Who is behind the big hack attacks?

Who is behind the big hack attacks?
More than 100 organisations around the world are believed to have been hacked in ransomware attacks since 2022 by a single hacker group. The most recent occurrence of a ransomware attack was on a company responsible for analysing blood tests for the UK's National Health Service which prompted some major London hospitals to declare a 'critical incident', with many operations postponed. It is believed that a criminal organisation known as Qilin, consisting of individuals fluent in Russian, orchestrated this malicious act, by inserting a piece of software into the company’s IT system which locks it.  Once payment is received then access is restored. Ania Lichtarowicz has been investigating for SOEP.

Would tweezers be better than robotic hands?
What if, instead of having hands, we had some kind of bionic device at the end of our arms. Could we adapt to it as naturally as if we’d never had hands in the first place? Researchers in Italy have been addressing that very question using virtual reality. They’ve devised a set of virtual tweezer hands and invited volunteers to try using them to perform dextrous tasks. Professor Viviana Betti leads Cosync, a lab specialising in neurological research at the Sapienza University of Rome in Italy, and the Laboratory of Neuroscience and Applied Technology at the Santa Lucia Foundation IRCCS, also in Rome.

The programme is presented by Gareth Mitchell and the studio expert is Ghislaine Boddington.  

More on this week's stories:
The organization tracking the hackers – Group-IB
Rewiring the evolution of the human hand: How the embodiment of a virtual bionic tool improves behaviour 

Chapters

• 2:38 Who is behind the big hack attacks?
• 11:00 Bionic hands or tweezers?

Transcript

00:00:00 Gareth Mitchell 

Hello this is the Somewhere on Earth podcast. My goodness, it's Tuesday the 18th of June 2024 and we have voices from well from London. From the two of us here in the studio. Well, three of us soon to be when Ania comes in, and another voice. Very nice voice from Rome. 

00:00:27 Gareth Mitchell 

And one of the voices from London today is our expert commentator, the excellent Ghislaine Boddington. I've not seen you for a while. Hello, Ghislaine. 

00:00:35 Ghislaine Boddington 

Hello, Gareth. Lovely to see you too. To be in the studio together. 

00:00:38 Ghislaine Boddington 

As well, yeah. 

00:00:38 Gareth Mitchell 

I know it's still nice. Yeah, even this long after lockdown, it's still quite nice to be be in a real studio together. And so just before we jump into the main part of the show, I always like to hear what you've been up to, what's going on or indeed what you're about to do, cause you you've you've been packing your suitcase, haven't you? For yet another trip. 

00:00:43 Ghislaine Boddington 

Yeah, it it's you're right. Yes. 

00:00:57 Ghislaine Boddington 

I have and at the time we're recording this. Yeah, I'm just flying out tomorrow to Austria to a a special gathering, of, they're called BOLD, the BOLD Community and it’s pioneers in policy making, business, research, creative industries, from all over the world coming to Austria. And we're gonna have a week together to do sharing of shaping the future. It's all about shaping the future and looking at technology and economies onwards. 

00:01:25 Ghislaine Boddington 

And so, yes, I'm going to be travelling through Austria with all these amazing people and meeting some of the Austrian innovators too. Looking at climate neutral neutrality, mobility, sustainability and of course, AI and the whole connections of AI to it. So yeah. 

00:01:40 Gareth Mitchell 

I had a feeling that would come in. Well, that sounds like a lovely gig then. 

00:01:43 Ghislaine Boddington 

Yes, it is actually very much looking forward to getting input, not just doing output all the time, yeah. 

00:01:49 Gareth Mitchell 

There you go, input and output going on and in Vienna. Looking forward to hearing how that pans out. Alright. As for today, let's jump in. 

00:02:06 Gareth Mitchell 

And coming up. Medical procedures have been disrupted for patients across some of London's main hospitals in recent days because of a ransomware attack. We ask who is behind that attack and how they caused all the trouble. Also today, the researchers have used a virtual pair of tweezers to address profound questions about how bionic we all really are or could be. That's all right here on the Somewhere on Earth podcast. 

00:02:37 Gareth Mitchell 

So how can somebody or a group of people somewhere, how can they cause chaos and distress thousands of kilometres away? Well, London hospitals recently declared a critical incident when a ransomware attack hit a company that analyzes blood tests for the UK's National Health Service. A Russian speaking criminal gang called Qilin is thought to be behind the attack.  Ania’s been looking into it all and most importantly, Ania, working out how to pronounce Quillin Killin. Chillin is it? 

00:03:07 Ania Lichtarowicz 

Chillin. Well, Ghislaine, Ghislaine knows best. Chillin. 

00:03:09 Ghislaine Boddington 

Chileen. Yeah, I think so, yeah. So. 

00:03:12 Gareth Mitchell 

All right, so there we are. So we know the name of this supposed criminal gang, so we've established all that. But now that we've done the pronunciation check, tell us a bit more about this hack then on these London hospitals. 

00:03:26 Ania Lichtarowicz 

So at the beginning of June, hospitals in London that use systems of a company called Synnovis found themselves the victims of a ransomware hack. 

00:03:34 Ania Lichtarowicz 

Now Synnovis partners with the National Health Service here in the UK and provides what are known as pathology services. So examining tissue, bodily fluids, postmortems. But the big thing that that that was affected here was blood tests. Kings College Hospital and Guys in St Thomas's, which are quite famous hospitals. They have quite a few high profile hospitals within them, were majorly impacted for blood transfusions, test results. A total of seven were actually impacted. 

00:04:04 Gareth Mitchell 

So do we have any idea what actually happened? 

00:04:06 Ania Lichtarowicz 

So this meant that patients were sent to other hospitals or had operations and treatments cancelled. So even blood tests at local doctor's clinics had to be cancelled. 

00:04:17 Gareth Mitchell 

What if a company says no, not paying? 

00:04:19 Ania Lichtarowicz 

Well, it's understood that it was a ransomware attack. Hackers inserted a piece of software into Synnovis's IT system which locks up a computer system to extort a payment for restoring those services. 

00:04:31 Ania Lichtarowicz 

The group, believed to be behind the attack, as we've already discussed, it's called Qilin. It's a Russian speaking criminal gang, but we don't actually know where they are based. It's been active since October ‘22. Initial attacks were on the French company, Robert Bernard and the Australian IT consultancy Dialog. So far, you know, 112 attacks have been attributed to them. 

00:04:54 Ania Lichtarowicz 

But their activity seems to have increased very much in the last four months or so. It operates in a somewhat franchise basis. So if you can imagine a chain of fast food restaurants, I guess is something similar to this. So independent hackers can use its tools and infrastructure in exchange for a 15 to 20% cut of any proceeds that Qilin 

00:05:14 Ania Lichtarowicz 

would receive. The attacks tend to be opportunistic rather than being targeted, so the best defence is to have excellent defence systems in place in the first place. 

00:05:25 Ania Lichtarowicz 

Now there is a security group. Do have a look at their website. It is fascinating. You'll lose hours in it. It's called Group-IB. They infiltrated Qilin last year. They say that typical ransom demands are between 50,000 and 800 thousand U.S. dollars. Typical attacks start with phishing emails with malicious links. 

00:05:45 Ania Lichtarowicz 

So these are targeted messages to employees and they try and convince them to click on them and then what happens? It allows the hackers in and they install malware. Group-IB says that Qilin’s targets are primarily critical sector companies, education and healthcare as we've seen in London. 

00:06:00 Ania Lichtarowicz 

And they recruit hackers through adverts on underground forums. The information that the hackers have access to, Qilin says they will be published on the dark web. Now how real is that threat?, is the actual question. Well, the Big Issue. So that's the magazine publication, which is sold by homeless people in many countries, including the UK, Australia, South Africa, Namibia, Kenya, Malawi - they didn't pay the demanded ransom and more than 500 gigabytes of information was taken from the publisher, was posted on the dark web. This included passport scans of employees and payroll information. So obviously it is, it's affected many countries and is quite a big operation and seems to be getting bigger. 

00:06:44 Gareth Mitchell 

Yeah. So, Ghislaine Boddington, Ania says it's a problem that's worsening. Is that your reading of it as well? 

00:06:48 Ghislaine Boddington 

Well, yeah, absolutely. And I think we've seen a massive increase in this type of attack since pandemic. There's apparently there's there's hundreds of thousands of attacks a day across the world. And of course, many companies are not stating that it's happened to them and so we probably don't even know you know, 1/2 or even 2/3 of what is happening out there. And the ransomware side is really scary. 

00:07:16 Ghislaine Boddington 

But it's, there's a thing called Raas, which is ransomware as a service and it's ransomware, which offers multiple encryption modes that can be controlled by those hackers. And what it does is it's got this double extortion as a tactic, where it both encrypts the data  

00:07:35 Ghislaine Boddington 

and then threatens to publish it if a ransom is not paid. So even if they didn't publish it, potentially it would be encrypted and not accessible anyway. So if a ransom is not paid.  Which the health system doesn't pay, do they, the ransoms? If I understand, no, no. 

00:07:51 Ghislaine Boddington 

And it is mainly through phishing emails. So I was looking at what the cybersecurity lot are planning ahead because at the present they're they're struggling, really struggling. And but there's one of the, one of the things that's out there now that most companies are looking at, it's called Zero Trust architecture. And I've been hearing about this all over the place,  

00:08:12 Ghislaine Boddington 

and it basically means zero trust for internal and external entities. And apparently this is a paradigm shift, but basically means you can't trust anyone, not any of your employees. none of your staff, and obviously not the external stuff coming in. And I can feel it even in my university we’re much, much more tougher about this, you know. 

00:08:32 Ghislaine Boddington 

It is. It is up to us as well because it only takes one staff member and you could be, you know, doing the wrong click and it's so scary that, because of course, they wouldn't mean to, yeah. 

00:08:41 Gareth Mitchell 

So. So somebody literally just opens up a PDF and they can end up taking out potentially their whole organization or a big chunk of it. 

00:08:48 Ghislaine Boddington 

And £1,000,000 ransomware comes into place, you know. Obviously AI and machine learning are coming into all of this because of course, pattern recognition and data analysis is part of the whole. But in cybersecurity, still that human insight alongside it is an imperative because there's a lot of nuances and creativity yeah, the hackers put on, you know, they're very creative with how they're working on this. 

00:09:14 Ghislaine Boddington 

I mean and it is alarming because AI also can generate huge amounts of malware variants. So AI in itself could be part of the problem, making more happen you know. What we just need is all these hackers to become cyber security experts instead, because of course, it's two sides of the same coin. It's just whether you are going to work for the good side or the bad side, or how you see it, and whether the jobs are there for you. 

00:09:39 Gareth Mitchell 

That's the thing, and presumably they'll follow the money. I mean, if the good side is saying, well, we'll pay you more than the criminal gangs. And if I were a hacker, which I'm not, by the way, it's nothing to do with me, this whole thing. 

00:09:42 Ghislaine Boddington 

That's one of the money, yeah. 

00:09:50 Gareth Mitchell 

But if I was, I'd say, yeah, fair enough. The dosh is nicer on the bright side. 

00:09:54 Ghislaine Boddington 

Quite often, of course, these these young people, often men, young men very, very high level with their coding, are in countries where there isn't the right kind of cyber security job for them in the proper pay. They haven't got another option. Romania is one of those places. Yeah, so. 

00:10:09 Gareth Mitchell 

And they can be living in countries that for geopolitical reasons, want to cause problems in other countries. Yes. Yeah. Right. I'll park it there. I think. Ghislaine thank you. And you Ania you, isn't it lovely to see you the side of the glass the listeners do like it, you know. 

00:10:19 Ghislaine Boddington 

Yes. 

00:10:21 Ania Lichtarowicz 

Well that was Patricia, so we know one does. 

00:10:24 Gareth Mitchell 

Yeah. OK. All right. Well, we like balance on this podcast. So if you don't like it when Ania comes this side of the glass, then do let us know and we can have a good old discussion about that.  

00:10:35 Ghislaine Boddington 

Do like it let us know. 

00:10:36 Gareth Mitchell  

Yeah, exactly. If you don't, we'll just ignore it. Everyone loves it. OK, there we are. And wouldn't you just believe it? We've had some guests arriving for the podcast we're recording next, so we're going to do that in a minute. You're going to hear it next week, folks, but it's going to be a good one.  

00:10:48 Ghislaine Boddington 

Excellent.  

00:10:49 Gareth Mitchell 

And the guests are here. We've got a podcast for next week. Awesome. Right. There you go. Think we better had. So let's move on. Here we go. 

00:10:51 

Who? 

00:10:54 Ghislaine Boddington 

We better finish this one then, yeah. 

00:11:02 Gareth Mitchell 

Well, here's a profound question about our relationship with technology. What if, instead of having hands, we had some kind of bionic device at the end of our arms? Could we adapt to it as naturally as if we'd never had hands in the first place? Well, some researchers in Italy have been addressing that very question using virtual reality they've devised a set of virtual tweezer hands. If you see what I mean, and they've invited some volunteers to try it all out, and they've been inviting them to try out some dexterous tasks to see how they get on with these virtual tweezer hands, let's hear more now from Professor Viviana Betti. She leads Cosync, which is a lab specializing in neuroscience research. She's also with the Department of Psychology at the Sapienza University of Rome in Italy. Welcome along to you Somewhere on Earth Viviana. 

00:11:49 Viviana Betti 

Hi, nice to see you. 

00:11:52 Gareth Mitchell 

So give me the background to all this. Why? Why did you want to look into this kind of research, effectively about our bionic selves? 

00:12:00 Viviana Betti 

OK, so that's a good question. So we already know from neuroscientific study that the brain maintains an internal model of the body, particularly of the hand. 

00:12:12 Viviana Betti 

So what we meant by internal model is a stable representation and this stable representation persists even after an amputation. So this is the first set of evidence. So another set of evidence suggests that nearly half of people with upper limb prosthetics abandoned them. 

00:12:32 Viviana Betti 

They are often uncomfortable, dysfunctional or just don't feel like a part of their body, and this study we made an unusual choice to circumvent this issue. So for this reason we invented this new paradigm. 

00:12:48 Gareth Mitchell 

OK. Yeah. So I think I get all that, so the idea that even after an amputation, someone still imagines their hands to be there, then they get a prosthetic that in some cases perhaps doesn't feel natural to them. So you're using virtual reality then to try and investigate to get around this issue of, you know, how we deal with some kind of enhancement or bionic adornment to my body and I don't know if you like the word bionic by the way. So I'll let you tell me if I can use that kind of language. But tell me how virtual reality came into this. 

00:13:21 Viviana Betti 

Yes. So the idea is to ask participants. So initially we design a very simple task. So the idea is to test their ability and dexterity using both a virtual bionic tool or a virtual hand. So what we ask is if to pop bubbles of a specific color, for example by pinching them with their tweezers or between the index finger and the thumb, and what we found in using this paradigm is that participants were faster and more accurate at popping virtual bubbles when they add tweezers. 

00:14:01 Gareth Mitchell 

Which to me seems counterintuitive, so I'm just trying to imagine myself as one of your volunteers. I'm in the virtual environment, so I hold my my arm up in front of me and then I see a virtual hand in front of me and I do one set of tests and then I get these tweezers. So effectively, you've taken my hand away and just given me effectively like a pencil, I'm more like a lobster now than having the hand that I imagined and counterintuitively, for me anyway, you were saying that people responded better with the virtual pincers, with the tweezers. 

00:14:31 Viviana Betti 

Yes, sure, that's correct. The idea. So our interpretation is that the control of that virtual limb is even simpler than a virtual hand because the virtual hand is an external object and it is difficult to control. So the hand has more than 20° of freedoms, so the idea is that the virtual tool, even if it doesn't have the same aesthetic features of the hand, then it's easy to use and to control for the brain. 

00:15:05 Gareth Mitchell 

Ghislaine. And you're my go to person. Apart from Viviana, of course. Yes. Anything to do with our embodied or indeed non-embodied selves. What do you make of this? 

00:15:14 Ghislaine Boddington 

I'm really interested Viviana in the choice to use VR for an embodiment test. I'm coming from a living body background dance and technology side and  

00:15:27 Ghislaine Boddington 

I always consider that actually the concept of embodiment, and this is part of my work, is very different in the virtual world as we kind of know from lockdown in video conferencing and the big debate also in VR experience is about the problem of creating, you know, virtual presence and liveness and a feeling of reality. You know. So I was wondering about the choice to use the virtual where there's no weight or effort or sense of force or exertion, or no tactile, touchy feeling side of it. 

00:15:58 Viviana Betti 

Yes. So for sure, virtual reality is not physical reality, but is a way, a fantastic way to create extreme manipulation of the body. And using this paradigm in virtual reality, where we are also able to have a sense of agency and a sense of control of the virtual hand or the virtual limb in general. So the idea is that virtual reality, if you embody that tool, you have the idea that this belong to your body and using the sense of agency you have the the the idea that you can control the virtual limb. So for for us, of course, this is the first study we are doing. also, studies using amputees and motor training lasting for weeks. 

00:16:56 Viviana Betti 

But so this is the first study, but is really effective in inducing this sense of belonging of that body, both the virtual hand or the virtual tool. Of course, it's not the reality, but it's a good way to test this manipulation. 

00:17:13 Gareth Mitchell 

Well, yeah, because I I was wondering why not do these tests in an embodied context. As I think Ghislaine suggests, I wonder if part of it is, you know, the clues and the title of some of what your research is about, like neuroscience that I mentioned in the introduction, because in your work in your paper, you say that you're interested in brain plasticity aren't you? In other words, how the brain rewires itself for want of a better phrase, in terms of using our tools for instance, and our motor function. So is that really part of it that you want to go right into the neuroscience level to try and understand this? 

00:17:44 Viviana Betti 

Yes. So our expectation is that we can observe brain plasticity effect after tool usage. So there exists already scientific evidence showing that the tool use can rewire the brain or induce some plasticity effect. 

00:18:04 Viviana Betti 

This is a novel paradigm in in which we are the virtual grafting of the of the tool or the virtual end. So this study is ongoing, is still ongoing. So we still don't have precise indication but so of course these are our expectations. So the brain can rewire using this different way to interact with the environment. 

00:18:28 Ghislaine Boddington 

You know that’s some of the work that I've been hearing about and I know at University of Cambridge in the Plasticity Lab there, Dani Clode is one of the designers working there. She's an augmentive designer and she's got a project called The Third Thumb Project. So it's not quite the same. It's not, you know, it's not a complete hand. It's an additional thumb that has been, she's testing out on people who’ve  

00:18:52 Ghislaine Boddington 

actually, got thumbs. They've got two thumbs, which is why it's called The Third Thumb and she actually does brain scans before and then they go away with this third thumb and use it for a few weeks. And then they do brain scans after and what they've been looking at, and I guess this is possibly the same word, is this proprioception. 

00:19:11 Ghislaine Boddington 

This is actually the body's ability to sense movement, action and location, but which is a body mind interface. Yeah. Is this part of the work you're looking at, this body, mind connection and how proprioception is the key to actually, because it's linked to every muscle movement we make, every every action and location. And of course, when you're moving, part of your body, whether it's part of your body or not, whether it's a virtual limb or whether it's an add-on prosthesis, that's what starts to happen, isn't it in the brain. 

00:19:42 Viviana Betti 

Yes. So there are very nice example in the literature The Third Thumb or The Six Fingers. So these are example of augmented robotics. And so we we believe that this proprioceptive input or in general the movement that you can do in the virtual environment can induce sort of plasticity effect in the brain. So I can repeat so this is still an ongoing study for us. So what we did is to test the amputees and control subjects using fMRI before and after a long motor training lasting 4 weeks, so we already collected the data. 

00:20:30 Viviana Betti 

We don't have so solid results at the moment. We are, the study is still ongoing, but for sure. So what we believe is the naturalistic interaction with the external environment even if now is a virtual environment can induce reshaping of the brain. 

00:20:50 Viviana Betti 

So we developed 9 virtual scenarios in which participants can interact with everyday life objects doing for example Lego construction  

00:21:02 Viviana Betti 

or interacting with some tools and other object in the in the environment. So we we still. So we believe that this is an effective way to induce a modulation of brain activity and connectivity. So we really believe that this could be effective. 

00:21:23 Viviana Betti 

And can also provide important insight for the neural neural rehabilitation, because if it's possible to induce some modulation of the brain activity, especially that activity devoted to the representation of the brain, then we can do a step further into the development of new prosthetic device. 

00:21:45 Gareth Mitchell 

OK. Well, there we’ll leave it with you Viviana. Yeah. Any final thought from you, Ghislaine or? 

00:21:46 Ghislaine Boddington 

00:21:50 Ghislaine Boddington 

You were just saying it's really interesting in terms of the the uses of it for actually for brain side of it only actually developing the you know people who've maybe had neurological damage of some type etcetera. So yeah, fascinating work. 

00:22:04 Gareth Mitchell 

Yeah, absolutely. Viviana, thank you very much indeed for speaking to us here on Somewhere on Earth. That's Professor Viviana Betti, who leads Cosync. So it's that lab specializing in neuroscience research in Rome, where she's also with the Department of Psychology at the Sapienza University, and there'll be more in the podcast extra in the subscription version of this. But if you're a non-subscriber, no worries. You’ll have really got the gist of it from that brilliant interview. So we thank you. So just a quick little shout out before we go, of course. 

00:22:36 Gareth Mitchell 

We like you to get in touch. Hello. At somewhere on earth.co. 

00:22:40 Gareth Mitchell 

That's hello at somewhere on earth.co. That's our e-mail. And on WhatsApp, we're code 447486329484 and come to think of it, I don't think we've had a voice message from you out there in listener land for a while, so why not leave us a little voice message? Tell us what you think of what you just heard, for instance. That would be rather lovely. OK, we'll leave it there. 

00:23:00 Gareth Mitchell 

So from all of us on the team and the team, by the way, is Dylan Burton on sound and Ghislaine Boddington on expertise. Me, Gareth Mitchell on just rabbiting on a little bit,  production management from Liz Tuohy and the team here are at Lanson's Team Farner.  From all of us, thank you very much for listening and we'll see you soon. And our editor is Ania Lichtarowicz. Bye, bye.