Intelligence Agency: Canada’s Oil Sector at Risk From Russia-aligned Hackers

A Canadian intelligence agency has issued a warning that Russia-backed non-state threat actors will keep attempting to break into Canada’s oil and gas industry until conflicts in Ukraine are resolved.

On Wednesday, the Communications Security Establishment released its most recent danger assessment, which includes the previously mentioned warning.

“We assess that the intent of this activity is very likely to disrupt critical services for psychological impact, ultimately to weaken Canadian support for Ukraine. We assess that this activity will almost certainly continue for the duration of the war, and will likely increase as Russia’s invasion efforts falter, or new support for Ukraine is announced,” stated the report.

Russia-aligned non-state actors may be less skilled and technically competent than their Kremlin-sponsored opponents, but they still are capable of causing damage, according to the foreign signals and cyber intelligence agency.

“We assess there is an even chance of a disruptive incident in the oil and gas sector in Canada caused by Russia-aligned actors, due to their higher tolerance for risk, the increase in their numbers and activity, as well as the number of vulnerable targets in the sector overall.”

The agency also said that those who wish to disrupt oil and gas supplies in the country will likely aim at bottlenecks, such as networks of large-diameter pipelines, transfer terminals, and big processing facilities.

The research released on Wednesday warns oil and gas company executives and cyber department staff that many actors, including cybercriminals and foreign adversaries, are a threat to the industry.

“We assess that particularly business email compromise and ransomware is almost certainly the main cyber threat facing the Canadian oil and gas sector. Ransomware is almost certainly the primary cyber threat to the reliable supply of oil and gas to Canadians,” according to the report.

“It is very unlikely that a state-sponsored cyber actor would intentionally disrupt or damage the oil and gas infrastructure in Canada outside of hostilities,” the report states, implying that Russian state-sponsored cyber actors are probably executing reconnaissance activity against Canadian companies.

“We assess that it is very unlikely that Russian state-sponsored actors would choose to conduct a destructive attack against Canadian or allied-state oil and gas infrastructure outside of perceived imminent armed conflict between Canada and Russia.”

The report concludes with a call to action for the oil and gas industry to increase its level of safety.

“State-sponsored cyber activity against the oil and gas sector has become a regular feature of global cyber threat activity, especially in times of rising geopolitical tensions.”

“Politically motivated state-sponsored cyber threat actors, including Russia, China, and Iran, have targeted the global energy sector for both espionage and disruption/destruction.”