third Cyber Security Assessment Netherlands - NCSC

magnitude of digital espionage incidents, the number of incidents
in the Netherlands is suspected to be significantly higher.
China
Globally various large-scale attacks targeted among other things
at governments institutions, dissident organisations, NGOs,
knowledge institutions and companies in a range of sectors have
been recognised. There are indications that in China, various actors
such as the army, hackers’ groups, educational institutions, plus
intelligence and security services are related to these attacks. The
aim of these attacks is to obtain relevant military and economic
information. Last year, various attacks on companies, dissident
organisations, government and knowledge institutions were
confirmed in the Netherlands, with characteristics all pointing
to a Chinese actor.
The AIVD is investigating a large-scale digital attack against a sector
that develops sophisticated technological applications for economic
and military purposes. Companies in this sector in Europe,
America and Asia have been the target of this attack. At various
companies in different countries the attacker successfully gained
access to a business network. These business networks were
examined for a long time without anyone noticing and the attacker
was able to get hold of large volumes of highly specialist confidential
information.
In addition to companies, Dutch public authorities, NGOs based
in the Netherlands and inter-governmental organisations have also
been the target of digital attacks originating from China. Research
by the AIVD into a large-scale international digital attack targeted
at various inter-governmental organisations revealed that these
attacks were carried out by sending e-mails with malware to
employees of these organisations. To increase the chance of the
e-mails being opened by the person they were addressed to, they
were sent from fake e-mail addresses that looked like addresses
from trusted (government) institutions connected to the organisations
concerned. The subject and attachments to these e-mails
appeared authentic and related to the employees’ concerned
current topics and activities.
Although there is no conclusive evidence for this, the scope,
duration, choice of target and professional set up of the above
attacks suggest an attack initiated or sponsored by a government.
Given the use of Chinese domain names and IP addresses and
the Chinese time and language settings found in the malware it
is probable that the attacker originates from China or wants to
suggest this.
The AIVD and MIVD currently estimate China to have large cyber
capacity. Although actors from China often use relatively simple
digital espionage methods, the attacks on the aforementioned
(Dutch) targets were on such a large scale, structured and tenacious
in nature that there is now a permanent high risk. Chinese actors
also use the Dutch IT infrastructure for digital espionage on other
countries. Given the increase in the number of Chinese actors
linked to digital espionage attacks and the increase in the number
of Chinese actors involved in these attacks, this threat is increasing.
Russia
The digital intelligence activities on the part of actors that may be
connected to Russia are directed at public authorities (in particular
the ministries of Defence and Foreign Affairs), international
organisations (in particular NATO), defence companies, banking,
the energy sector and Russian dissidents. In the past year, digital
attacks on foreign public authorities were blamed in particular on
Russian actors. The AIVD has also established that the Netherlands
was the target of digital attacks for which Russia can be attributed.
The AIVD and MIVD currently estimate Russia to have large cyber
capacity. The attacks identified were carried out professionally using
unique and sophisticated malware, making them difficult to detect.
The data stolen with this malware indicates a motive for the
espionage. Given the choice of target and the sophisticated set up
of these attacks, it is likely that the Russians authorities are involved
in these attacks. The Russian digital intelligence activities pose
a realistic threat to the Netherlands.
Iran
The cyber activities on the part of the Iranian government are targeted
primarily at digital control and intelligence gathering from their
own citizens. The Iranian government has domestic internet traffic
under virtually full control, with the prime focus being on opponents
to the regime.
AIVD research has revealed that in recent years Iran has focused
more heavily on disruptive cyber activities targeted at countries
abroad. One example that can probably be attributed to Iran are
the attacks using Mahdi malware in mid-2012. This virus was spread
through e-mails with infected attachments. Despite the fact that
the attachments gave a virus warning by anti-virus software, a few
hundred people worldwide still opened the file. The Mahdi malware
appears to have a dual aim: to spy on individuals, companies and
organisations in Iran itself and outside of Iran (in particular Israel).
Given the small number of infections in the Netherlands it is
unlikely that the Netherlands was a specific target of this malware.
Considering the choice of target, the Iranian government is
probably involved in some way in this attack.
Furthermore, a high number of defacements and DDoS attacks on
websites of domestic and foreign opponents to the Iranian regime
originate from Iran and the assessment is that these are carried out
with the Iranian’s government’s knowledge. One example of this is
a defacement attack at the beginning of 2012 on various Azerbaijani
government websites, which also involved abuse of the Dutch IT
infrastructure. The hackers placed inflammatory and religiously
tinted images and text on the home pages of these websites opposing
the alleged close ties between Israel and the current Azerbaijani
government. The hackers also called for the start of an ‘Arab Spring’
in Azerbaijan. There are indications that Iranian hackers were
involved in carrying out this attack.
60