The FBI and the Cybersecurity and Infrastructure Security Agency are warning of continued cyber threats stemming from Russia's Foreign Intelligence Service, or SVR, which the Biden administration accused of carrying out the SolarWinds supply chain attack.
In a joint alert issued 26 April 2021, the agencies warn that despite economic and other sanctions against Russia announced by the White House on 15 April 2021, attackers associated with the SVR likely will continue to target government networks, think tanks and policy analysis organizations as well as private technology firms using a variety of techniques and tools. Russia has denied that its intelligence service targeted SolarWinds.
The entire report can be viewed Here
Russia's SVR "will continue to seek intelligence from U.S. and foreign entities through cyber exploitation, using a range of initial exploitation techniques that vary in sophistication, coupled with stealthy intrusion tradecraft within compromised networks," according to the alert.
The U.S. previously blamed a threat group working for the SVR and referred to as APT29 or The Dukes or Cozy Bear for a spear-phishing campaign targeting the Democratic National Committee in 2015 that played play a significant role the 2016 U.S. election.
See Here
In announcing the Russian sanctions earlier this month, the FBI, CISA and the National Security Agency described several tools and techniques the SVR used, including the exploitation of several well-known vulnerabilities found in VPNs and other products that allow for remote access to networks.
The updated alert issued 26 April 2021 notes that attackers associated with the SVR continue to update their techniques to avoid detection. The changes include shifting from planting malware in networks to hacking cloud-based applications, especially email, to steal data and other information.
"The exploitation of Microsoft Office 365 environments following network access gained through use of modified SolarWinds software" reflects how Russian attackers continually refine their tactics, according to the joint alert. "Targeting cloud resources probably reduces the likelihood of detection by using compromised accounts or system misconfigurations to blend in with normal or unmonitored traffic in an environment not well defended, monitored or understood by victim organizations."
In other cases, the FBI and CISA have found the SVR using some of the same techniques leveraged in the SolarWinds supply chain attack to target others. For instance, the attackers attempted to obtain access to the cloud-based email accounts of victim organizations' IT staff to "collect useful information about the victim networks, determine if victims had detected the intrusions and evade eviction actions."
The recent joint alert points to several earlier incidents in which Russian attackers infiltrated and established persistence within networks. In 2018, the SVR targeted an unnamed organization's network using password spraying techniques to guess the credentials of administrative accounts as a way to gain a foothold within the infrastructure, the alert notes. "The actors conducted the password spraying activity in a 'low and slow' manner, attempting a small number of passwords at infrequent intervals, possibly to avoid detection," according to the joint report. "The password spraying used a large number of IP addresses all located in the same country as the victim, including those associated with residential, commercial, mobile and The Onion Router (TOR) addresses."
In the 2018 incident, the attackers compromised one administrator's account that did not require multifactor authentication. From there, the SVR modified email account settings, allowing it to read messages and make further changes, the FBI and CISA note.
Besides password spraying, the attackers took advantage of misconfigurations within the targeted organization's systems and applications and began logging into non-administrative accounts. These techniques, combined with access to one administrator's account, allowed the SVR to begin accessing a wide variety of email accounts. The attackers also made sure to cover up the attack by using proxy servers, the report finds.
"While the password sprays were conducted from many different IP addresses, once the actors obtained access to an account, that compromised account was generally only accessed from a single IP address corresponding to a leased virtual private server," according to the alert. "The FBI observed minimal overlap between the VPSs used for different compromised accounts, and each leased server used to conduct follow-on actions was in the same country as the victim organization."
Researchers noted in another attack, the SVR took advantage of what was then a zero-day vulnerability in Citrix's Application Delivery Controller and Gateway products to attack another unnamed organization, according to the alert. Once again, because multifactor authentication was not required, the attackers gained network access through the flaw and then established persistence. When the organization discovered the attack, it evicted the attackers, but because the initial point of entry was not known as the time, the attackers returned using the same technique, according to the FBI and CISA.
"Eventually, the initial access point was identified, removed from the network, and the actors were evicted," according to the alert. "As in the previous case, the actors used dedicated VPSs located in the same country as the victim, probably to make it appear that the network traffic was not anomalous with normal activity." Citrix issued a patch for the flaw, now identified as CVE-2019-19781.In past years, the SVR and its affiliates have continued to use malware as part of their operations, including one attack that targeted COVID-19 research facilities in the U.S., the U.K. and Canada in 2020.
Tom Kellermann, head of cybersecurity strategy for VMware and a member of the Cyber Investigations Advisory Board for the U.S. Secret Service, says threat intelligence sharing by government agencies is long overdue. "For decades, there has been an over-classification of actionable threat intelligence, and now we see a culture shift," Kellermann says.
Joseph Neumann, a cyber executive adviser at consulting firm Coalfire, notes that while some of the techniques are already known, the fact that the government is publishing them can help security teams look for compromises within their networks. "These are helpful, to a degree, (because they allow) administrators and defenders to know where to start their initial looks, but fall short of giving them data that they can plug into security tools to begin immediate automated remediations and mitigations," Neumann says.
A report VMware published in February 2021 noted that the SVR is primarily focused on intelligence gathering and has targeted U.S. organizations as well as foreign affairs ministries in other nations.
Other security cyber threat investigators have previously noted that the SVR typically does not engage in the types of destructive cyber operations conducted by other parts of Russia's intelligence service, such as the Russian Main Intelligence Directorate, also known as the GRU.
Red Sky Alliance has been has analyzing and documenting cyber threats and groups for over 9 years and maintains a resource library of malware and cyber actor reports available at https://redskyalliance.org at no charge. Many past tactics are reused in current malicious campaigns.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@wapacklabs.com
Weekly Cyber Intelligence Briefings:
Reporting: https://www.redskyalliance.org/
Website: https://www.wapacklabs.com/
LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/3702558539639477516
TR-21-123-002_Russian_Cyber_Continues.pdf
Comments