G20 Summit Event Assessment

G20 Summit Event Assessment

Product Serial: A-2022-11-11a

TLP: CLEAR

ZeroFox Intelligence is proud to announce the release of our assessment for the 7th Annual Group of 20 (G20) summit.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 8:30 AM (EST) on November 11, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Popular Indonesian tourist destination Bali will be hosting the 17th Annual Group of 20 (G20) summit from November 15–16, 2022. Residents and visitors will begin to experience physical security preparations as early as November 11, when drivers will be restricted by their license plates on certain roadways until November 18. The conference is especially notable because it will be the first gathering of global leaders since Russia’s war in Ukraine. However, Russian President Vladimir Putin will not be attending given the criticism over the war’s humanitarian and cost-of-living impacts, which are expected to feature prominently. Leaders from the other 18 largest economies will be in attendance, plus a seat for the European Union (EU). This includes a planned meeting between U.S. President Joe Biden and Chinese President Xi Jinping, who recently secured a third term in leadership that will likely see him remain leader of China for the rest of his life. The relationship between the two countries is tense over Taiwan and recent U.S. export rules that prohibit Chinese access to advanced technology.

Efforts to solve the global cost-of-living and energy crises will also continue during the summit; many of the leaders will have recently attended the COP27 environmental summit in Egypt as well as the ASEAN summit in Phnom Penh, where both Biden and Xi were expected. Lastly, the G20 precedes the Asian-Pacific Economic Conference in Bangkok, which will be headlined by U.S. Vice President Kamala Harris. The presence of three major international summits in the same geographic region occurring in the same week with important political leaders at all three increases the risk of nation-state and hacktivist activity. The G20 also has added physical security and cyber risks, as it is taking place at a popular tourist destination. Bali and Indonesia experienced a series of damaging al-Qaeda attacks in the early 2000s. However, coordinated counter-terrorism efforts over the last 10 years have significantly weakened jihadist groups in the region, making a terror attack unlikely. Similarly, protest groups are not predicated to gather en masse the way they have for previous summits.

Indonesia has a relatively poor recent cybersecurity record with several notable cyber breaches related to government-held data. This includes a late 2021 data breach on its COVID-19 tracking app, which delegates are still required to download. Threat actors may attempt to obtain sensitive personal information from delegates or visitors by impersonating apps and websites, such as those of hotels, G20-related events, and tourism services on the island. Given that G20 is occurring between two other major international summits, cyber threat actors have a larger window than normal to threaten world leaders. Heightened geopolitical rhetoric on account of Russia’s war in Ukraine and tensions between the United States and China, coupled with financial motivations, could give cyber threat actors added incentive to target any of the three major summits.

Key Findings

• Indonesia is requiring delegates to download a COVID-19 tracing app that was compromised in 2021.
• Indonesia has a weak record protecting government-held data; it has experienced a series of cyberattacks and data breaches since 2020.
• Security will be tight around the series of venue locations and the over 20 sponsoring hotels providing accommodations.
• Travel through the local airport and along major roadways will be restricted by license plates.
• Russian President Vladimir Putin will not attend but Ukrainian President Volodymyr Zelinsky will.
• U.S. President Joe Biden is planning to meet with Chinese President Xi Jinping.
• Important global summit ASEAN will be held before G20 and APEC falls afterward, where more consequential trade and political agreements could be reached.