Diplomatic Meetings as Targets for Syrian Cyber Attacks

The blog Dark Reading recently raised attention to possible retaliatory cyber attacks from Syria should there be military intervention in its civil war. We know that cyber attacks are common alongside kinetic events in significant conflicts, and as DR points out, the conventional weapons asymmetry that comes with a Western intervention makes a defensive cyber strike appealing. A cyber response  from Syria should be expected, but could we also see a preemptive  attacks?

If you’re a reader of this blog, you know that prominent pro-Assad hacker organization the Syrian Electronic Army (SEA) commonly uses a tactic called spear phishing that relies on social engineering to gain unauthorized data access. Considering the intersection of kinetic and cyber events, prominent diplomatic meetings provide ripe opportunities for socially engineered attacks used as political statements.

The below live monitoring view from Recorded Future details reported travel plans for world leaders during the next thirty days. You can use the visualization to persistently monitor upcoming travel events:

We called out several examples with leaders from states involved in Syrian military intervention:

• U.S. Secretary of State John Kerry traveling Europe during the next view days with a final meeting on Monday with British officials and Palestinian leader Mahmoud Abbas in London.
• Turkish, Spanish, and Japanese leaders traveling to Buenos Aires in the coming days.
• Foreign ministers from several countries meeting over the weekend in Vilnius.
• U.S. Vice President Joe Biden heading to Panama later in September.

We’ll conclude by pointing out a separate but related element of DR’s post: “Allies and groups sympathizing with the Syrians could likely prove a significant force multiplier, without drawing the attention that conventional military assistance may result in…”

Allies taking up arms with the SEA or yet to be recognized Syrian cyber teams would significantly bolster resources for expanding their target surface area. We’ll closely watch and report on any joint operations involving hackers from Syria or other states sympathetic to the Assad government that might indicate an escalation in capabilities.