US Warns Of Russian State Hackers Still Targeting US, Foreign Orgs

The FBI, the US Department of Homeland Security (DHS), and the Cybersecurity and Infrastructure Security Agency (CISA) warned today of continued attacks coordinated by the Russian Foreign Intelligence Service (SVR) (aka APT29) against US and foreign organizations.

“The SVR activity—which includes the recent SolarWinds Orion supply chain compromise—primarily targets government networks, think tank and policy analysis organizations, and information technology companies and seeks to gather intelligence information,” CISA said.

CISA adds that APT29 will “continue to seek intelligence from U.S. and foreign entities through cyber exploitation, using a range of initial exploitation techniques that vary in sophistication, coupled with stealthy intrusion tradecraft within compromised networks.”

The joint advisory published today provides additional info on APT29 tactics, tools, techniques, and capabilities.

The extra information should help protect the networks of government entities, think tanks, policy analysis organizations, information technology companies, and other potential SVR targets.

Also Read: 4 Best Practices On How To Use SkillsFuture Credit

Among Tactics, Techniques, and Procedures (TTP) associated with the SVR actors, the federal agencies highlighted:

• Password Spraying: In one 2018 compromise of a large network, SVR cyber actors used password spraying to identify a weak password associated with an administrative account. With access to the administrative account, the actors modified permissions of specific e-mail accounts on the network, allowing any authenticated network user to read those accounts. While the password sprays were conducted from many different IP addresses, once the actors obtained access to an account, that compromised account was generally only accessed from a single IP address corresponding to a leased virtual private server (VPS). 
• Leveraging Zero-Day Vulnerability: In a separate incident, SVR actors used CVE-2019-19781, a zero-day exploit at the time, against a virtual private network (VPN) appliance to obtain network access. Following exploitation of the device in a way that exposed user credentials, the actors identified and authenticated to systems on the network using the exposed credentials. As in the previous case, the actors used dedicated VPSs located in the same country as the victim, probably to make it appear that the network traffic was not anomalous with normal activity.
• WELLMESS Malware: In 2020, the governments of the United Kingdom, Canada, and the United States attributed intrusions perpetrated using malware known as WELLMESS to APT 29. Once on the network, the actors targeted each organization’s vaccine research repository and Active Directory servers. These intrusions, which mostly relied on targeting on-premises network resources, were a departure from historic tradecraft, and likely indicate new ways the actors are evolving in the virtual environment
• Tradecraft Similarities of SolarWinds-enabled Intrusions: During the spring and summer of 2020, using modified SolarWinds network monitoring software as an initial intrusion vector, SVR cyber operators began to expand their access to numerous networks. The SVR’s modification and use of trusted SolarWinds products as an intrusion vector is also a notable departure from the SVR’s historic tradecraft.

For each TTP entry highlighted in the security alert, the FBI and DHS also shared recommendations and mitigation measures to help network operators defend from intrusion attempts employing these attack techniques.

Today’s security advisory complements a previous one published on April 15th, sharing info on vulnerabilities exploited by the Russian-backed APT29 hacking group (also tracked as the Dukes, CozyBear, and Yttrium) to breach national security and government-related networks in the US and worldwide.

On the same day, the White House formally attributed the SolarWinds supply-chain attack to the APT29 state hackers. Multiple cybersecurity companies (FireEye, Malwarebytes, Mimecast) and US state and federal agencies were breached in this campaign.

In addition, President Biden issued an executive order blocking property regarding harmful activities from the Russian Federation government.

Also Read: 3 Reasons Why You Must Take A PDPA Singapore Course

The Treasury Department also issued sanctions against multiple Russian technology firms (ERA Technopolis, Pasit, SVA, Neobit, AST, and Positive Technologies) for allegedly helping the SVR, Russia’s Federal Security Service (FSB), and Russia’s Main Intelligence Directorate (GRU) launch cyberattacks against US entities.