BLUEVOYANT REVIEW Supply Chain Disruptions and Cyber Security in the Logistics Industry 2021 Table of Contents 3 Introduction 4 Key Findings 5 Threat Landscape 5 Cyber Attacks on Supply Chain 7 Dark Web 9 Ransomware 11 Threat Intelligence Findings 11 Findings: Threat Targeting 11 Findings: Potential Compromise 12 IT Hygiene and Email Security 13 Conclusion BLUEVOYANT: SUPPLY CHAIN DISRUPTIONS AND CYBER SECURITY IN THE LOGISTICS INDUSTRY 2 Introduction With global health dependent on immediate, In order to manage these complicated, high-volume safe, and effective vaccine distribution, and with networks, logistics companies are increasingly reliant economies operating by the grace of the global on highly automated systems4 that ensure ‘just-in-time’ shipping sector, logistics firms are, quite literally, delivery across roads, ports, airports, and through responsible for carrying the world through the rail, air, and maritime freight. These systems make current crisis. With timely operations at a premium, logistics as a sector incredibly vulnerable to cyber these firms are highly sensitive to disruption and attacks. Logistics and cyber security have a history: especially vulnerable to ransomware - malware the global NotPetya ransomware attack in 2017 that can bring operations to a standstill and hold famously infiltrated the Danish shipping firm Maersk. companies to hostage until demands are met. The attack froze Maersk’s worldwide logistics operations in place and eventually cost the firm Logistics companies have undergone a tumultuous between US $250-300 million5. and transformative year. In the immediate aftermath of COVID-19, air and maritime freight crashed - only to Four years on from NotPetya, and with the logistics rebound in 2021 as work-from-home economies drove of the vaccine supply chain in the global spotlight, people to ship more necessities and goods directly to BlueVoyant reviewed the cyber security readiness of their homes. While many major logistics companies the logistics sector, asking three questions: are well-known - DHS, FedEx, UPS - the infrastructure How is ransomware affecting the supply 1 supporting this change is a tightly-woven network of chain industry? many huge, but lesser-known, businesses: logistics How prepared are major logistics firms to software and solutions companies, shipping giants, 2 freight forwarders. Many of these companies weather ransomware attacks? are experiencing different rates of rebound1,2 and What can logistics firms do to succeed 3 3 capacity , just when they are needed most. despite an aggressive threat landscape? The vaccine distribution effort has placed an Others are also taking note: additional burden and emphasis on the sector. At present, vaccines are shipped by air from The Biden administration has signed manufacturers in Europe to European member into effect an Executive Order on Supply states, the U.S., and abroad. Again, the vaccine effort Chains6, with a focus on securing and draws in many different partners, including not only bolstering the American supply chain logistics solutions providers but also specialized against vulnerability to attack. businesses, like AmeriCold, that can manage the ‘cold chain’ required for preserving vaccine doses in This follows on from a new National Maritime Cyber low temperatures. BlueVoyant’s previous Report on security Plan7 to govern shipping. This report, drawn from Biotechnology & Pharma disclosed the aggression proprietary and open-source datasets, shows that logistics and volume of attacks targeting businesses involved firms still have a lot to learn from NotPetya. We note our in vaccine development. findings, as well as our thoughts on what the sector can do to create a safer future, below. BLUEVOYANT: SUPPLY CHAIN DISRUPTIONS AND CYBER SECURITY IN THE LOGISTICS INDUSTRY 3 In 2017, the global NotPetya ransomware attack froze Danish shipping firm Maersk’s worldwide logistics operations and COST THE FIRM BETWEEN $250-300M Key Findings In light of current concerns over global supply chains, BlueVoyant analysts reviewed the cyber security issues facing the logistics industry. BlueVoyant chose to assess the leading twenty logistics companies by market capitalization in order to assess their vulnerability to ransomware and other disruptive attacks. The following is a summary of our findings: Ransomware attacks are common Malicious actors are interested BlueVoyant’s datasets revealed that and on the rise. Consistent with in logistics companies. many of the companies surveyed a spike in ransomware attacks Every company’s network saw are vulnerable. Despite the risk across all sectors8, reported attacks some evidence of threat targeting. from ransomware, most were found on shipping and logistics firms to have open remote desktop or tripled between 2019 and 2020. administration ports and insufficient Almost all of these attacks occurred email security. through phishing or exploitation of open remote desktop ports.9 Given that these companies, which make up the bulk of the logistics industry, were vulnerable to key avenues of attack from ransomware - and given that ransomware is the number one threat to logistics companies today - these findings suggest a situation of imminent and extreme risk. BLUEVOYANT: SUPPLY CHAIN DISRUPTIONS AND CYBER SECURITY IN THE LOGISTICS INDUSTRY 4 Threat Landscape Cyber Attacks on Supply Chain A recent study found the Covid-19 pandemic to be the decade’s single most disruptive event for global manufacturing supply chains10. Even without the pandemic, however, evidence from multiple sources indicates that cyber attacks on supply chain companies are experiencing a precipitous increase; furthermore, much of that activity is driven by ransomware11,12. A ransomware attack on a supply chain business can be extremely disruptive. Wired’s coverage of the 2017 NotPetya incident’s consequences for shipping conglomerate Maersk (discussed at greater length below) depicts the issue quite compellingly: Businesses suffer ...customers faced a set of bleak options: They could try to get their precious cargo onto disruptions lasting other ships at premium, last-minute rates, at one month every often traveling the equivalent of standby. Or, if their cargo was part of a tight supply chain, like components for a factory, Maersk’s outage 3.7 YRS could mean shelling out for exorbitant air freight delivery or risk stalling manufacturing processes, where a single day of downtime costs hundreds of thousands of dollars. Many of the containers, known as reefers, were electrified and full of perishable goods that required refrigeration. 72% They’d have to be plugged in somewhere or their Companies studied contents would rot.13 have suffered supply Supply chain disruptions are increasingly common: chain disruptions a recent McKinsey study estimated businesses will, on average, suffer disruptions lasting at least one month every 3.7 years even without an increase in the frequency of malicious cyber activity.14 A 2020 3D Hubs report revealed that 72% of companies studied have suffered supply chain disruptions due to cyber attacks over the past decade.15 While a June 2020 survey 290 cited in that report found that only 9% of respondents cyber attacks ranked cyber attacks the top supply chain disruption against supply chain of the last 10 years, the report also notes that other companies in 2019 researchers recorded 290 cyber attacks against supply chain companies in 2019 alone.16 Other factors could, moreover, increase the frequency of cyber attacks that disrupt supply chains. BLUEVOYANT: SUPPLY CHAIN DISRUPTIONS AND CYBER SECURITY IN THE LOGISTICS INDUSTRY 5 Attacks on shipping in particular have been on the rise. “ At present, a series of cyber attacks have plagued the shipping industry. Israeli cyber security company Naval Dome reports that since February this year, the number of attacks on the shipping industry has soared by 400%. Over the past three years, cyber attacks against operational technology (OT) systems in the maritime industry have increased by 900%, and by the end of this year, the number of reported incidents will reach a record number. Among them, there were 50 major OT attacks reported in 2017, increased to 120 in 2018, more than 310 in 2019, and more than 500 in 2020.”17 Shipping and logistics is vulnerable as a sector than was foreseeable.19 Although Maersk and other because it is targeted both by nation-state groups as businesses in the logistics sector, including Deutsche well as cybercriminals. Geopolitical tensions can be Bahn, may have been collateral damage in the particular disruptive and spark attacks or interference in shipping case of NotPetya, similar activity could presumably have businesses, such as incidents resulting from issues an even more severe impact on supply chains if nation- like Brexit and ongoing US-China trade disputes.18 state actors set out to disable logistics companies The boundary between cyber activity and geopolitical specifically. Indeed, some such incidents may already contestation is quite porous and private businesses have occurred: Deutsche Bahn also suffered an infection are often softer targets for such activity than state with the WannaCry strain of ransomware, which analysts institutions. NotPetya’s rapid spread is a particularly attribute to the North Korea-linked Lazarus Group, in powerful example of this, as the available evidence May 2017.20 More recently, analysts have attributed a indicates that threat actors initially deployed NotPetya to days-long service interruption