دانلود کتاب هنر جنگ سایبری – راهنمایی برای جاسوسی، باج افزار و جرایم سایبری سازمان یافته

In late January 2014, a system administrator at Anthem, at the time one of the world’s largest health insurance providers, made a troubling discovery. The previous night, someone had used their account to execute several queries intended to collect sensitive customer data from Anthem servers. In doing so, the attacker had stolen personally identifiable information (PII) associated with nearly 80 million Anthem patients. In 2015, cybersecurity vendors Trend Micro and Symantec identified the attacker: dubbed Black Vine, they were believed to originate from a country in southeast Asia. Moreover, the vendors’ research indicated that the operation wasn’t a mere grab at financial gain, as most had assumed, but instead one step in a large-scale espionage operation. I conducted some of this initial research; more information became available four years later, when a U.S. federal indictment accused multiple Chinese hackers of participating in the operation against Anthem. The indictment claimed the attackers had targeted a program responsible for conducting background investigations for U.S. citizens who apply for a security clearance. Anthem provided healthcare benefits to U.S. federal government employees, so by comparing the stolen healthcare data with travel information disclosed in security clearance investigations, the attacker was able to correlate a list of individuals they believed to be CIA intelligence operatives secretly working in Africa and Europe.