CyberWire Daily at 10: A decade of emerging threat actors and APTs. [Special Edition]

The discussion highlights a major shift over the past decade regarding attribution practices in cybersecurity. Ten years ago, public attribution to nation-states was rare and considered somewhat risky, but now it has become common and routine. This change is attributed to improved intelligence sharing between governments and the private sector, as well as increased confidence in attribution capabilities. The conversation also touches on how attribution has become a tool for marketing and branding by cybersecurity vendors, with named threat groups like Fancy Bear becoming recognizable 'brands.' The tendency to assign catchy, sometimes humorous names helps in communication but also reflects the organizational and branding aspects of threat intelligence.

The hosts observe that threat actors, especially nation-states and organized cybercrime groups, have become more professional, disciplined, and organized — functioning much like businesses with marketing teams, dedicated coders, and organizational structures. This professionalism has led to a more strategic and less tactical approach, with attacks often part of broader geopolitical and economic goals. Discussions include the rise of ransomware and its link to traditional espionage tools, the blurring of lines between espionage and financially motivated attacks, and how threat groups have adapted to technological advancements, including AI. The evolution signifies a move towards sustained, organized cyber operations that mimic legitimate industries.

The conversation explores the geopolitical implications of cyber threats, including the reluctance of nations to establish clear red lines against cyberattacks, especially on critical infrastructure like hospitals. The hosts speculate about the reasons behind this ambiguity, such as strategic advantages and the desire for offensive capabilities. They discuss how 'cyber Pearl Harbors' or similar catastrophic events might reshape norms, but there's skepticism about how soon this will happen. Emphasis is placed on the ongoing 'cat and mouse' game of cybersecurity, with advancements in AI and technology promising to accelerate offensive and defensive capabilities. The overall tone suggests that the nature of cyber conflict will continue to evolve in complexity and scale, with no clear end in sight.

The hosts discuss the prominent threat groups of the past decade, such as Fancy Bear and the Shadow Brokers, noting their importance and impact on cybersecurity awareness. They lament the chaos caused by the inconsistent naming conventions across different organizations and vendors, which hampers clear communication and coordination. The idea of establishing a universal naming standard is proposed, but practically difficult due to commercial interests and marketing strategies. Names are often chosen to be memorable or humorous, which adds to the confusion but also helps in media and public discussions. The discussion underscores the ongoing challenge of naming and tracking threat groups coherently.

Looking ahead, the hosts agree that advanced persistent threats will continue to evolve with technology, especially AI, which will increase the velocity and sophistication of attacks. They anticipate that threat actors will remain organized and professional, leveraging new tools and tactics for geopolitical and profit-driven motives. The ongoing strategic ambiguity among nations and the inclusion of various state and non-state actors suggest that the landscape will become more complex. Both hosts see this as an ongoing cycle of adaptation, with defenders working to improve visibility, collaboration, and resilience, but ultimately the contest will remain unresolved for the foreseeable future.