New Zealand deploys spy agency against hackers who hit stock market

Wellington

NEW Zealand called in its spy agency and activated security crisis plans to help defend the stock exchange from overseas attack, after hackers disrupted the market for a fourth straight day.

"We as a government are treating this very seriously," Finance Minister Grant Robertson said on Friday, adding the agencies would coordinate to deal with the threat. "There are limits to what I can say today about the action the government is taking behind the scenes due to significant security considerations."

The NZ$204 billion (S$187 billion) stock market has been the target of distributed-denialof-service attacks that have overwhelmed its website and forced trading halts since Tuesday. The national security plan is triggered in response to a crisis that threatens New Zealand's interests or international reputation.

The authorities have not commented on the suspected source of the attacks, which flood a network with Internet traffic and disrupt services, other than saying they originate from offshore.

Security intelligence company Akamai warned earlier this week that extortionists claiming to be the Russian-linked hacking group Fancy Bear have recently been sending ransom letters to companies in finance, travel and e-commerce in the Asia-Pacific, the United States and the United Kingdom demanding payments to stop attacks.

New Zealand stock exchange operator NZX is among the companies targeted, the ZDNet website reported, citing an unidentified source in the DDoS mitigation field.

The exchange failed to open at 10am New Zealand time on Friday despite assurances from NZX that it would. Trading finally began three hours later at 1pm. The market lost an hour of trading on Tuesday, three on Wednesday and almost six hours yesterday from the repeat attacks. NZX declined to comment on whether any demands have been made.

The disruptions, which come as the benchmark S&P/NZX-50 index nears a record high, are frustrating investors who were unable to trade amid a busy company earnings season.

The outages are "hugely disruptive for everyone", said Michael Midgley, chief executive officer of the New Zealand Shareholders' Association.

"Our main concern, aside from any attempted incursion, is that it is potentially damaging to information flows. In the Covid world, the audience is keenly watching to see how reported data relates to forecasts."

In November, government cyber security agency CERT NZ said it had received reports of extortion e-mails targeting companies within the financial sector in New Zealand. It said the e-mails claimed to be from a Russian group called "Fancy Bear/Cozy Bear" and demanded a ransom to avoid denial-of-service attacks.

Fancy Bear is another name for the Russian hacking group APT28, which has been linked to attacks against the US Democratic Party, the White House and Nato.

Security experts have also linked it to attacks on European government institutions and private companies, and say its primary mission is to gather intelligence in support of the Russian government.

The group sending ransom e-mails is highly unlikely to be the real Fancy Bear, but is using its name to gain notoriety, said Yihao Lim, a cyber threat intelligence analyst at Mandiant Threat Intelligence in Singapore.

The Financial Markets Authority, which regulates NZX, yesterday said it was monitoring the incident.

When asked on Friday if it had received ransom e-mails threatening attacks, Australia's ASX said that as a matter of policy it does not "comment on specific cyber-related matters".

"We have a range of security protections in place and work closely with government and relevant agencies to maintain the integrity of our services. ASX markets are operating normally," it said. BLOOMBERG