Attack refrigerators, divert flights, undermine elections... Cyber ​​pranks or hybrid war to destabilize Europe?

Are the wave of attacks on the refrigeration systems of supermarkets and the French blood bank connected to the diversion of planes due to bomb threats? This is a question that many people are asking right now in Europe. EU leaders openly attribute this succession of attacks to a "hybrid war" sponsored by hostile states interested in destabilizing European democracies. However, cybersecurity and cybercrime experts, given the lack of evidence from open official investigations, do not rule out that behind these cybercrimes there is a wave of social 'hacktivism' or sabotage for pure entertainment.

The summary of the latest that has happened is as follows: on the night of October 12, more than 13,000 supermarkets throughout France had their refrigeration systems hacked: the mode of all of them was changed remotely from "cooled" to "defrosted." Two weeks later, in a second wave of similar attacks, supermarkets in half a dozen European countries (Belgium, Luxembourg, Sweden, the Netherlands, Ireland, Finland, Italy and Romania) had their refrigerators hacked.

This same week the French Ministry of Health confirmed another attempt to sabotage refrigeration systems, but this time hospital ones, those of the French blood bank, where an attempt was made to raise the temperature from -30 to 100 degrees Celsius. The attack, fortunately, was detected before it was too late, saving plasma and blood reserves for research and transfusions. Furthermore, in recent days, around fifty planes from different airlines to and from Europe received a chain of bomb warnings that required them to be diverted by regulations. Threats that in the last day also affected several European media outlets, which had to evacuate their workers.

The Minister of Foreign Affairs of Spain, José Manuel Albares, assured this Friday that it will be known who is behind the attacks on meat processing plants or the threats to airplanes and described them as "hybrid aggression." "It will take some time to know what happened but we will know," said the minister, who considers that these events are an attempt at "hybrid and, in some way, psychological aggression." Albares attributes this to the fact that there are actors in the world who try to weaken Europe because it is the great bastion of democracy.

Through social networks, three hacker groups, some with evident pro-Russian bias—Noname57 and Z-Pentest—have claimed responsibility for the attacks on the refrigerators and another, called the “Male State,” has put its stamp on some of the bomb threats that diverted planes. However, claiming cyber responsibility does not always mean being behind the attacks.

Several cybersecurity experts consulted by 20 minutes agree that we are facing something new, unknown and disconcerting. They base this on the fact that the attacks were not aimed at extorting a company - as it seemed at first with the hacking of refrigerators from the Finnish brand Danfoss, when equipment from another company, Copeland, was later attacked - and on the fact that they attacked targets in sectors that, although not considered "critical" - such as electricity, gas or nuclear - are "fundamental" in the daily lives of European citizens, aviation and food.

David Arroyo is the only CSIC cybersecurity researcher. As head of the GICP, he is dedicated to analyzing the entire cybercrime ecosystem, starting from classic attacks to the most dangerous ones. Arroyo explains that, to date, there is no evidence that the attacks on the refrigerators and the false bomb warnings on board are coordinated, but he does place them in the so-called "gray zone" (between peace and war) as "hybrid threats." In addition, he warns that "more things are going to appear that seem to respond to a plan, the panorama being as convulsive as it is."

Juan Miguel Velasco, a cybersecurity expert with more than 30 years of experience, also contextualizes these "chained attacks" in "a moment of general tension" and recognizes that no one knows for sure who is behind them. "When we see an attack on a company we know how to proceed, but when it seems that someone attacks you for the sake of attacking, just because, it is very disconcerting and we are facing something new," he adds.

Refrigerators, exposed and vulnerable

For his part, Antonio Muñoz, professor of cybersecurity at the University of Malaga, expert in hardware cybersecurity and member of the NICSLab research group, asks to wait for results of the investigations opened in the affected countries, but does not rule out the political-social aspect of attacks that "definitely are not 'ransomware', because there was no economic interest." Regarding the hacking of the refrigerators, the case he is most familiar with, he points out that the cybercriminals had it easy.

Muñoz says that these were "cyberphysical" attacks, since the constants of the equipment installed in thousands of stores were modified from outside thanks to an obvious vulnerability in remote access. "The Internet connection of the refrigeration provides versatility when it comes to monitoring and controlling the systems, but it opens up a larger attack surface. Because the problem is that the network that connects is not protected," he reveals.

There are many voices that in recent days have pointed out the high exposure to hacking that computers connected to the Internet have. In this specific case, accessing the refrigerators of thousands of supermarkets seems to have been as easy as finding them in open repositories on the Internet, typing the key "supervisor" and the password "12345." This is how Muñoz sees it: "The strength of cybersecurity is in the weakest link of the chain. The attacks come because an operator makes a security breach, does not update the password, or leaves the key exposed in a file."

This expert believes that "a single person can orchestrate it and carry out the attack, but it is not just anyone," he points out, "doing it is possible, but it is more difficult to leave no trace. Furthermore, attacking thousands of different stores requires having everything very well tied up. It was planned."

Regarding the authorship of the attacks on the cold systems of the food sector in half of Europe, CSIC scientist David Arroyo believes that, since it does not have a very sophisticated technical implication, "Korean hackers or Russian hackers, who are the elite, do not have to come into play, and it could be the work of a group of 'hacktivists', of activists who use networks to destabilize at a time when we have strong social pressure on the streets of Europe due to the economic and political situation."

Bomb warnings on airplanes, criminal cyberbullying

For Arroyo, however, false threats of bombs on airplanes are a different matter. It falls within what is called a swatting attack, a form of criminal harassment that consists of deceiving the emergency services. In the United States, he explains, this is done on a recurring basis and there is even a database that allows traceability to quickly discard false notices. "It is the typical hooliganism that is now a digital hooliganism," explains this expert, "Here the cybernetic aspect comes because single-use emails are used, shielded by VPN so that the IP cannot be traced well. That is, the digital medium is used to hinder any attribution work."

In this case he also sees the two possibilities raised in the authorship of the refrigerators: either an action by digital activists, or a hybrid war strategy through 'sponsorship' of hostile states. "There is not enough evidence to rule out those two big possibilities."

Hybrid threats and lack of coordination

NATO's definition of a "hybrid threat," as Arroyo recalls, says that it is one that uses several domains to achieve a final impact on the user. Hence, no one doubts that both situations occur in the recent attacks, but also in the violation of borders with the instrumentalization of migration or even in the creation of groups to encourage violent altercations and looting, such as Blocus. And he assures that from now on "everything is going to be a hybrid threat."

According to Arroyo, we live in a "state of continuous cyberwar," and he believes that the volume of cyberattacks and their diversity, sectoral and geographical, distance the theory from hooliganism. "It's hard to think that it is a digital hooliganism, but it is also risky to say that it could be a global strategy to destabilize Europe. Are there signs? Yes, but we lack the evidence. And that is very difficult to achieve, it can take months or not be resolved at all," he says.

"Right now I don't see any evidence that leads me to point out that there is a State 'sponsoring' all of this," insists Arroyo. But he points out that it does not solve anything that does not exist, that neither Russia, Iran or Israel are behind it. "The situation of instability is already worrying enough to begin to take seriously these issues that until now seemed like a movie to us."

The fact that the recent attacks are limited to Europe, for cybersecurity expert Juan Miguel Velasco, may have to do with the excess regulation in data protection that makes collaboration between States difficult for action on cybercrisis. "When they try to harm us we react late, but we also make a lot of noise. While other actors, like the US or China, are more silent. In Europe we tell everything they do to us, we give popularity to whoever attacks us, whether it is successful or not, and that excess is very profitable, it generates a wave of public opinion that can spread."