Distributed Denial of Service) attacks rarely cause long-term damage as the physical infrastructure is unaffected and are regarded within the cyber community as more of a short-term nuisance. Those could have been avoided if organizations had done their homework.

“If you leave your single IP known publicly and accessible from all over the world, what would you expect? Cybercriminals are not stupid; they don’t try to break strong security measures. A common myth is that anti-DDoS services are expensive. They are not. Small organizations can even get free-tier services,” Alisauskas said.

Kremlin-orchestrated cyber attackers also tried to penetrate critical infrastructure in Lithuania, where the NATO summit occurred. However, electric networks, air traffic control, and other vital functions stood resilient.

“There were attempts that did not develop into any incident. The events like network scanning, surveillance, and testing were tried but ended in a snarl.”

Critical infrastructure is protected according to technical requirements based on ISO 27001 standards. Alisauskas believes that even small organizations should check those requirements, as it is easy to put some protections in place.

“In cyber defense, the same principle applies to driving a car. When you launch a website or system, you ensure all the wheels are tightened. If this is not the case, you can expect an incident.”

“DDoS attacks are a daily activity. There’s not a single day without them. Not all are reported, but those during such an event are more noticeable. However, DDoS attacks often start and end often without any effect,” he added.