Latest / Tech Talks With Kinsoft / Inside the Australian Defence Supply Chain Cyberattacks

Transcript

Inside the Australian Defence Supply Chain Cyberattacks · Tech Talks With Kinsoft

• 0:00
  Hello and welcome to Tech Talks with Kinsoft.
• 0:03
  We are so glad you're here with us today. We're
• 0:04
  jumping straight into the deep end. We really
• 0:06
  are. We have a stack of reports, breach notifications,
• 0:11
  and some, well, some pretty alarming intelligence
• 0:13
  warnings that paint a really stark picture. It's
• 0:18
  about where the Australian defense industry stands
• 0:20
  right now. And honestly, it is a massive wake
• 0:25
  -up call. Wake -up call is probably a... Putting
• 0:27
  it mildly, if you've been following the headlines
• 0:29
  at all. Or even if you haven't. Yeah, exactly.
• 0:31
  What's happened recently with the Australian
• 0:33
  supply chain is, I mean, it's a masterclass in
• 0:36
  how modern warfare is shifting. Shifting how?
• 0:39
  It's moving from the battlefield, you know, directly
• 0:41
  into the server room. We're talking of the soft
• 0:43
  underbelly of defense. Yeah. I think people tend
• 0:45
  to look at the big stuff, submarines, the jets,
• 0:48
  and think that's the only risk. Right. But today
• 0:51
  we're looking at the... Piping manufacturers
• 0:54
  and the turret suppliers. Specifically, we're
• 0:57
  unpacking the massive breach at ICAT Engineering
• 1:00
  and then the data leaks around the Redback infantry
• 1:03
  vehicle. And we're not just, you know, recounting
• 1:06
  the news here. Our mission today is to figure
• 1:08
  out how two very different groups, a criminal
• 1:12
  gang. J Group and a hacktivist collective called
• 1:16
  Cyber2Fin managed to walk right through the back
• 1:19
  doors. And maybe most importantly, we are going
• 1:22
  to dismantle a really dangerous myth I see all
• 1:25
  the time. Ah, yes. This idea that there's such
• 1:27
  a thing as non -sensitive data. That distinction
• 1:31
  sensitive versus non -sensitive, it is quickly
• 1:34
  becoming the biggest liability in cybersecurity.
• 1:36
  It's a comfort blanket that is, frankly, suffocating
• 1:40
  people. Before we get to all that, I want to
• 1:42
  start with a concept that really stuck out to
• 1:43
  me. Okay. This idea of a cyber staycation. It
• 1:46
  sounds kind of pleasant, doesn't it? It does.
• 1:48
  Like you're taking a break at home. But in our
• 1:50
  context, it is the exact opposite. It's nightmare
• 1:54
  fuel. Absolutely. We usually picture cyber attacks
• 1:56
  as a smash and grab. You know, break the window,
• 1:59
  grab the jewelry, run. Get in, get out before
• 2:01
  the cops come. But in the case of the ICANN engineering
• 2:03
  breach, that is not what happened. The attackers
• 2:06
  didn't run. No. They moved in. They lived inside
• 2:09
  the system for 150 days. Five months. That is
• 2:13
  an eternity in digital time. Just think about
• 2:17
  the level of intimacy that implies. Intimacy
• 2:20
  is a good word for it. If someone is in your
• 2:22
  network for five months, they aren't just stealing
• 2:24
  files. They're learning your culture. They know
• 2:27
  who goes to lunch when. They know how the CEO
• 2:29
  signs off their emails. They know which IT admin
• 2:32
  gets a bit lazy with password resets. You got
• 2:35
  it. That's nearly half a year. Imagine someone
• 2:38
  sitting in your office, reading your mail, looking
• 2:41
  through your files every single day for five
• 2:43
  months, and you have no idea they're there. That's
• 2:46
  the level of compromise we're talking about.
• 2:48
  It creates a situation where the attacker knows
• 2:50
  the network better than the defenders do. And
• 2:52
  that dwell time, that's the technical term, is
• 2:55
  what allowed them to do so much damage. So let's
• 2:59
  look at the victim here, ICAD engineering. For
• 3:01
  anyone who might not be... deep in the procurement
• 3:04
  weeds, who are they? ICAT is what we call a critical
• 3:06
  subprime. They aren't a household name like,
• 3:09
  say, Lockheed Martin or BAE Systems. Right. You
• 3:12
  won't see their logo on the side of a fighter
• 3:14
  jet. Exactly. But they are a key player. They
• 3:18
  specialize in mechanical and structural engineering.
• 3:22
  So what are they actually building? Think heavy
• 3:24
  lifting, piping, pumps, marine insulation. A
• 3:29
  lot of work for naval and industrial projects.
• 3:32
  They are the gears in the machine. So they aren't
• 3:35
  building the missiles, but they're building the
• 3:36
  things that make the ships that carry the missiles
• 3:38
  actually work. Precisely. And that makes them
• 3:41
  a prime target that, well, maybe nobody is watching.
• 3:45
  Oh, so? If you want to stop a ship, you don't
• 3:47
  need to blow up the hull. You just need to mess
• 3:49
  with the pumps that keep it afloat or the cooling
• 3:51
  systems for the engine. And that's where the
• 3:53
  attackers come in. We've got a group called J
• 3:55
  -Group. Sounds like a boy band. Acts like a digital
• 3:58
  cartel. In the reports, they're called a ransomware
• 4:00
  gang. But their behavior here felt different,
• 4:05
  more calculated. J Group is interesting. Usually
• 4:08
  ransomware gangs are noisy. They encrypt your
• 4:10
  files, lock you out, demand payment, quick turnover.
• 4:13
  Right. But here, the sophistication suggests
• 4:15
  they knew exactly what they were stealing. They
• 4:18
  used a technique called living off the land.
• 4:20
  I've heard this term thrown around. It sounds
• 4:22
  like a survivalist show. In a way, it is. It's
• 4:25
  survivalism for hackers. It means the attackers
• 4:27
  didn't bring in a bunch of their own custom malicious
• 4:30
  software that would, you know, trip an alarm.
• 4:32
  They didn't install some flashy hack tool. Nope.
• 4:35
  Instead, they used the tools that were already
• 4:38
  there. They used the system administrator's own
• 4:40
  toolkit against them. So if the IT team uses
• 4:43
  a remote desktop tool to fix a printer, the hackers
• 4:47
  use that exact same tool to steal a file. That's
• 4:50
  it. To a security system that isn't tuned correctly,
• 4:53
  it just looks like an employee doing their job.
• 4:56
  Oh, look, the admin is moving files. Except it
• 4:59
  isn't the admin. It's JGroup, using the admin's
• 5:01
  credentials and software. It's incredibly sneaky.
• 5:03
  It's hiding in plain sight. But how did they
• 5:05
  get in initially? Was it some sophisticated zero
• 5:08
  -day Mission Impossible stuff? I wish. The reports
• 5:12
  point to an exploit of a known vulnerability
• 5:14
  in an older VPN appliance. A VPN appliance. The
• 5:18
  very thing that's supposed to keep us secure.
• 5:20
  That's the irony, isn't it? Security tools, if
• 5:23
  you don't patch them, they become the vulnerability.
• 5:25
  It's like installing a steel door but leaving
• 5:27
  the key under the mat. J Group found the key
• 5:30
  under the mat. They found the note under the
• 5:32
  mat telling them where the key was. Okay, so
• 5:34
  they get in, they spend five months living off
• 5:37
  the land, moving laterally, which I assume means
• 5:40
  hopping from computer to computer. Yep. And they
• 5:43
  started collecting data. They actually used a
• 5:45
  phrase that sent a shiver down my spine. They
• 5:48
  said they curated a museum of corporate secrets.
• 5:51
  That phrase, curated a museum, it really speaks
• 5:54
  to their arrogance, but also their method. They
• 5:57
  weren't just looting. They were cataloging. And
• 5:59
  when they finally exfiltrated the data, they
• 6:02
  took 800 gigabytes. 800 gigs. That is massive.
• 6:06
  We're not talking about a few spreadsheets here.
• 6:08
  No, we're talking about a significant chunk of
• 6:11
  the company's digital brain. Employee files,
• 6:14
  passport scans, HR info, which is a nightmare
• 6:18
  for the staff. Identity theft waiting to happen.
• 6:20
  Big time. But operationally, they took client
• 6:22
  communications, invoices, and technical documentation.
• 6:26
  Specifically, CAD drawings. CAD drawings. The
• 6:30
  blueprints. Essentially, yes. And the connection
• 6:32
  here is to major projects. The files pertain
• 6:35
  to the Hunter Class Frigate Program and the Collins
• 6:38
  Class Submarine Program. The submarines. Okay,
• 6:41
  that's the crown jewel. And this is where the
• 6:43
  story gets into a bit of a he said, she said
• 6:46
  situation. Right. ICAD CEO Gerard Dyson confirmed
• 6:50
  the access, but he was very specific. He said
• 6:53
  it was limited to non -sensitive project information.
• 6:56
  Which is the standard crisis comms playbook.
• 6:59
  You want to contain the panic. You want to say
• 7:01
  it's bad, but it's not catastrophic. The hackers,
• 7:04
  they weren't having it. They openly mocked that
• 7:07
  claim. They basically said non -sensitive. We
• 7:09
  have the designs for the pumps that go into your
• 7:11
  submarines. And that is where the non -sensitive
• 7:13
  myth just completely falls apart. This is the
• 7:16
  part I really want people to understand. Let's
• 7:18
  drill into that. To me, or to a business executive,
• 7:21
  a pump is a pump. It moves water. Why is a drawing
• 7:25
  of a pump a national security risk? Think about
• 7:27
  submarine warfare. The entire game is silence.
• 7:31
  You want to be a hole in the water. Exactly.
• 7:33
  To be silent, you need to manage vibration and
• 7:36
  acoustic noise perfectly. The pumps, cooling
• 7:39
  pumps, hydraulic pumps, they are primary sources
• 7:42
  of mechanical noise. So if I have the blueprints
• 7:45
  for the pump... If you have the blueprints, you
• 7:47
  know the flow rates, you know the RPM, you know
• 7:50
  the materials, the tolerances. From that, a sophisticated
• 7:54
  adversary can calculate the... acoustic signature
• 7:57
  of that submarine. You can figure out exactly
• 7:59
  what it sounds like underwater. You got it. And
• 8:01
  if you know what it sounds like, you can program
• 8:03
  your torpedoes or your sonar to look for that
• 8:05
  specific sound. So that nonsensitive drawing
• 8:08
  of a water pump. becomes the key to tracking
• 8:11
  and syncing a multi -billion dollar asset. That's
• 8:14
  the connection. It's terrifying. It completely
• 8:16
  reframes what we consider sensitive. It's not
• 8:18
  just the secret weapon. It's the nuts and bolts
• 8:21
  that hold it together. And it caused a lot of
• 8:23
  confusion in the supply chain. A huge amount.
• 8:25
  You had the ASC, the Australian Submarine Corporation,
• 8:28
  claiming ICAT isn't even a supplier. Right. And
• 8:31
  holds no sensitive data. Meanwhile, BAE Systems
• 8:34
  confirmed ICAT is a supplier and they were managing
• 8:37
  the situation. It sounds like the left hand didn't
• 8:39
  know what the right hand was doing, or maybe
• 8:41
  just how far down the chain the data had traveled.
• 8:43
  That's it. The visibility creates a fog, and
• 8:47
  JGroup used that fog. But ICAD wasn't the only
• 8:50
  wake -up call. We have to talk about the Redback.
• 8:52
  Yes, the Redback Infantry Fighting Vehicle. This
• 8:55
  is part of that huge $7 billion Land 400 program
• 9:00
  for the ADF. A next -generation vehicle. And
• 9:02
  this attack was different. This wasn't J -Group.
• 9:04
  This was a group called CyberDufan. Okay, and
• 9:06
  why does that distinction matter? Well, J -Group,
• 9:08
  as we said, is criminal enterprise. They want
• 9:11
  leverage. They want money. CyberDufan is described
• 9:14
  as an Iran -backed hacktivist group. So they
• 9:17
  aren't looking for a payday. No. They're looking
• 9:19
  for disruption. They want to influence geopolitical
• 9:22
  conflict. Specifically, they target entities
• 9:25
  connected to Israel. Right, because the Redback
• 9:27
  has turret systems supplied by Israeli defense
• 9:30
  companies. Exactly. So CyberTufan didn't hack
• 9:33
  the Australian army directly. They hacked the
• 9:36
  Israeli suppliers. And in doing so, they found
• 9:39
  high -res images, technical drawings. About the
• 9:43
  Redback vehicle. destined for Australia. And
• 9:46
  they posted it all on Telegram. Which has really
• 9:48
  become the public square for these leaks, hasn't
• 9:50
  it? It has. It's accessible. It's fast. But the
• 9:53
  key here is that it's collateral damage. Australia
• 9:56
  wasn't the primary target, but our secrets were
• 9:59
  in the filing cabinet that got raided. It just
• 10:01
  shows you can't view your security in isolation.
• 10:05
  Your security is only as good as a supplier in
• 10:07
  a completely different hemisphere. It's the global
• 10:10
  village of defense manufacturing. And right now,
• 10:13
  the village has some broken fences. So what does
• 10:17
  this all mean for the non -sensitive data miss?
• 10:19
  We keep going back to this. Can we dig deeper
• 10:22
  into why that label is so misleading? I think
• 10:24
  it's the most dangerous term in modern cybersecurity.
• 10:27
  It creates a false sense of security. Companies
• 10:30
  think, well, we don't hold the nuclear codes,
• 10:32
  so we're not a target. But the bad guys don't
• 10:34
  need the codes if they have the map to the room
• 10:36
  where the codes are kept. That's a perfect analogy.
• 10:39
  Let's look at it through the lens of what intelligence
• 10:41
  agencies call mosaic theory. Mosaic. Imagine
• 10:45
  a mosaic. One little tile. It's just a blue square.
• 10:48
  It means nothing on its own. Right. That's your
• 10:49
  non -sensitive invoice or your staff roster.
• 10:52
  But if an intelligence agency steals 10 ,000
• 10:55
  of those tiles and puts them all together. They
• 10:57
  see the whole picture. They see the military
• 10:59
  capability. They see everything. If I have your
• 11:01
  staff roster, I know when your surge periods
• 11:03
  are. If I have your invoices, I know who your
• 11:04
  subcontractors are. If I have your project timelines,
• 11:07
  I know when a ship is launching. None of those
• 11:09
  documents are marked secret, but together they
• 11:11
  provide a roadmap. An exact roadmap. Yeah. It
• 11:14
  tells you who the weak links are. If I know a
• 11:16
  major defense prime uses a specific small engineering
• 11:20
  firm for, say, their HVAC systems, and I know
• 11:24
  that firm has weak security. You hack the HVAC
• 11:27
  guy. You hack the HVAC guy. You live in their
• 11:29
  system for 150 days. You learn their email patterns,
• 11:32
  their invoice numbers. Then you send a legitimate
• 11:35
  looking email from that trusted partner to the
• 11:38
  big defense contractor. And because it's coming
• 11:40
  from a known partner, they open the malicious
• 11:42
  attachment. And you're in. It's all about exploiting
• 11:45
  those trust relationships. Adversaries target
• 11:48
  the smaller firms to get the language and patterns
• 11:51
  they need. This brings us to the bigger picture.
• 11:54
  We're not just talking about criminals trying
• 11:56
  to make a quick buck anymore. No. We're talking
• 11:58
  about state -backed threats. ASIO has been pretty
• 12:01
  loud about this. Mike Burgess, the director general
• 12:04
  of ASIO, has been very blunt. He's warned that
• 12:07
  state backed hacking groups and he specifically
• 12:09
  mentioned efforts linked to China and Russia
• 12:11
  are intensifying their efforts to infiltrate
• 12:14
  our critical infrastructure. And their goal isn't
• 12:17
  just spying, is it? Espionage is part of it,
• 12:20
  for sure. But the more concerning goal is what
• 12:22
  they call pre -positioning. Pre -positioning.
• 12:24
  That sounds ominous. It is. It means getting
• 12:27
  into the water, power, transport or defense networks
• 12:30
  and just waiting. Laying the groundwork for sabotage.
• 12:32
  Exactly. The goal is to be able to disrupt these
• 12:35
  systems at a time of their choosing, say, during
• 12:38
  a geopolitical crisis. So the CyberStaycation
• 12:41
  J group took inside ICAD. A state actor could
• 12:45
  do the same, but instead of stealing data, they
• 12:48
  plant a logic bomb to shut down the manufacturing
• 12:50
  line three years from now. That is the threat.
• 12:53
  Imagine if we needed to ramp up production of
• 12:56
  the Redback vehicle because of a conflict, but
• 12:58
  the machines just wouldn't turn on because a
• 13:00
  sleeper code had been activated. And what's complicating
• 13:03
  all this is the convergence of these threats.
• 13:05
  The lines are blurring. They really are. Sometimes
• 13:08
  criminal gangs act as proxies for states. Sometimes
• 13:12
  states buy data from criminal gangs. J Group
• 13:15
  might have stolen that ICAD data for ransom,
• 13:17
  but who's to say they didn't sell a copy to a
• 13:20
  foreign intelligence service on the side? So
• 13:22
  you don't even know who you're fighting. It could
• 13:24
  be a guy in a hoodie or a military unit. Or both.
• 13:27
  Now, looking at where we are right now, February
• 13:29
  2026, it feels like we can't go a week without
• 13:32
  a new headline. The landscape is incredibly aggressive.
• 13:35
  Just recently, we've seen the active exploitation
• 13:38
  of a flaw in SolarWinds' web help desk. SolarWinds
• 13:41
  again? I feel like we've been talking about them
• 13:43
  for years. It's a recurring theme because it's
• 13:45
  such a ubiquitous tool. It's used everywhere.
• 13:48
  If you control the help desk software, you control
• 13:51
  the IT department. And if you control IT... You
• 13:54
  own the company. Yeah. And then you have the
• 13:57
  attack on Hansa Merkur, the German insurance
• 13:59
  giant. A ransomware attack by the Dragon Force
• 14:02
  gang. They claim to have stolen 97 gigs of data.
• 14:05
  It just reinforces that ICAD wasn't a one -off.
• 14:08
  This is a global escalation. If you have data
• 14:11
  or if you provide a critical service, you are
• 14:13
  on the list. It really drives home the point
• 14:16
  that this isn't going away. So taking all of
• 14:18
  this in the 150 -day dwell time, the non -sensitive
• 14:22
  data myth, what's the takeaway? If I'm a business
• 14:25
  leader or just managing IT for a mid -sized firm,
• 14:28
  I'm feeling pretty exposed right now. You should
• 14:30
  feel exposed. That's the first step. The key
• 14:32
  lesson here is that the perimeter is dead. You
• 14:34
  can't just build a wall around your company and
• 14:36
  think you're safe. The entire supply chain is
• 14:38
  your attack surface. So practically speaking,
• 14:40
  what do we do? First, vendor risk management
• 14:42
  is crucial. You have to know how secure your
• 14:44
  partners are. You need to audit them. You can't
• 14:46
  just trust. You must verify. Check their patching
• 14:49
  cadence. Exactly. And stop using the term non
• 14:53
  -sensitive as an excuse to be lax. Treat all
• 14:56
  data as if it has value. If it's worth keeping,
• 14:59
  it's worth protecting. And technically, network
• 15:02
  segmentation is vital. That's stopping that lateral
• 15:05
  movement we talked about. Right. If a hacker
• 15:07
  gets into the reception desk's computer, they
• 15:10
  shouldn't be able to just hop straight over to
• 15:11
  the server holding the submarine blueprints.
• 15:14
  You need internal blast doors. Blast doors. I
• 15:17
  like that image. Like on a ship. Precisely. If
• 15:20
  one compartment floods, the ship doesn't sink.
• 15:24
  J Group moved laterally because they could. The
• 15:27
  doors were wide open. We need to make that movement
• 15:30
  difficult. Make them work for it. Make them work
• 15:32
  for every inch. If they have to break down a
• 15:34
  door, every time they move, they make noise.
• 15:36
  And if they make noise, you catch them. So it's
• 15:38
  shifting from preventing entry, which seems impossible,
• 15:41
  to detecting presence. Yes. We need to catch
• 15:45
  them during the staycation, not after they've
• 15:47
  checked out with all your stuff. It's a lot to
• 15:49
  process. But I think the story of the cyber staycation
• 15:52
  is the one that's going to stick with me. It
• 15:53
  should. It forces you to ask the uncomfortable
• 15:55
  question. Which brings us to our final thought.
• 15:59
  We know J Group lived in a defense contractor
• 16:01
  system for five months, undetected. They watched,
• 16:05
  they learned, they cataloged. So the question
• 16:07
  is, if they can do that to a defense contractor
• 16:10
  who is currently vacationing in the networks
• 16:14
  of the apps and services you use every single
• 16:17
  day. Who is reading your emails right now? Who
• 16:19
  is watching your data flow just waiting for the
• 16:21
  most damaging moment to make their move? You
• 16:24
  assume your network is empty. But until you look,
• 16:27
  you don't really know. You don't. That is a chilling
• 16:29
  thought to end on, but a necessary one. Ignorance
• 16:33
  is definitely not bliss in this industry. No,
• 16:35
  it's not. Awareness is the first step to defense.
• 16:38
  Absolutely. Thank you so much for joining us
• 16:40
  on Tech Talks with Kinsoft. We hope this look
• 16:43
  at the defense supply chain has been eye -opening.
• 16:45
  It's always a pleasure to unpack these things.
• 16:47
  Let's just hope the next wake -up call isn't
• 16:49
  quite so loud. Now, if listening to this has
• 16:51
  made you a little sweaty about your own security
• 16:53
  posture or you're wondering if your supply chain
• 16:56
  is resilient enough, Don't just panic act. Right.
• 16:59
  Whether it's IT needs, security audits, or just
• 17:01
  figuring out where your non -sensitive data is
• 17:04
  exposed, you really do need expert help. Exactly.
• 17:07
  So head over to www .kinsoft .com .au. That's
• 17:12
  www .kinsoft .com .au to discuss your security
• 17:16
  and IT needs. They can help you lock those doors
• 17:18
  front, back, and digital. Thanks for listening.
• 17:21
  And stay secure out there.