Cyber warfare: US military succeeds in strike against the TrickBot botnet

SECURITY INSIGHTS | 2 November 2020

The operation carried out by the United States Cyber Command was apparently a pre-emptive strike to protect the U.S. presidential election. This example demonstrates the growing significance of cyber warfare in our increasingly interconnected world.

Cyber Command, the U.S. military agency entrusted with electronic warfare, has succeeded in massively disrupting the operation of the TrickBot botnet during a campaign lasting several weeks. The operation is considered part of the efforts to prevent the upcoming U.S. presidential election from being tampered with, according to the Washington Post.

Russian criminals are suspected to be behind TrickBot, one of the world’s largest botnets with at least one million hijacked computers. Originally, it was mainly used to steal credentials and spread banking Trojans. Over time, however, the people behind it have continued to develop the botnet, hiring it out for Distributed Denial of Service attacks (DDoS) and most recently using it for ransomware attacks. In ransomware attacks, attackers use embedded malware to encrypt massive amounts of data and demand payment of a large ransom for decrypting it.

However, the botnet operators are likely to be distracted for at least a while and busy restoring normal conditions. This tactic of “imposing cumulative costs” on an opponent by keeping him constantly busy is a key element of U.S. Cyber Command’s strategy to protect the election from foreign threats.

Military intelligence agencies had already taken a similar approach in 2018 during the U.S. midterm elections. At that time, they sabotaged access to the internet for the Internet Research Agency, which was considered a Russian “troll factory,” in order to prevent influence from being exerted through targeted disinformation on the day of the election.

For example, fake news and hate campaigns on the internet can be a good way to incite the public to hate and distrust their own government. Other cyber warfare methods include prying on and stealing information, deleting or modifying content and data, and introducing compromised software or hardware that causes system failures.

The weapons of choice include phishing and social engineering campaigns to gain access to systems and information, malware such as viruses, worms, and Trojans to remotely control or sabotage systems, and ransomware to cripple systems temporarily or permanently. Botnet-based Distributed Denial of Service (DDoS) attacks play a key role. They are not only useful for specifically disrupting critical infrastructure, but can also be used to launch additional attacks or disguise them. A DDoS attack can be used to hit government or corporate networks with massive broadband attacks and then more easily infect overloaded systems with spyware or malware to steal or destroy data.

In 2010, the Stuxnet worm, presumably jointly developed by the U.S. and Israel to sabotage the Iranian nuclear program, hit the headlines. In 2015, the German Bundestag was the target of a massive hacker attack, which was later linked to the GRU, the Russian military secret service. Only recently the EU sanctioned several Russians implicated of being involved. In 2017, the NotPetya malware crippled millions of computers. The malware presumably developed by Russia to destroy data was mainly targeted at computers in Ukraine, but spread rapidly worldwide, causing hundreds of millions of dollars worth of damage. Only recently, six GRU hackers were accused by the U.S. of being responsible for these and other cyber attacks. The example of NotPetya shows how quickly cyber weapons can spiral out of control.

Nevertheless, no end to the arms race is in sight. Compared to conventional warfare, cyber warfare represents a cheap, simple, fast, and effective alternative. The weapons of war will become even more powerful in the future thanks to modern technologies such as artificial intelligence or quantum computing. And with increasing digitalization, the number of potential targets is increasing.