Operations that aim to persuade an audience of a particular viewpoint, energize those who hold specific views, and/or divert target audiences are all examples of influence operations.

Propagandists are vying for users’ already-diminishing attention on social media platforms, according to the logic of distraction. Propagandists could successfully capture user attention without necessarily persuading them, if they can divert target audiences from an unfavorable narrative developing on social media by disseminating alternative theories or muddying the information environment.

Although influence operations can take many different shapes and employ a variety of techniques, there are a few common threads that connect them all. According to a recent study on political influence operations in the Middle East, these operations frequently used one of the following strategies:

• Making an effort to promote one’s own government, culture, or policies;

• Making an argument in favor of or against particular policies.

• Attempts to destabilize foreign relations or domestic situations in rival nations;

• Attempts to make allies appear good and opponents look bad to third-party countries

In a number of these instances, the accounts carrying out the operation pretended to be locals voicing their displeasure with their government or certain political personalities. This strategy of using digital agents of influence is frequently used by social media manipulation operations to conceal the genuine identity of the content source from the target audience. For instance, the Internet Research Agency (IRA) accounts of Russia sent direct messages to members of the Black American and conservative American communities while posing as activists. A misused idiom, a recurring grammatical fault, or even the use of a backtick (‘) where a real speaker would use an apostrophe (‘) are some subtle indicators that might help you spot these false reports. State-level antagonistic actors frequently deploy a variety of strategies, drawing on their own workforce or contracting out to virtual mercenaries.

Since 2016, Twitter and Meta have taken down well over 100 social media influence operations that originated in dozens of different nations. Inauthentic amplification attempts, fake news websites, and persona creation (the creation of false personas to disseminate a message) are frequently used in these operations.

However, influence operations have also greatly increased outside of Facebook and Twitter to other platforms, intimate settings, and encrypted areas. The New York Times reported on how “Iranian agents had infiltrated small [Israeli] WhatsApp groups, Telegram channels and messaging apps” to promote divisive messages. The report was done in collaboration with Israeli disinformation researchers. These influence operations occasionally show inventiveness by using platform rules in an offensive way.

For instance, a campaign in favour of the Tanzanian government that Twitter deleted in 2021 targeted Tanzanian activists’ accounts by making fake allegations of copyright reporting.

Recent studies and media coverage on influence operations have tended to concentrate on foreign campaigns, in which governments or individuals target individuals in other countries. But influence efforts can also be domestically focused, as the Tanzanian case demonstrates. Political actors frequently disseminate clandestine propaganda directed at their constituents in an effort to increase their popularity, detract from that of an adversary, or create commotion inside the political system. Facebook terminated phony accounts associated with Brazilian politicians, President Jair Bolsonaro, and his sons, Congressman Eduardo Bolsonaro and Senator Jair Bolsonaro, in 2020 for disseminating divisive content about Brazilian politics. In fact, a lot of critics think that internal influence operations-rather than foreign ones-are the most concerning.

Additionally, influence operations have been used to take sides in intraparty disputes and, in the case of some campaigns linked to the Chinese Communist Party, to hit expatriate groups.

Techniques Employed

China employs a variety of techniques for influence operations to shape opinions, advance its interests, and project power. These techniques can be both overt and covert, and they are often coordinated by the Chinese Communist Party (CCP) and its various government agencies. Here are several techniques that China has been known to use:

Propaganda and Media Influence: China maintains a vast propaganda apparatus that includes state-controlled media outlets such as Xinhua News Agency, CCTV, and People’s Daily. These outlets disseminate narratives aligned with the CCP’s objectives and promote positive portrayals of China. They also engage in information warfare by spreading disinformation, censorship, and manipulating online discussions through social media platforms.

Economic Leverage: China utilizes its economic power to exert influence. It may offer financial aid, investment, or loans to other countries, attaching conditions that align with its political objectives. This can create dependencies and influence decision-making processes in target nations.

Diplomatic Influence: China engages in diplomatic efforts to shape global narratives, build alliances, and influence international organizations. It actively seeks to cultivate relationships with political leaders, academic institutions, and think tanks globally. It hosts conferences, forums, and summits to promote its interests and propagate its narratives.

United Front Work: The CCP employs a strategy known as “United Front Work” to co-opt and influence individuals and groups outside of its formal political structure. This includes overseas Chinese communities, ethnic or religious groups, business leaders, and intellectuals. The goal is to create a favorable perception of China and gain support for its policies.

Cyber Espionage and Information Warfare: China has been accused of engaging in state-sponsored cyberattacks and espionage to steal intellectual property, gain access to sensitive information, and manipulate public opinion. It also employs “50 Cent Army” or “Wu Mao” internet trolls who spread pro-China propaganda and disrupt discussions critical of the regime.

Confucius Institutes: China has established Confucius Institutes in various countries, which are cultural and educational centers that promote Chinese language and culture. However, they have been criticized for engaging in censorship, promoting self-censorship, and advancing Chinese Communist Party propaganda.

Overseas Investments and Infrastructure Projects: China’s Belt and Road Initiative (BRI) is a large-scale infrastructure development project that seeks to enhance connectivity across Asia, Europe, Africa, and beyond. By investing in critical infrastructure projects in other countries, China can deepen its economic ties, gain influence, and extend its geopolitical reach.

United Front Work

United Front Work is a strategy employed by the Chinese Communist Party (CCP) to co-opt and influence individuals and groups outside of its formal political structure. Here are a few examples of United Front Work activities carried out by China:

Overseas Chinese Communities: China seeks to influence overseas Chinese communities by establishing various organizations and associations that promote Chinese culture and interests. These organizations often operate under the umbrella of the CCP’s United Front Work Department. They aim to maintain ties with overseas Chinese, encourage support for China’s policies, and discourage dissent or criticism of the CCP.

Ethnic and Religious Groups: China targets ethnic or religious groups within its borders and abroad through United Front Work. For example, it seeks to co-opt Tibetan and Uighur diaspora communities by promoting narratives that downplay human rights concerns and highlight economic development and cultural preservation efforts in Tibet and Xinjiang. China also uses United Front tactics to exert influence over overseas Chinese Muslim organizations.

Business and Intellectual Elites: China actively cultivates relationships with influential business leaders, academics, and intellectuals around the world. Through various means, such as funding research institutions, supporting academic exchanges, and organizing conferences, China seeks to shape narratives, gain access to cutting-edge technologies, and project soft power. These efforts aim to build networks of individuals who are sympathetic to China’s policies and willing to advocate for them.

Political Parties and Politicians: China seeks to cultivate relationships with politicians and political parties in other countries. It may offer financial support, establish friendship associations, or facilitate exchange programs to build political influence. This can involve providing financial assistance, investment opportunities, or other incentives to countries or politicians that align with China’s interests.

Media and Academic Institutions: China invests in media outlets and academic institutions worldwide to enhance its soft power and control narratives. This includes establishing partnerships with foreign media organizations, sponsoring Confucius Institutes in universities (which have been accused of promoting CCP propaganda), and funding research centers or think tanks that produce China-friendly analysis.

Operations and Impact of Influence

Influence operations may have an effect due to their particular content or focus (such as through persuasion) or by undermining public confidence in the information environment as a whole.

Resources, message quality, and operation detectability are sometimes constraints on the direct impact of content in modern influence operations. Depending on the objectives of the operator, these aspects may be more or less important. For instance, the effectiveness of each individual message is probably much less important if operators are merely trying to divert targets rather than persuade them of a particular opinion. Theoretically, language models might one day partially circumvent these limitations.

It is more important to create the impression that any given message can be false or deceptive in order to affect trust in an information environment. Even if influence operations fail to alter people’s opinions, they may cause people to doubt the veracity of information they get from even reliable sources, which could undermine trust in democratic and epistemic institutions more generally.

Content-Based Impact

If an influence operation

• Persuades someone of a specific position or supports an existing one,

• Distracts them from discovering or developing other ideas, or

• Distracts them from making any room for higher quality thought, then it may have an impact dependent on the content.

Often, the intention is to merely divert attention away from information that could be harmful to the operator. Distraction operations frequently take advantage of and worsen preexisting attention rivalries between advertisers, media sources, and platforms to crowd out crucial information with attention-grabbing, irrelevant material. Therefore, distraction operations do not require a target to be convinced by the information spread, but rather that a target not be convinced by (or even take into consideration) any other piece of information.

The impact of an influence operation can be quantified or tracked in both historical and modern cases. For instance, the Soviet Union engaged in an influence campaign to disseminate the myth that the United States government invented the virus in a lab during the HIV epidemic in the 1980s. According to a 2005 research, 27% of African Americans still held this belief. In 2016, the IRA organized rallies and counter protests outside the Islamic Da’wah Center in Houston using manipulative agents of influence on Facebook. As a result of the protests’ inability to take place without the IRA’s involvement, the impact is extremely simple to identify in this case.

While platforms assign blame and give researchers information about influence operations that were shut down, researchers still have little visibility into the impact on users or their post-engagement behavior. Additionally, not every influence operation is discovered. Due to multicausality and the obstacles associated with tracking changes in public opinion over time, even propagandists who try to gauge their own influence occasionally run into problems. Scholars have emphasized that historically, this uncertainty has helped intelligence agencies exaggerate the impact of their influence operations for administrative gain.

Despite these measuring difficulties, several characteristics, such as resources, material quality and messaging, and detectability, obviously restrict the impact of current efforts. Following a brief description of these drawbacks, we go into how generative models might be able to assist you get over them.

• Resources: Just like marketing efforts, the effectiveness of an influence operation depends on one’s ability to reach the target audience with the required material. A political actor employs how many propagandists to write material. How many social media accounts can someone open up to create a false online presence? Low-resource initiatives have a lower chance of reaching their target audience or getting media attention.

• Content’s Quality and Message: People are less likely to be persuaded by messaging if it sharply contradicts their preexisting viewpoint or if the arguments are shoddily put forth or illogically reasoned. Above all else, campaigns with messaging that contradicts targets’ beliefs, fails to successfully integrate with a target’s information environment, and presents weak arguments should be avoided.

• Detectability: Lastly, actions that are rapidly found have a lower likelihood of having an effect. Independent researchers and social media platforms aggressively look for influence operations, which the platforms then take down to reduce their reach. In fact, propagandists’ awareness that these operations can be abandoned might influence their actions, encouraging them to pursue diversion strategies rather than persona creation, which takes more time and effort but can be more persuasive to observers.

It is beneficial to keep these restrictions in mind as we think about the potential contribution of language models to influence campaigns. They could pose a serious problem for the information environment if they can get beyond the current barriers. In Section 4, we go into more detail about this.

Trust-Based Downstream Impact

The second method influence operations might have an effect is via undermining trust. Even when influence campaigns are recognized, their presence, especially at scale, may lead people to become skeptical of other, authentic sources. Degrading public trust does not necessarily require high quality initiatives. Particularly in areas where information technologies make it challenging to determine the reliability of sources, propagandists frequently seek to take advantage of weaknesses in their target’s mental shortcuts for gaining confidence. Influence operators have the ability to erode credibility beyond the narrow focus of their campaign by faking or using deceptive credentials and testimonials, as well as by altering with photographic and video evidence. Lowering societal trust might make it more difficult for a society to plan quick responses to emergencies, which could be an admirable objective for antagonistic actors in and of itself. As a result, propagandists can further their goals in an environment where there is less societal trust. Existing societal division and polarization make it harder for trustworthy actors to gain widespread respect. They can also provide influence operators a foothold to target their messaging at specific audiences, cause discord, and undermine institutional and social confidence. The norms that allow people and organizations to connect and collaborate without the need for numerous rules and processes to manage their behavior are threatened by low universal trust.

The post China’s Influence Operations appeared first on IMR.

With government funding, massive computational capacity, and ties to the military, Peng Cheng Lab is likely to be actively used by state hacking teams. Notably, this cyber range, which facilitates military-civil fusion, has supercomputers, research facilities for AI, ICS, smart cars, etc. It is known to have hosted cyber competitions.

The lab is led by the Guangdonag Provincial Laboratory of Cyberspace Science and Technology and built with funding from the Guangdong provincial and Shenzhen municipal governments. It aims to provide computational power to groups conducting research on a large number of topics.

Based on the lab’s known partnerships (see below), these groups include academics, industry, and military researchers. Peng Cheng Lab enumerated areas of research extends to robotics, virtual reality, smart lasers, and “electromagnetic cognition.”

Peng Cheng Lab has built a powerful supercomputer, Cloudbrain-II Based on available data, Cloudbrain-II is estimated to be half as fast as the world’s fastest supercomputer, Fugaku in Japan. Its most famous contribution to China’s public research so far has been the computational power it provided to train China’s PanGu large language model. Peng Cheng Lab aims to provide similar computation resources to work on cyber ranges and AI and cyber research.

Peng Cheng Lab also hosts cyber ranges for industrial control systems, smart cars, cybersecurity development, and AI. The facility’s work on industrial control systems appears aimed at securing IoT devices used to implement “smart manufacturing”—a policy goal formalized in a recent five-year plan. Smart cars, part of the electric vehicle revolution and a topic of concern in China’s Three-Year Action Plan for the High-Quality Development of the Cybersecurity Industry (2021-2023), receive their own cyber range. The Internet of Vehicles Lab is being built in concert with central government regulators under the China Automotive Technology and Research Center in Tianjin.

Peng Cheng Lab issued contracts to build its AI cyber range within months of opening in 2019. The contracts were quickly followed with public events promoting research on AI in China. The Shenzhen-based lab hosted China’s National AI Competition in late 2020, which counted leaders from the Chinese Academy of Engineering, leading Chinese universities, and private firms among its participants.

Projects focused on cybersecurity advanced just as quickly. Peng Cheng Lab hosted an inaugural conference on cyber range research in mid-2019 and has done so at least once since then. After China’s National Cybersecurity Center for Education and Innovation opened in 2020, Peng Cheng Lab began partnering with the facility. In 2021, Peng Cheng Lab joined the National Cybersecurity Center, Sichuan University, and a cybersecurity park in Qingdao in jointly hosting a cybersecurity competition. Qi An Xin Technology Group, a Chinese cybersecurity company active at the National Cybersecurity Center and one of China’s 20 “invisible champions” of national security technology, may have facilitated Peng Cheng Lab’s engagement—the company won a contract to construct Peng Cheng Lab’s AI cyber range. The lab’s rapid integration into existing cybersecurity and AI research initiatives across the country by Qi An Xin indicate it is taken seriously by other leading researchers in China. As of 2022. such cooperation appears to be organic and not centrally dictated.

The lab’s list of partners is growing rapidly. Since opening its doors in 2019, Peng Cheng Lab has formed research partnerships with other Chinese institutions. The lab partners with 21 universities, 13 research organizations, and 25 businesses or SOEs. Among the organizations participating in the initiative, prominent institutions include several of China’s premier universities, such as Peking University, Tsinghua University, and the Chinese Academy of Sciences. One school tied to state-sponsored hacking campaigns and co-located on a PLA base, Shanghai Jiao Tong University, also partners with Peng Cheng Lab. Shanghai Jiao Tong University is also subject to a 2017 agreement with the PLA Strategic Support Force to develop “new combat forces.”

Likewise, China’s National University of Defense Technology and the Key Laboratory of Science and Technology for National Defense are listed among its partnerships with research organizations. The collection of collaborators reads as a who’s who of Chinese high-tech research talent. Peng Cheng Lab names entities like BGI, China Aerospace Science and Industry Corporation, China Electronics Corporation, China Electronics Technology Group, iFlyTek, and HiSense among its corporate and defense-SOE partners. The US Department of Commerce has listed many of these businesses on its Entity List.

Of the cyber ranges discussed in this report, Peng Cheng Lab stands out for its association with Li Jianhua, a professor at Shanghai Jiao Tong University. Li currently runs a PLA-affiliated lab which researches the applications of AI to cybersecurity research for both offensive and defensive purposes. His work is also featured in Robot Hacking Games, China’s version of DARPA’s Cyber Grand Challenge.

Li is one of China’s leading experts on cyber policy. In 2018, he published an article extolling the importance of cyber ranges and offered a detailed path for successful development. Li argued that the ability to rapidly recreate networks is critically important, a capability which can facilitate attack planning. He specifically suggested the use of AI to aid both defenders in detecting intrusions and in “decision making” during range operations.

Given Li’s prominence, his involvement in Peng Cheng Lab suggests it is among the more sophisticated cyber ranges developed by China. His involvement, his school’s history of working with China’s security services, the technical capabilities of the lab, and the lab’s partnership with military institutions indicate it may be used by the PLA to practice offensive operations. Li’s institution, Shanghai Jiao Tong University, is listed among the lab’s strategic partners, alongside defense-SOEs and the PLA’s National University of Defense Technology. Further, given Li’s focus on AI and ties to the security services, Peng Cheng Lab is well-situated to enable AI-aided attack planning. One possible scenario would allow offensive operators to further hone their attacks by applying machine learning to attack simulations made possible by the range.

Based on “Downrange: A Survey of China’s Cyber Ranges”, A report by Center for Security and Emerging Technology, 2022

The post Peng Cheng Laboratory appeared first on IMR.

China is rapidly building cyber ranges that allow cybersecurity teams to test new tools, practice attack and defence, and evaluate the cybersecurity of a particular product or service. Nineteen of China’s 34 provinces are building, or have built, such facilities.

Their purposes span from academic to national defence. In short, the presence of these facilities suggests a concerted effort on the part of the government, in partnership with industry and academia, to advance technological research and upskill its cybersecurity workforce—more evidence that China has entered near-peer status in the cyber domain.

A report titled “Downrange: A Survey of China’s Cyber Ranges”, by the Center for Security and Emerging Technology, published in September 2022, examines some of China’s 19 facilities that have demonstrable ties to the military or security services.

China’s investment in cyber ranges is in line with what is known about other efforts to bolster the country’s hacking and cybersecurity capabilities. As these facilities mature, network defenders who find themselves in the crosshairs of China’s hacking teams may be subject to attacks that have been rehearsed, tested, and sometimes practiced on replicas of their own networks.

Important Findings

This report finds:

1. China’s cyber ranges facilitate joint exercises between the People’s Liberation Army (PLA) and civilians. One competition hosted each year in Chengdu aims to replicate the North Atlantic Treaty Organization’s (NATO) Locked Shields exercise. Teams include representatives from the military, private cybersecurity firms, and critical infrastructure operators. Separately, a defence state-owned enterprise (SOE) makes a “comprehensive space scenario range” available to civilians at an annual cybersecurity competition. Each of these examples demonstrates China’s implementation of military-civil fusion in the cyber domain.

2. Some cyber ranges allow hackers to practice attacking and defending critical infrastructure systems. Some ranges provide users with training on industrial control systems within the cyber range; one of which purportedly engages in “national offensive and defensive exercises.” The Office of the U.S. Director of National Intelligence’s 2022 unclassified annual threat assessment found that China was “almost certainly […] capable of launching cyberattacks that would disrupt critical infrastructure services.” These ranges could allow rehearsals and testing of these types of attacks in the future.

3. Peng Cheng Laboratory in southern China is using a supercomputer to research artificial intelligence’s (AI) application to cybersecurity. The lab’s partners include the National University of Defense Technology, China’s Key Laboratory of Science and Technology for National Defense, and Shanghai Jiao Tong University, a university with ties to military hacking teams. The lab has quickly earned the respect of longtime experts in China’s cybersecurity community.

Ranges Enhance Chinese Defence

China’s cybersecurity posture will be enhanced by the use of cyber ranges in several ways. First, China’s critical infrastructure, massive data troves, and government agencies will be better defended. Cybersecurity teams with years of experience and hours of practice on a range will be better able to defend against a variety of threats. Second, China’s attacks are likely to increase in efficacy and capability. While there are no indications to date that China has launched a physically destructive or disruptive cyberattack against another country’s critical infrastructure, the ranges covered in this report suggest such a lack of action may be based in policy rather than from a lack of capabilities. Besides making attacks on industrial control systems more feasible, other types of attacks will improve as well. For example, hacking teams have more opportunities to try new tactics, techniques, and procedures.

Components of Cyber Ranges

Cyber ranges can help these agencies provide the experiential learning that hackers need. A set of virtual machines—software that creates a computer within a computer— comprise most cyber ranges. Because virtual machines are cheap software to license, a cyber range can quickly grow in size but with little additional cost. The operator can design the range to his or her needs, specifying how the machines are connected, what operating system they use, and even the range’s defences. The best cyber ranges aim to simulate real computer networks. Few achieve this high standard, and for most users “close” is good enough. The best government-funded cyber ranges can simulate millions of connections.

But cyber ranges do not only let users learn new tools, they also let them practice. Offensive teams that hope to damage or impair physical systems with precision often need to rehearse. Attacking an electrical substation or gas pipeline requires deep knowledge about the target. A cyber range built to emulate that target can help attackers make sure that they are on the right path. Industrial networks can be recreated from stolen data; AI may even help attackers understand how to attack these systems.

Background and Recent Policies

The Chinese Academy of Sciences (CAS) established China’s first national cyber range in 2010. That was China’s first publicly-acknowledged, government-led effort to establish such a facility. Some of China’s best universities, military hacking teams, and private cybersecurity firms likely already had access to cyber ranges.

Cyber ranges within China featured prominently in 2021 in two important ways. First, the Ministry of Industry and Information Technology began soliciting public opinions on the drafted Three-Year Action Plan for the High-Quality Development of the Cybersecurity Industry (2021-2023) in July 2021. MIIT policymakers called on the government and industry to build “AI security cyber ranges,” promote research on cyber ranges, use cyber ranges for training, and invest in cyber ranges that can be used to train defenders of China’s futuristic smart cities. MIIT frequently allocates money for research on cyber ranges, including allotments to research partnerships between universities and the PLA Strategic Support Force—the service branch responsible for computer network operations and space systems.

China issued its second policy addressing cyber ranges a few months later in October 2021. The National Industrial Information Security Development Research Center, a research institute of the MIIT, published a document whose contents were only summarized publicly. In the policy document, titled “Industrial Cyber Range Platform Technology Capability Evaluation Criteria”, policymakers lay out the standards that China’s Industrial Control System cyber ranges should aspire to meet. Available summaries reference standards from companies such as Dragos, KPMG, EY, and Deloitte. What little information is publicly available stresses the close connection between industrial security and China’s future as an automated manufacturing powerhouse.

Private Sector Participation

China, like many countries, has a robust market for cyber range providers. Private sector companies sell services to universities so cybersecurity students can practice their skills. Some companies specialize in supporting critical infrastructure operators, helping electrical grid operators learn how to defend their networks. And still some companies focus on training other private sector employees. Similarly, it is well known that China’s premier military university for hackers—the PLA Information Engineering University—has a cyber range.

Potential Cyber Range Uses in China

There are a number of potential uses of cyber ranges. The following have been observed in China:

● Training on new tools and techniques in a controlled environment.

● Practicing attacking and defending industrial control systems.

● Evaluating product cybersecurity—smart cars, Internet of Things (IoT) devices, etc.

● Evaluating the efficacy of cybersecurity/antivirus products. Such evaluations can determine whether the products will detect new attack methodologies or malware. These evaluations can also help attackers evade a target’s defences. China’s military has been observed purchasing such systems.

● Recreating networks to allow defenders to practice defending those systems and attackers to practice attacking targeted systems.

● Planning attacks using attack graphs, which recreate a network and determine which pathways to a target are least likely to pique the interest of defenders. Some researchers are using an AI technique, reinforcement learning, to determine and optimize these attack paths.

● Replicating smart-city networks for defenders to practice protecting internet- connected infrastructure and surveillance systems.

Conclusion

The development of China’s cyber ranges highlights how its military-civil fusion strategy is applied to the cyber domain, leveraging academic institutions, companies and government labs/entities to work toward a central goal. These ranges not only provide the opportunity for civilian organizations and the military to practice their skills together, but they also consistently engage in national security related research in areas such as applying machine learning frameworks to software vulnerability discovery, applying AI to cyberattack and defence, and developing attack and defence methodologies for industrial control systems.

The growth of China’s cyber ranges is not accidental. Central policymakers signalled their interest in cyber ranges for education, training, AI development, and testing in China’s most recent development plan for the cybersecurity sector. Consequently, municipal and provincial governments funded the development of cyber ranges with sometimes significant subsidies in alignment with Beijing’s political mandate. Other cyber ranges included in the appendix receive similar funding across China. The decentralized approach to investment supports innovation by provincial governments and increases opportunities for cooperation and collaboration between the military and civilians.

Cyber ranges are key to training the next generation of talent to defend, and potentially attack, critical infrastructure. China—through the development of its ranges—is providing a venue for testing and exercising the tools and techniques to attack and defend critical infrastructure while developing the technical talent to execute these operations. Although no cybersecurity firms or governments have yet attributed a disruptive or destructive attack on industrial control systems to China, this report on its cyber ranges demonstrates that the PLA has the capabilities to do active research in this area and could be postured to conduct such attacks in the future. New research on Chinese procurement records and research publications shows Chinese interest in procuring the capabilities for such destructive attacks, following the 2015 attack on Ukraine’s electrical grid. China’s interest in having that capability is likely driving those requests.

As new cyber range capabilities develop and mature, the lessons learned from their use will provide more policy options to Beijing. Competition among states for influence and power in China’s near-abroad will continue to shape Beijing’s policy in the region. Besides positive incentives that induce cooperation, such as trade deals, disincentives—like potentially learning that Beijing has implanted destructive malware on your country’s electrical grids—bolster China’s ability to compel other countries.

Although the time and place of future cyber operations is hard to predict, the scope and scale of China’s operational capabilities is growing. Investment precedes capabilities, and China has invested.

Based on “Downrange: A Survey of China’s Cyber Ranges”, A report by Center for Security and Emerging Technology, 2022

The post China’s Cyber Ranges for Attack and Defence appeared first on IMR.

India, US, Indonesia, and China accounted for 45% of total cyberattacks on government agencies worldwide in the second half of 2022, according to a report by cybersecurity firm CloudSek, released on 30 December. The number of attacks on government agencies were up 95% year-on-year, the report claimed.

The government itself has acknowledged that 18 million cyberattacks and 200,000 online threats daily in the first quarter of 2022.

India was the most targeted country in 2022 as attacks on government agencies more than doubled. CloudSek attributed this to an increase in activities of Malaysia-based hacktivist group Dragon Force, which ran campaigns such as #OpIndia and #OpsPatuk against India in retaliation to the controversial comments by an Indian politician on Prophet Mohammed.

Another hacker group Khalifah Cyber Crew intensified attacks on India in protest against alleged “Muslim discrimination” by the government, the report said.

Attacks on government agencies in China declined to 4.5% of all attacks from 13.10% last year. On the other hand, in India, US, and Indonesia, the share of all attacks grew from 6.3% to 13.7%, 7.4% to 9.6%, and 4.6% to 9.3%, respectively.

CERT-In Data

Government data, collated by the Ministry of Electronics and Information Technology’s Indian Computer Emergency Response Team (CERT-In), is available only till 2021, but that too shows an increase in cyberattacks in India.

In 2019, CERT-In handled close to 3,94,499 incidents in total, in which it suggested remedial measures for organisations and shared notes on “cyber threats and vulnerabilities”. In the same year, CERT-In issued 204 security alerts and 38 advisories.

The number of incidents handled by CERT-In surged in 2020 to 11,58,208, a near-tripling over the previous year. This surge continued in 2021, which saw 14,02,809 incidents, a 21 per cent increase.

The matters CERT-In looks into include website intrusion and malware propagation, malicious code, phishing, distributed denial-of-service (DDoS) attacks, website defacements, unauthorised network scanning or probing activities, ransomware attacks, data breaches and vulnerable services.

Trends

The Indian Computer Emergency Response Team said: “Threat actors were leveraging tools that are already available in the cyber environment rather than making custom tools and malwares. By this way, they were being able to bypass many security controls.”

Threat actors are also able to execute scripts that reboot victim’s machine into ‘safe mode’, and thus bypass security solutions.

In terms of mitigation, the agency recommended victims to immediately disconnect and isolate infected systems from the network. IT also recommended to turn off any wireless internet connectivity and isolate all system backups.

Spike in Ransomware Attacks in India

In a first of its kind report, the Indian Computer Emergency Response Team (CERT-In) said that it had observed a 51 percent increase in ransomware incidents in the country in the first half of the business year (H1) in 2022.

The information technology sector was the most affected when it came to these attacks, CERT-In said, followed by manufacturing and finance.

CERT-In attributed the rise in attacks in India to Djvu, a ‘high-risk’ virus that majorly targets citizens. The agency also named Phobos, a ransomware which “strikes smaller companies and individuals that have less capacity to pay relative to larger businesses”, to have played a role in the increase.

It also attributed the increase to Hive, a year-old ransomware which has grown into one of the most prevalent ransomware payloads in the ransomware-as-a-service (RaaS) ecosystem, according to Microsoft.

“Ransomware as a Service”

A ransomware is a type of malicious software designed to block access to a computer system until a sum of money is paid. Ransomware as a service (RaaS) is a subscription-based model that enables affiliates to use already-developed ransomware tools to execute ransomware attacks, said Upguard, a cybersecurity company.

In the report CERT-In said, “Ransomware-As-A-Service (RAAS) ecosystem is evolving with sophisticated double and triple extortion tactics and a wide range of ransomware campaigns through affiliates.”

“This is leading to higher probability of monetization and further rise in attack campaigns. Post covid accelerated digitalisation and hybrid work culture are also aiding this threat emergence,” it added.

Modus Operandi

The agency noted that ransomware gangs were focusing on penetrating known unpatched vulnerabilities of public facing applications for gaining entry into the network.

“Compromised credentials of remote access services (VPN/ RDP) are being used by threat actors to gain entry into the network,” it said.

Apart from that, CERT-In said phishing campaigns are also another major source of ransomware infections.

Zerofox describes a phishing campaign as a scam created by cybercriminals to steal financial resources or sensitive data from victims using manipulative emails or other fraudulent digital assets.

State of Affairs

In recent times the three most notorious members of the ransomware family- Ryuk, Purga, and Stop made major headlines in the nation.

The Stop ransomware caused about 10.10% of the ransomware attacks followed by Ryuk making about 5.84% attacks along with Purga for deploying 0.80% of ransomware attacks

Ryuk seemed to have been the most active threat landscape in the Indian public as well as private sectors. On the other hand, brute-force attacks on RDP and SMBs seemed to have steadily increased in the last five years.

According to Forbes, there was one ransomware attack every 10 seconds in 2020.

Reportedly, organizations have faced double extortion in 2020 across the globe. Moreover, the cost of ransomware damage is predicted to hit around $20 billion by 2021.

Although, this figure may vary later depending upon the cost of attacks and their devastating consequences. To know how brutal ransomware attacks can get, here are the top devastating ransomware attacks that took place in India.

Hacktivism

In 2022, hacktivism accounted for 9% of the cyberattacks on the government sector. Hacktivism is a form of cyberattack where the hacker’s motivation is not financial gains but to promote a political agenda or protest against certain policies. Last year, attacks on China also increased due to its aggressive stance towards Taiwan and the Uyghur community.

In addition to hacktivism, government agencies in India are also increasingly being targeted by phishing campaigns, according to the report.

Ransomware Attacks

CloudSek also found that ransomware groups were very active and accounted for 6% of the attacks on governments. LockBIT, which provides ransomware-as-a-service (RaaS) was the most prominent ransomware operator. Its targets in 2022 included government agencies in the US, Canada, and Italy. In November, a Russian national was arrested in Canada for alleged involvement in LockBIT ransomware campaigns in the US.

In November 2022, India’s top government-run hospital All India Institute of Medical Science (AIIMS) was also hit by a cyberattack causing disruption of online services that lasted over two weeks. India’s nodal cybersecurity agency Computer Emergency Response Team (CERT-In) found in its investigation that five AIIMS’ servers were compromised during the attack and nearly 1.3 terabytes of data was encrypted by hackers.

What to Expect in 2023

Experts believe that state-sponsored hackers will go after cloud services in 2023 due to growing digital transformation. “Nation states will begin to target cloud service provider (CSP) managed services as companies migrate more of their attack surface to these managed services,” according to Bob Huber, chief security officer at Tenable, a cybersecurity firm.

India’s had its worst year of cyberattacks, but 2023 will see govt & firms ramp up defences

India was a top target for cyberattacks in 2022, shows study by web security firm Indusface. As govt tries to address policy vacuum, companies likely to spend more on cybersecurity.

According to a study released Tuesday by Indusface, a Tata Capital-funded software-as-a-service (SaaS) security firm, India has become one of the most attacked and breached countries in the world. Among the 829 million cyber-attacks detected and blocked globally by the firm in the fourth quarter of 2022, close to 59 per cent were directed towards India.

In this backdrop, what will the government and companies do differently in the coming year?

As the government readies its legislation on cybersecurity, numerous industry-wide surveys and sector experts say that 2023 will see companies spending significant amounts to secure their digital systems from attacks.

According to Sajan Paul, managing director & country manager, India & SAARC, Juniper Networks, a “zero trust” policy will be an “essential security strategy” for India, going forward. ‘Zero trust’ model assumes breach and verifies each request as though it originates from an open network.

Data protection Bill and CERT-In rules

India’s IT ministry has come up with the Digital Personal Data Protection Bill, 2022, defining some roles of data fiduciaries and introducing appellate committees that will deal with redressals and grievances. Many have termed it a “step in the right direction” to ensure data security.

The draft law, alongside CERT-In rules, has been part of core policy discussions in India. The rules now require companies to report cybersecurity incidents within six hours. While this seems stringent, it might not be practical, some experts believe. This was perhaps the most significant development in the cybersecurity domain in 2022.

Commentary

Cyberattacks on government agencies are not new. Many of these attacks state sponsored and are aimed at stealing sensitive information or cripple critical infrastructure of other countries. Indian entities are often targeted by hacker groups with links to China. Similarly, many of the attacks on US agencies often originate from Russia or North Korea.

According to IBM’s ‘Cost of Data Breach Report 2022’, the average cost of data breaches in the government sector has increased from $1.93 million in 2021 to $2.07 million this year.

Threat actors have modernised their attack methodologies, evolved sophisticated tactics and adopted a wide range of attack campaigns.

==

Top Six Attacks in 2020-21

Telangana and AP Power

A malicious software attacked the power utility systems of  Telangana and Andhra Pradesh in 2020 where all the servers went down until the glitch was rectified. Since the computer systems of Telangana and Andhra Pradesh power utilities were interlinked, the virus attack quickly spread, taking down all the systems.

UHBVN Ransomware Attack

Uttar Haryana Bijli Vitran Nigam was hit by a ransomware attack where the hackers gained access to the computer systems of the power company and stole the billing data of customers. The attackers demanded Rs.1 crore or $10 million in return for giving back the data.

WannaCry

India was the third worst-hit nation by WannaCry ransomware, affecting more than 2 lakh computer systems. During the first wave of attacks, this ransomware attack had hit banks in India including few enterprises in Tamil Nadu and Gujarat. The ransomware majorly affected the US healthcare system and a well-known French car manufacturing firm.

Mirai Botnet Malware Attack

This botnet malware took over the internet, targeting home routers and IoT devices. This malware affected 2.5 million IoT devices including a large number of computer systems in India. This self-propagating malware was capable of using exploitable unpatched vulnerabilities to access networks and systems.

Petya

India was one of the top 10 countries to be hit by Petya ransomware. This ransomware attack halted work at one of the terminals of India’s largest seaport causing computer lockdown and serious consequences for the country’s exports.

BSNL Malware Attack

The state-owned telecom operator BSNL was hit by a major malware attack, impacting nearly 2000 broadband modems! 60,000 modems became dysfunctional after the malware attack hit the Telecom Circle.

The post Cyber Year in Review appeared first on IMR.

Chinese non-state actors are very involved in Chinese cyber operations. A wide variety of non-state entities, such as contractors and technology conglomerates (Alibaba, Huawei, etc.), have worked in tandem with the CCP on a variety of research, development, and execution of cyber operations.

Over the years, PLA unit officers have been indicted in the US on charges of theft of confidential business information from U.S. commercial firms and planting malware on their computers.

Chinese state-sponsored cyber actors aggressively target U.S. and Allied political, economic, military, educational, and critical infrastructure (CI) personnel and organizations to steal sensitive data, emerging and key technology, intellectual property, and personally identifiable information (PII), including political targets and now have the ability to influence elections. In March 2021, United States intelligence community released analysis in finding that China had considered interfering with the election but decided against it on concerns it would fail or backfire.

While cyber espionage for national security concerns is a common action conducted by most countries, cyber espionage for economic benefit is an accusation continually made against the Chinese government and military.

China is focussed towards developing the domestic technology industry and its capabilities, to counter the “eight King Kongs” (Apple, Cisco, Google, IBM, Intel, Microsoft, Oracle, and Qualcomm).

The scale of China’s cyber operations dwarfs those of other countries in the region—the complexity and sheer range of targeting, and the number of domestic technology companies whose increasingly global reach may be utilized for intelligence gain and influence.

Beijing has nurtured a tech industry and environment that actively support the party-state’s aims to bolster government surveillance and cyber capabilities. From large firms to startups, many companies work with the state to conduct vulnerability research, develop threat detection capabilities, and produce security and intelligence products.

In India, most major attacks on Indian government networks, such as the National Security Council, have originated from China. Chinese hackers are experts in operating botnets. Multiple instances of Chinese cyber attacks against India’s cyberspace have been reported including ransomware attack on the servers of All India Institute of Medical Sciences in…

India needs a a culture of cyber security investment and strategy. At the very least, we need to ensure security personnel monitor key internal security capabilities and can identify anomalous behaviour. Any known Chinese state-sponsored indicators of compromise and tactics, techniques, and procedures must be identified for immediate response.

The post EDITORIAL—China’s Cyber Arsenal appeared first on IMR.

China is a socialist, capitalist state ruled by a single-party – the Chinese Communist Party (CCP) – with Xi Jinping as their leader since 2012. In reality, China is much more orientated towards capitalism.

Development of Media

There were four phases in the development of the media in China.

• The first was the Founding of the new China in 1949 to 1966.

• The second was the Cultural Revolution from 1966 to 1978.

• The third involved a total change of the media system by Deng Xiaoping’s market reforms.

• The last phase began with the Tiananmen square uprising in 1989.

After the founding of the People’s Republic of China in 1949, the Communist party started to rule the country. General restrictions were placed on the media system. Private ownership of newspapers was abolished. General media became a party organ.

During the Cultural Revolution, media freedom suffered in the second phase. Anyone who had an opinion counter to Mao Zedong’s was considered as an enemy of the revolution. Television channels were reduced to five. 43 newspapers, which were published were controlled by the party itself. But printed media increased rapidly during 1957-1977 by 358%. Wired broadcasting, a system with speakers in rural China reached 99 million in 1980. It was mainly used for communicating with the rural population and to spread propaganda.

From 1978 to 1989 (third phase), under Deng Xiaoping’s rule there was a a media boom, especially in radio and later in television. In 1987, 55% of China’s population had access to television. Deng Xiaoping wanted to achieve economic independence by freedom of press.

From the Tiananmen uprising in 1989, when students demonstrated for more freedom, democracy and against governmental corruption, until today, there have been stricter restrictions of freedom of press and surveillance by the government. To circumvent this, people and organizations started to use their own distribution networks, like The Guangzhou Ribao, the daily newspaper in Guangzhou. This opened new markets for commercialization.

Television gained more popularity. Ownership of television increased many times. It became a status symbol and economic growth. But from 1980 to 1991, film audiences decreased by almost 50%.

When the Communist Party of China gained power, it created media outlets like the Xinhua News Agency, which became the mouthpiece of the government. Independent media is also regulated by the government.

China Media Today

There are still many restrictions on freedom of press.

Demographic. China has a literacy rate of 95%. The internet population is growing with about 600 million users. Over 90% of the internet population has a social network account and spends an average of 46 minutes a day on it. Most users of internet live in urban areas (72%). The number of mobile phones users hit 1.22 billion in 2013. One can say that in China new technologies are part of the daily life.

The majority of the people living in China are in the age between 25 and 54 (46.7%). The younger generation from 19 to 25 years account only for 19% of social media users in China. The Chinese use different social networks than in other parts of the world.

• Qzone (700 million users) is the ruling social network for blogging, sharing music and photos.

• Weibo (500 million users) is an alternative to Facebook and Twitter combined.

• WeChat (300 million users) is like WhatsApp.

Legal Regulations. Article 35 in China’s legal code is saying that “citizens of the People’s Republic of China enjoy freedom of speech, of the press of assembly, of association, of procession and of demonstration.” But in 1994, the propaganda department established the Six No’s, including:

•   No private media ownership.

•   No shareholding.

• No joint ventures with foreign organization.

•  No discussion of nature of news/press law.

•   No openness for foreign television.

Besides the No’s there is a “Chinese Newspaper Self-Discipline Agreement” what is saying that journalists must strictly follow all regulations and rules passed by the government. Further, discussions about passed laws and control of the CCP is forbidden.

Article 41 in China’s legal code says that Chinese citizens have the right to criticize the government, but Article 51 says the opposite: “Chinese people may not infringe upon the interest of the state.” The CCP’s central propaganda department ensures this.

Economic Influences. Economic development has had a big impact on the media development. In 1992 all newspapers were subsidized by the state. Today all newspapers and television stations, especially those not owned by the government, are mainly financed by advertisement. The media is increasingly focusing on business and entertainment and not anymore on reporting the latest news.

The Chinese government has difficulties in controlling the media. Hence, it censors the internet in many ways. Some Google and Facebook are totally censored and Wikipedia pages are put offline in times of major discussions in China. Instead, Qzone, Weibo and Wechat are the ruling social networks in China.

Netizens try to circumvent censorship by using proxy servers, to contact western media and banned social networks like Facebook. As many as 95 million Chinese could be on Facebook.

Talk Radio is known to be the freest media, where people anonymously discuss China’s problems. Talk Radios are very popular in China and the CCP is a little reserved into getting into conflict with its citizens.

Mass Media Infrastructure

China’s mass media has been growing since the 1980’s. Due to a range of technologies, it is more diversified, including wired systems, satellite, and the internet. With almost 2,000 newspapers, 9,000 magazines, 273 radio stations and 352 television stations they cover all kinds of different topics.

Xinhua News Agency, located in Beijing, is the primary and largest news agency. It is also considered as one of the world’s leading news agencies with 100 branches worldwide. By purchasing many other Asian news agencies in Japan, South Korea and Singapore it has achieved an influential status. China News Service also supplies news to Chinese living overseas.

Print Media. State run newspapers like the People’s Daily are more traditional and propagate the party’s interest. Other commercial newspapers showcase greater freedom with increasing diversity. All printed media is controlled by the CCP. Many follow Xinhua News Agency, which reflects official polices and promotes government propaganda.

Reference News (3.4 million daily and owned by Xinhua News Agency), People’s Daily (2.8 million) and Global Times (2 million) are the laregst newspapers. None of the major newspapers reflect any different point of view than CCP’s.

Local newspapers display a great variety and are more liberal orientated, even covering corruption among party workers.

Television and Radio. China has one large Radio station called China National Radio with 9 channels. Every province and region has its own local radio stations. China Radio International (CRI) is for the western world.

China Central Television (CCTV) is one large state-owned television network with 20 channels. It is state run and is a party organ of the CCP. It focusses more on news and traditional entertainment. Through its relationship with over 250 other television organizations in 130 countries it has a global impact. CCTV’s viewership is declining due to that fact that the younger generation prefers other outlets.

Other TV stations and several local and regional TV stations like Hunan TV Phonenix TV, Dragon TV and Travel TV display entertainment, documentaries and news. Almost every province has at least one satellite TV network.

Due to censorship all television channels including “independent” companies usually do not push the boundaries on news reporting.

Internet

2,000 out of 10,000 traditional newspapers are available on the internet. News pages like New York Times and BBC are censored.

• Qzone (712 million users) is targeted towards high school students and younger rural kids.

•  Weibo is similar to Twitter, (500 million users)

•  Gaming networks like 51.com has 259 million users.

Google is censored, and instead, Baidu is the dominant player in China’s search engine market (80% market share).

It is impossible to censor a post right away which leads to an easy exchange of information through networks like Weibo long before the official news.

Legal Framework

The “Chinese Newspaper Self-Discipline Agreement” says that journalists must strictly follow all regulation and rules passed by the government. Licensing for a newspaper business in China is very complicated.

Censorship. The Central Propaganda Department of the CCP is responsible for the media representing the party’s interest. It is common that reporters and editors censor themselves. People who report on secrets of the government or for example, revolution, have to face tough consequences and long terms in Chinese prisons.

Foreign journalists do censor themselves because they are worried about not getting a visa again. Many journalists do not know where the red line is, hence they must be even more careful.

The CPD has influence on every part of the media through the “50 cent” army.

On social networks like Weibo, the CPD allows government criticism but silences collective expression. It is all done by keyword filtering, a 20,000 to 50,000 internet police and the “50 cent” army.

Western/American Influence

Western way of life or the American way of life has a huge impact in China. An increasing number of people prefer to watch “idol style” shows instead of the state owned television stations which show more documentaries and news. The CPD wants to cut back on American-style television like singing competitions by restricting the timings, despite being popular.

The authorities do not like the populist and western input that the shows promote. In addition, the voting system in singing competitions promote a democratic way of thinking. All of this could than lead to problems for the Chinese government.

Conclusion

The Internet and new forms of media are more open and diverse. The majority of Chinese people do not really mind censorship because they perceive their culture as something unique. China’s internet environment is led by Weibo, Tencent, Baidu and many other small organizations. Rural television medium plays a significant part in conveying information to the Chinese people.

The Chinese legal framework is very controversial and it gives the CCP complete control over media freedom. In China all the media is controlled by the CPD. The Central Propaganda Department is using hard power approach for limiting media freedom in China. Reporters including foreign journalists are censoring themselves worried about the results if they write the whole truth.

As regards internet and social networks, the CPD focuses more on preventing collective actions than just individual critical posts about the government. The impact of Western and American style of media is not welcomed by Chinese authorities because they are worried about western inputs that could potentially lead to loss of power.

China’s Malicious Use of Social Media

China uses a variety of methods to spread its narrative abroad through social media, including:

Government-controlled media: China has a large state-run media apparatus that includes major news outlets such as Xinhua and CCTV, which are used to disseminate official government views and information to a global audience.

Social media platforms: China has a large presence on global social media platforms such as Twitter, Facebook, and YouTube, where it uses official and unofficial accounts to disseminate information and engage with foreign audiences.

Influencers and opinion leaders: China uses a network of influencers and opinion leaders, including scholars, business leaders, and celebrities, to promote its views and interests abroad.

Fake news and disinformation: China has been accused of spreading false information and disinformation through social media platforms in order to influence public opinion and shape global perceptions of China.

Censorship and control: China censors and controls the information that is available on social media within its own borders and also the information that is disseminated abroad to control the narrative about China.

Cyber-espionage: China has been known to use cyber-espionage techniques to hack into foreign social media accounts and steal information that can be used to spread disinformation or to silence critics

Artificial intelligence and automation: China is also known to use AI and automation to amplify its voices on social media and to spread disinformation at scale.

China’s approach to social media is often seen as an attempt to shape global perceptions of China and to advance its own interests and agenda.

The post Chinese Media System for Mass Control appeared first on IMR.