Uncovering the Unknown: A New Initiative to Monitor Undermonitored Regions

Geopolitics: New Threat Intel Effort to Study ‘Undermonitored’ Regions

The Need for Attention in Africa and Latin America

A new cyber threat intelligence working group has been established to focus on understanding complex cyber operations in Africa and Latin America. The organizers argue that these regions have been historically neglected by cybersecurity researchers and call for greater attention and resources to be dedicated to studying them. The “Undermonitored Regions Working Group” aims to improve visibility in areas where geopolitical rivalry has led to an increase in cyber operations but lacks investment, focus, and attention from the wider cybersecurity community.

In a blog post accompanying his talk at SentinelOne’s second annual LABScon threat research security conference, Tom Hegel, a senior threat researcher with SentinelLabs, highlighted the importance of these regions in shaping the battlegrounds of the future. Hegel criticized the habit of overlooking regions that do not immediately serve immediate financial interests, stating that overlooking these areas allows threat actors to subtly shift the balance of negotiations and play pivotal roles in larger geopolitical strategies.

Objectives of the Working Group

The “Undermonitored Regions Working Group” aims to collaborate on understanding intrusions, delivering intelligence to victims and defenders, and potentially creatively disrupting operations. Currently, the group consists of researchers from several cybersecurity vendors and a policy researcher focused on China. Hegel mentioned that he is looking to add members who can make a substantial impact.

China’s Offensive Cyber Operations in Africa

The formation of the group comes at a time when China is deploying offensive cyber operations to support its broader soft power agenda in Africa. According to Hegel, intrusions tracked by him, his team, and others align with Chinese investment efforts, which critics refer to as “debt trap diplomacy.” These intrusions target telecommunications, financial institutions, and governmental bodies.

Earlier this year, SentinelLabs threat researchers published an analysis of Chinese cyberespionage activity targeting telecommunications entities in the Middle East, part of a global effort dating back more than a decade. Hegel revealed that the same attackers compromised an unnamed telecommunications entity in North Africa, which aligned closely with Chinese telecommunications soft power interests in Africa.

The Role of Chinese Influence and Technology in Africa

Chinese espionage operations targeting African countries have increasingly garnered attention in recent years. In 2018, an investigation by French newspaper Le Monde revealed that the Chinese government had backdoor access to servers in the African Union’s headquarters in Ethiopia. The building was funded and built by China, with network technology and services provided by Chinese tech giant Huawei. It was also reported that a separate group of Chinese-linked hackers stole security camera footage from within the building.

The widespread use of Chinese technology across the African continent, coupled with cases where this technology has been utilized to target and silence political opponents, underlines the need for more resources to understand cyber operations in Africa. Hegel argues that the intricate connection between geopolitics and cyber threats demands attention throughout the cybersecurity industry.

Internet Security and the Importance of Understanding Undermonitored Regions

The establishment of the “Undermonitored Regions Working Group” highlights the need for increased focus on cyber operations in regions such as Africa and Latin America. Neglecting these areas leaves them vulnerable to cyber threats and allows geopolitical dynamics to shape the evolving digital landscape. Understanding these regions and the cyber operations occurring within them is crucial in the face of growing challenges posed by state-sponsored actors and their influence.

Editorial: Broadening the Scope of Threat Intelligence

The formation of the “Undermonitored Regions Working Group” is an important step in broadening the scope of threat intelligence and addressing the historical neglect of regions like Africa and Latin America. It showcases the significance of geopolitical factors in cyber operations and emphasizes the need for a global perspective in the cybersecurity industry.

By expanding our understanding of cyber threats in undermonitored regions, we can develop strategies to mitigate risks and protect against potential cyber attacks. This requires investment in research and resources, as well as collaboration between governments, cybersecurity vendors, and policy researchers.

Advice: Prioritizing Research and Collaboration

The “Undermonitored Regions Working Group” should prioritize research efforts to comprehensively study cyber operations in Africa and Latin America. By focusing on these regions, the cybersecurity industry can gain insights into threat actors’ strategies and tactics, helping to develop effective defense mechanisms.

Collaboration is vital in this endeavor, and the working group should actively seek members who can contribute their expertise and make a substantial impact. Governments, cybersecurity firms, and policy researchers should join forces to share intelligence, collaborate on threat assessments, and develop strategies to counter cyber threats in undermonitored regions.

Furthermore, the findings and insights gained from studying undermonitored regions can be utilized to inform global cybersecurity policies and practices. Recognizing the role of geopolitics in cyber threats is crucial to prevent the exploitation of vulnerable regions and ensure the security of both local and international digital landscapes.