NASHVILLE, Tenn.–Every credit union leader knows about the cybersecurity threats they face—but what they may not realize is the sheer scope and the sources of those attacks, according to one person.

In remarks to Origence’s Lending Tech Live event, Lt Gen. (Ret) BJ Shwedo, a cybersecurity expert with four master’s degrees in national security and intelligence and who is SVP for Special Programs at Pentagon FCU, spent an hour quickly moving through all manner of cyber threats and cyber warfare, with one theme abundantly clear: the cyber threat is only growing and credit unions had better stay updated. 

“We are looking at the solidification of partnerships between Russia, China North Korea, and Iran,” Shwedo said of the threats that are not just to the United States but companies, especially financial institutions. 

Fallout From Russia’s War on Ukraine

Not surprisingly, given his military career, Shwedo spent considerable time reviewing the cyber terrorism and warfare taking place between Russia and Ukraine, and how that is playing out in the private sector, as well.  Ukraine, said Shwedo, has become a testing ground for Russia on numerous fronts.

“I’d love to tell you there is huge divide between the Russian military and Russian hacker groups, but there isn’t,” he told the meeting. “We are seeing hackers working for nation-state entities who are moonlighting at night. That’s relevant to you because when you have a nation-state going after the financial industry, that is a capability you have to be aware of.”

Shwedo pointed credit unions to the U.S. government’s Cybersecurity and Infrastructure Security Agency (CISA) and the tools and guides it makes available, and urged CUs to take advantage of those and to check frequently for updates. 

A Threat That’s Not Fake

Meanwhile, if credit unions leaders aren’t watching for deepfakes, they need to be, according to Shwedo. Deep fakes, which are videos of a person in which their face or body has been digitally altered or assumed, have become so convincing they can be difficult to differentiate from real videos, and AI is only improving their fake authenticity.

Shwedo said deep fakes have facilitated $25.6 billion in theft, and leaders in the banking industry have been among the targets. 

In many cases, he said, a deep fake scam attempt can be thwarted with something as simple as a phone call to the person whose identity has been hijacked. 

“With the increasing use of AI, critical thinking is more important than ever,” said Shwedo.

Insider Threats

As CUs have been warned repeatedly, compromised employees are an ever-growing risk. Shwedo said the hacker group Scattered Spider, which is based in the U.K. so they recognize all the cultural nuances of the workplace, is particularly good at doing research on LinkedIn and elsewhere to mimic IT workers and to contact employees about service tickets. By fooling the employee they are able to circumvent a lot of multi-factor authentication systems. 

“They can keep your people online for 10 minutes and they sound very convincing,” said Shwedo.

What to Watch

Shwedo warned credit unions that hackers:

• Find weakness and then work laterally.
• Use phshing, insider access and holes in old and unpatched systems. 
• Turn to third party providers who have trusted access

In terms of cyber action plans, Shwedo offered this advice below, saying at the least these are the “baseline.”