VORANT. Threat Intelligence Sign in Get the full feed

Experts flag cybercrime's national-security nexus

medium threat financial-servicesenergygovernment-nationalhealthcaretechnology

Cybercrime increasingly blurs into national security as financially-motivated threat actors sell access to state-sponsored adversaries, infrastructure disruptions mount, and credential stealers fuel ransomware.

A panel of five cybersecurity experts from Santander, Flashpoint, US Secret Service, Maltego, and Recorded Future has highlighted how cybercrime has evolved from a purely economic problem into a national security threat. The shift was crystallized by the Colonial Pipeline and Kaseya ransomware attacks, which prompted governments to reclassify ransomware as a national security matter. Costa Rica's subsequent state of emergency declaration after nationwide Conti ransomware attacks further underscores this trend. Experts note that financially-motivated cybercriminals often unknowingly sell network access to state-sponsored adversaries, while nation-states may employ criminal proxies for plausible deniability. The FBI reported $7 billion in cybercrime losses in 2021, double the 2019 figure, with transnational criminal networks now capable of disrupting critical infrastructure and essential services.

The panel emphasized several emerging threats that warrant attention. Credential stealers like RedLine, Vidar, and Raccoon now correlate with 50 percent of ransomware attacks, as stolen credentials enable account takeover of network access. Access brokers enjoy a symbiotic relationship with ransomware groups, with an average 71-day gap between network access being sold on underground forums and subsequent ransomware deployment. Synthetic identity fraud has cost over $100 billion in stolen pandemic relief funds, while business email compromise schemes generated $2.4 billion in losses in 2021 alone, dwarfing ransomware's $49.2 million. Experts called for a holistic, internationally-coordinated approach that prioritizes hunting down criminals over defensive spending, stronger public-private partnerships, and enforcement actions like the Alexander Vinnik arrest and BTC-e shutdown to reinforce rule-of-law norms.

The discussion highlighted underreported threats including phishing, which despite its simplicity yields massive annual losses; SIM swapping that bypasses two-factor authentication; and supply chain attacks like SolarWinds. Panelists agreed that cybercrime's borderless nature demands cooperation across government, law enforcement, and private sector stakeholders, with the Budapest Convention on Cybercrime cited as a framework model, even as Russia proposes competing UN resolutions. The consensus view holds that skillful diplomacy, coordinated sanctions, intelligence sharing, and prosecutions that demonstrate rule of law remain the most effective tools to encourage international cooperation against transnational cybercriminal networks.

Mentioned in this report

Threat actors Conti
Malware RaccoonRedLineVidar

Detection guidance

Security Support Provider (SSP) Registration Added to LSA Configuration

ATT&CK T1556

Detects addition of a new DLL to the LSA Security Packages registry value, a technique used to register malicious Security Support Providers that intercept plaintext credentials during authentication, consistent with credential-stealer tooling referenced in the report. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Security Support Provider Registration in LSA
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith:
    - \Control\Lsa\Security Packages
    - \Control\Lsa\OSConfig\Security Packages
  filter_known:
    Details|contains:
    - kerberos
    - msv1_0
    - schannel
    - wdigest
    - tspkg
    - pku2u
  condition: selection and not filter_known
falsepositives:
- Legitimate software installing custom authentication packages (rare, e.g. some VPN
  or smartcard middleware)
- Group Policy updates that rewrite the Security Packages list with standard Microsoft
  values
level: high
tags:
- attack.t1556
- attack.credential_access
id: e2911db4-b4cf-5654-93e0-268eb3c63d33
status: experimental
author: Vorant

Process Execution with Invalid or Revoked Code Signing Signature

ATT&CK T1553.002

Detects execution of a binary whose Authenticode signature is present but invalid, expired, or unable to be verified, a pattern seen in supply-chain compromises (e.g. SolarWinds-style trojanized updates) where legitimate signed software is tampered with post-signing. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Execution of Binary with Invalid Code Signing Certificate
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Signed: true
  bad_signature:
    SignatureStatus:
    - Invalid
    - Expired
    - Revoked
    - UnknownSigner
  condition: selection and bad_signature
falsepositives:
- Expired internal code-signing certificates on legacy in-house tools
- Test or pre-release builds signed with certificates not yet trusted by the endpoint
level: medium
tags:
- attack.t1553.002
- attack.defense_evasion
id: 44aad5a2-929f-5bc9-9d54-c5257d25cae1
status: experimental
author: Vorant

Multiple Failed Authentication Attempts Preceding Success (Brute Force / Credential Stuffing)

ATT&CK T1110

Flags repeated failed logon events which, per the report, precede account takeover using credentials harvested by info-stealers such as RedLine, Vidar and Raccoon; analysts should correlate multiple occurrences (e.g. 5+ failures) from the same source or against the same account within a short window before a successful logon as the actionable brute-force signal. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Repeated Failed Logon Attempts Indicative of Brute Force
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventID: 4625
    LogonType:
    - 3
    - 10
  filter_lockout_test:
    TargetUserName|contains: test
  condition: selection and not filter_lockout_test
falsepositives:
- Password lockout self-testing by help desk or IAM teams
- Misconfigured service or scheduled task using stale credentials causing repeated
  legitimate failures
level: low
tags:
- attack.t1110
- attack.credential_access
id: 84934ef4-ebbe-5b0f-a586-6cb8ad65f77c
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-cybercrime-and-national-security

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free