logo
Overkill Security  Because Nothing Says 'Security' Like a Dozen Firewalls and a Biometric Scanner
О проекте Просмотр Уровни подписки Фильтры Обновления проекта Контакты Поделиться Метки
Все проекты
О проекте
A blog about all things techy! Not too much hype, just a lot of cool analysis and insight from different sources.

📌Not sure what level is suitable for you? Check this explanation https://sponsr.ru/overkill_security/55291/Paid_Content/

All places to read, listen and watch content:
➡️Text and other media: TG, Boosty, Teletype.in, VK, X.com
➡️Audio: Mave, you find here other podcast services, e.g. Youtube Podcasts, Spotify, Apple or Amazon
➡️Video: Youtube

The main categories of materials — use tags:
📌news
📌digest

QA — directly or via email overkill_qa@outlook.com
Публикации, доступные бесплатно
Уровни подписки
Единоразовый платёж

Your donation fuels our mission to provide cutting-edge cybersecurity research, in-depth tutorials, and expert insights. Support our work today to empower the community with even more valuable content.

*no refund, no paid content

Помочь проекту
Promo 750₽ месяц
Доступны сообщения

For a limited time, we're offering our Level "Regular" subscription at an unbeatable price—50% off!

Dive into the latest trends and updates in the cybersecurity world with our in-depth articles and expert insights

Offer valid until the end of this month.

Оформить подписку
Regular Reader 1 500₽ месяц 16 200₽ год
(-10%)
При подписке на год для вас действует 10% скидка. 10% основная скидка и 0% доп. скидка за ваш уровень на проекте Overkill Security
Доступны сообщения

Ideal for regular readers who are interested in staying informed about the latest trends and updates in the cybersecurity world without.

Оформить подписку
Pro Reader 3 000₽ месяц 30 600₽ год
(-15%)
При подписке на год для вас действует 15% скидка. 15% основная скидка и 0% доп. скидка за ваш уровень на проекте Overkill Security
Доступны сообщения

Designed for IT professionals, cybersecurity experts, and enthusiasts who seek deeper insights and more comprehensive resources. + Q&A

Оформить подписку
Фильтры
Пн
Вт
Ср
Чт
Пт
Сб
Вс
28
29
30
31
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
1
Обновления проекта
Поделиться
Метки
overkillsecurity 142 overkillsecuritypdf 52 news 47 keypoints 38 nsa 26 fbi 25 adapt tactics 11 Living Off the Land 11 LOTL 11 unpacking 10 vulnerability 9 cyber security 8 Digest 8 edge routers 8 Essential Eight Maturity Model 8 malware 8 Maturity Model 8 Monthly Digest 8 research 8 ubiquiti 8 IoT 7 lolbin 7 lolbins 7 Cyber Attacks 6 phishing 6 Forensics 5 Ransomware 5 soho 5 authToken 4 BYOD 4 MDM 4 OAuth 4 Energy Consumption 3 IoMT 3 medical 3 ai 2 AnonSudan 2 authentication 2 av 2 battery 2 Buffer Overflow 2 console architecture 2 cve 2 cybersecurity 2 energy 2 Google 2 incident response 2 MITM 2 mqtt 2 Passkeys 2 Retro 2 Velociraptor 2 video 2 Vintage 2 vmware 2 windows 2 1981 1 5g network research 1 8-bit 1 Ad Removal 1 Ad-Free Experience 1 ADCS 1 advisory 1 airwatch 1 AlphV 1 AMSI 1 android 1 Android15 1 announcement 1 antiPhishing 1 AntiPhishStack 1 antivirus 1 Apple 1 Atlassian 1 Attack 1 AttackGen 1 BatBadBut 1 Behavioral Analytics 1 BianLian 1 bias 1 Biocybersecurity 1 Biometric 1 bite 1 bitlocker 1 bitlocker bypass 1 Black Lotus Labs 1 blackberry 1 blizzard 1 botnet 1 Browser Data Theft 1 BucketLoot 1 CellularSecurity 1 checkpoint 1 china 1 chisel 1 cisa 1 CloudSecurity 1 CloudStorage 1 content 1 content category 1 cpu 1 Credential Dumping 1 CVE-2023-22518 1 CVE-2023-35080 1 CVE-2023-38043 1 CVE-2023-38543 1 CVE-2024-0204 1 CVE-2024-21111 1 CVE-2024-21345 1 cve-2024-21447 1 CVE-2024-24919 1 CVE-2024-26218 1 cve-2024-27129 1 cve-2024-27130 1 cve-2024-27131 1 cve-2024-3400 1 cvss 1 cyber operations 1 Cyber Toufan Al-Aqsa 1 cyberops 1 D-Link 1 dark pink apt 1 data leakage 1 dcrat 1 Demoscene 1 DevSecOps 1 Dex 1 disassembler 1 DOS 1 e8mm 1 EDR 1 Embedded systems 1 Employee Training 1 EntraID 1 ESC8 1 Event ID 4663 1 Event ID 4688 1 Event ID 5145 1 Evilginx 1 EvilLsassTwin 1 Facebook 1 FBI IC3 1 FIDO2 1 filewave 1 Firebase 1 Firmware 1 Fortra's GoAnywhere MFT 1 france 1 FraudDetection 1 fuxnet 1 fuzzer 1 game console 1 gamification 1 GeminiNanoAI 1 genzai 1 go 1 GoogleIO2024 1 GooglePlayProtect 1 GoPhish 1 gpu 1 ICS 1 ICSpector 1 IDA 1 IncidentResponse 1 Industrial Control Systems 1 jazzer 1 jetbrains 1 jvm 1 KASLR 1 KillNet 1 LeftOverLocals 1 Leviathan 1 lg smart tv 1 lockbit 1 LSASS 1 m-trends 1 Machine Learning Integration 1 Mallox 1 MalPurifier 1 mandiant 1 MediHunt 1 Meta Pixel 1 ML 1 mobile network analysis 1 mobileiron 1 nes 1 nexus 1 NGO 1 Nim 1 Nimfilt 1 NtQueryInformationThread 1 OFGB 1 oracle 1 paid content 1 panos 1 Passwordless 1 Phishing Resilience 1 PingFederate 1 Platform Lock-in Tool 1 PlayIntegrityAPI 1 PlayStation 1 playstation 2 1 playstation 3 1 plc 1 podcast 1 Privilege Escalation 1 ps2 1 ps3 1 PulseVPN 1 qcsuper 1 qemu 1 qualcomm diag protocol 1 radio frame capture 1 Raytracing 1 Real-time Attack Detection 1 Red Team 1 Registry Modification 1 Risk Mitigation 1 RiskManagement 1 rodrigo copetti 1 rooted android devices 1 Router 1 rust 1 Sagemcom 1 sandworm 1 ScamCallDetection 1 security 1 Security Awareness 1 session hijacking 1 SharpADWS 1 SharpTerminator 1 shellcode 1 SIEM 1 Siemens 1 skimming 1 Smart Devices 1 snes 1 SSO 1 stack overflow 1 TA427 1 TA547 1 TDDP 1 telecom security 1 Telegram 1 telerik 1 TeleTracker 1 TEMP.Periscope 1 Terminator 1 Think Tanks 1 Threat 1 threat intelligence 1 threat intelligence analysis 1 Threat Simulation 1 tool 1 toolkit 1 tp-link 1 UK 1 UserManagerEoP 1 uta0218 1 virtualbox 1 VPN 1 vu 1 wargame 1 Web Authentication 1 WebAuthn 1 webos 1 What2Log 1 Windows 11 1 Windows Kernel 1 Windstream 1 women 1 WSUS 1 wt-2024-0004 1 wt-2024-0005 1 wt-2024-0006 1 xbox 1 xbox 360 1 xbox original 1 xss 1 Yubico 1 Z80A 1 ZX Spectrum 1 Больше тегов
Читать: 2+ мин
logo Overkill Security

Benefits and Drawbacks of NSA’s Advisory. The Double-Edged Sword

The ‎document‏ ‎titled ‎“cyber ‎actors ‎adapt ‎tactics‏ ‎for ‎initial‏ ‎cloud‏ ‎access” ‎released ‎by‏ ‎the ‎National‏ ‎Security ‎Agency ‎(NSA) ‎warns‏ ‎of‏ ‎use ‎of‏ ‎cyber ‎actors‏ ‎have ‎adapted ‎their ‎tactics ‎to‏ ‎gain‏ ‎initial ‎access‏ ‎to ‎cloud‏ ‎services, ‎as ‎opposed ‎to ‎exploiting‏ ‎on-premise‏ ‎network‏ ‎vulnerabilities.

Benefits:

Awareness ‎and‏ ‎Understanding: ‎The‏ ‎document ‎raises‏ ‎awareness‏ ‎about ‎the‏ ‎shift ‎in ‎tactics ‎towards ‎cloud‏ ‎services, ‎which‏ ‎is‏ ‎crucial ‎for ‎organizations‏ ‎to ‎understand‏ ‎the ‎current ‎threat ‎landscape.

📌Detailed‏ ‎TTPs: It‏ ‎provides ‎detailed‏ ‎information ‎on‏ ‎the ‎tactics, ‎techniques, ‎and ‎procedures‏ ‎(TTPs)‏ ‎used ‎by‏ ‎actors, ‎including‏ ‎the ‎use ‎of ‎service ‎and‏ ‎dormant‏ ‎accounts,‏ ‎which ‎can‏ ‎help ‎organizations‏ ‎identify ‎potential‏ ‎threats‏ ‎and ‎vulnerabilities.

📌Sector-Specific‏ ‎Insights: The ‎document ‎outlines ‎the ‎expansion‏ ‎of ‎targeting‏ ‎to‏ ‎sectors ‎such ‎as‏ ‎aviation, ‎education,‏ ‎law ‎enforcement, ‎and ‎military‏ ‎organizations,‏ ‎offering ‎sector-specific‏ ‎insights ‎that‏ ‎can ‎help ‎these ‎industries ‎bolster‏ ‎their‏ ‎defenses.

📌Mitigation ‎Strategies: It‏ ‎offers ‎practical‏ ‎mitigation ‎strategies ‎that ‎organizations ‎can‏ ‎implement‏ ‎to‏ ‎strengthen ‎their‏ ‎defenses ‎against‏ ‎initial ‎access‏ ‎by‏ ‎actors, ‎such‏ ‎as ‎implementing ‎MFA ‎and ‎managing‏ ‎system ‎accounts.

📌Emphasis‏ ‎on‏ ‎Fundamentals: The ‎advisory ‎emphasizes‏ ‎the ‎importance‏ ‎of ‎cybersecurity ‎fundamentals, ‎which‏ ‎can‏ ‎help ‎organizations‏ ‎establish ‎a‏ ‎strong ‎baseline ‎defense ‎against ‎sophisticated‏ ‎actors.

📌Global‏ ‎Supply ‎Chain‏ ‎Relevance: ‎The‏ ‎document ‎references ‎the ‎actors’ ‎involvement‏ ‎in‏ ‎the‏ ‎SolarWinds ‎supply‏ ‎chain ‎compromise,‏ ‎highlighting ‎the‏ ‎global‏ ‎implications ‎of‏ ‎such ‎cyber ‎espionage ‎activities.

Drawbacks:

📌Resource ‎Intensity:‏ ‎Implementing ‎the‏ ‎recommended‏ ‎mitigations ‎may ‎require‏ ‎significant ‎resources,‏ ‎which ‎could ‎be ‎challenging‏ ‎for‏ ‎smaller ‎organizations‏ ‎with ‎limited‏ ‎cybersecurity ‎budgets ‎and ‎personnel.

📌Complexity ‎of‏ ‎Cloud‏ ‎Security: ‎The‏ ‎document ‎points‏ ‎out ‎the ‎inherent ‎challenges ‎in‏ ‎securing‏ ‎cloud‏ ‎infrastructure, ‎which‏ ‎may ‎require‏ ‎specialized ‎knowledge‏ ‎and‏ ‎skills ‎that‏ ‎not ‎all ‎organizations ‎possess.

📌Evolving ‎Tactics: While‏ ‎the ‎document‏ ‎provides‏ ‎current ‎TTPs, ‎the‏ ‎actors’ ‎tactics‏ ‎are ‎constantly ‎evolving, ‎which‏ ‎means‏ ‎that ‎defenses‏ ‎based ‎solely‏ ‎on ‎this ‎advisory ‎may ‎quickly‏ ‎become‏ ‎outdated.

📌Potential ‎for‏ ‎Overemphasis ‎on‏ ‎Specific ‎Threats: Focusing ‎too ‎much ‎on‏ ‎such‏ ‎actors‏ ‎could ‎lead‏ ‎organizations ‎to‏ ‎neglect ‎other‏ ‎threat‏ ‎actors ‎or‏ ‎vectors ‎that ‎are ‎equally ‎dangerous‏ ‎but ‎not‏ ‎covered‏ ‎in ‎the ‎document.

📌Shared‏ ‎Responsibility ‎Model:‏ ‎The ‎document ‎implies ‎a‏ ‎shared‏ ‎responsibility ‎model‏ ‎for ‎cloud‏ ‎security, ‎which ‎may ‎lead ‎to‏ ‎confusion‏ ‎about ‎the‏ ‎division ‎of‏ ‎security ‎responsibilities ‎between ‎cloud ‎providers‏ ‎and‏ ‎customers.

📌False‏ ‎Sense ‎of‏ ‎Security: Organizations ‎might‏ ‎develop ‎a‏ ‎false‏ ‎sense ‎of‏ ‎security ‎by ‎relying ‎on ‎the‏ ‎mitigations ‎suggested,‏ ‎without‏ ‎considering ‎the ‎need‏ ‎for ‎a‏ ‎dynamic ‎and ‎adaptive ‎security‏ ‎posture‏ ‎to ‎respond‏ ‎to ‎new‏ ‎threats.

Читать: 8+ мин
logo Overkill Security

The Defense Cybersecurity Workout Plan. The Basics Never Looked So Good

Defense ‎through‏ ‎Cybersecurity ‎Fundamentals ‎in ‎the ‎APT

In‏ ‎the ‎contemporary‏ ‎cybersecurity‏ ‎landscape, ‎marked ‎by‏ ‎the ‎sophisticated‏ ‎operations ‎of ‎actors, ‎the‏ ‎importance‏ ‎of ‎adhering‏ ‎to ‎cybersecurity‏ ‎fundamentals ‎cannot ‎be ‎overstated. ‎While‏ ‎advanced‏ ‎threats ‎continue‏ ‎to ‎evolve,‏ ‎leveraging ‎cutting-edge ‎tactics, ‎techniques, ‎and‏ ‎procedures‏ ‎(TTPs),‏ ‎a ‎strong‏ ‎foundation ‎in‏ ‎cybersecurity ‎fundamentals‏ ‎remains‏ ‎a ‎critical‏ ‎line ‎of ‎defense ‎for ‎organizations‏ ‎across ‎all‏ ‎sectors.‏ ‎This ‎foundational ‎approach‏ ‎to ‎cybersecurity‏ ‎emphasizes ‎the ‎implementation ‎of‏ ‎best‏ ‎practices, ‎policies,‏ ‎and ‎controls‏ ‎that ‎are ‎designed ‎to ‎protect‏ ‎against‏ ‎a ‎wide‏ ‎range ‎of‏ ‎threats, ‎including ‎those ‎from ‎highly‏ ‎sophisticated‏ ‎adversaries.

Understanding‏ ‎Cybersecurity ‎Fundamentals

📌Access‏ ‎Control: ‎Ensuring‏ ‎that ‎only‏ ‎authorized‏ ‎users ‎have‏ ‎access ‎to ‎information ‎systems ‎and‏ ‎data, ‎and‏ ‎that‏ ‎they ‎are ‎only‏ ‎able ‎to‏ ‎perform ‎actions ‎that ‎are‏ ‎necessary‏ ‎for ‎their‏ ‎role.

📌Data ‎Encryption: Protecting‏ ‎data ‎at ‎rest ‎and ‎in‏ ‎transit‏ ‎through ‎encryption,‏ ‎making ‎it‏ ‎unreadable ‎to ‎unauthorized ‎users.

📌Patch ‎Management: Regularly‏ ‎updating‏ ‎software‏ ‎and ‎systems‏ ‎to ‎address‏ ‎vulnerabilities ‎and‏ ‎reduce‏ ‎the ‎risk‏ ‎of ‎exploitation.

📌Firewalls ‎and ‎Intrusion ‎Detection‏ ‎Systems ‎(IDS): Implementing‏ ‎firewalls‏ ‎to ‎block ‎unauthorized‏ ‎access ‎and‏ ‎IDS ‎to ‎monitor ‎network‏ ‎traffic‏ ‎for ‎suspicious‏ ‎activity.

📌Multi-Factor ‎Authentication‏ ‎(MFA): ‎Requiring ‎users ‎to ‎provide‏ ‎two‏ ‎or ‎more‏ ‎verification ‎factors‏ ‎to ‎gain ‎access ‎to ‎systems,‏ ‎significantly‏ ‎enhancing‏ ‎security.

📌Security ‎Awareness‏ ‎Training: Educating ‎employees‏ ‎about ‎cybersecurity‏ ‎risks‏ ‎and ‎best‏ ‎practices ‎to ‎prevent ‎social ‎engineering‏ ‎attacks ‎and‏ ‎other‏ ‎threats.

📌Incident ‎Response ‎Planning:‏ ‎Preparing ‎for‏ ‎potential ‎security ‎incidents ‎with‏ ‎a‏ ‎well-defined ‎plan‏ ‎for ‎response‏ ‎and ‎recovery.

The ‎Role ‎of ‎Fundamentals‏ ‎in‏ ‎Defending ‎Against‏ ‎Sophisticated ‎Threats

While‏ ‎sophisticated ‎cyber ‎actors ‎like ‎the‏ ‎actors‏ ‎employ‏ ‎advanced ‎techniques‏ ‎to ‎bypass‏ ‎security ‎measures,‏ ‎many‏ ‎of ‎their‏ ‎strategies ‎still ‎exploit ‎basic ‎security‏ ‎weaknesses—such ‎as‏ ‎poor‏ ‎password ‎management, ‎unpatched‏ ‎software, ‎and‏ ‎insufficient ‎access ‎controls. ‎By‏ ‎adhering‏ ‎to ‎cybersecurity‏ ‎fundamentals, ‎organizations‏ ‎can ‎address ‎these ‎vulnerabilities, ‎making‏ ‎it‏ ‎significantly ‎more‏ ‎difficult ‎for‏ ‎attackers ‎to ‎gain ‎initial ‎access‏ ‎or‏ ‎move‏ ‎laterally ‎within‏ ‎a ‎network.

For‏ ‎example, ‎the‏ ‎implementation‏ ‎of ‎MFA‏ ‎can ‎prevent ‎unauthorized ‎access ‎even‏ ‎if ‎credentials‏ ‎are‏ ‎compromised. ‎Regular ‎patch‏ ‎management ‎can‏ ‎close ‎off ‎vulnerabilities ‎before‏ ‎they‏ ‎can ‎be‏ ‎exploited ‎in‏ ‎a ‎zero-day ‎attack. ‎Security ‎awareness‏ ‎training‏ ‎can ‎reduce‏ ‎the ‎risk‏ ‎of ‎employees ‎falling ‎victim ‎to‏ ‎phishing‏ ‎or‏ ‎other ‎social‏ ‎engineering ‎tactics.

Challenges‏ ‎in ‎Maintaining‏ ‎Cybersecurity‏ ‎Fundamentals

Despite ‎the‏ ‎clear ‎benefits, ‎maintaining ‎a ‎strong‏ ‎foundation ‎in‏ ‎cybersecurity‏ ‎fundamentals ‎can ‎be‏ ‎challenging ‎for‏ ‎organizations. ‎This ‎can ‎be‏ ‎due‏ ‎to ‎a‏ ‎variety ‎of‏ ‎factors, ‎including ‎resource ‎constraints, ‎the‏ ‎complexity‏ ‎of ‎modern‏ ‎IT ‎environments,‏ ‎and ‎the ‎rapid ‎pace ‎of‏ ‎technological‏ ‎change.‏ ‎Additionally, ‎as‏ ‎organizations ‎increasingly‏ ‎adopt ‎cloud‏ ‎services‏ ‎and ‎other‏ ‎advanced ‎technologies, ‎the ‎cybersecurity ‎landscape‏ ‎becomes ‎more‏ ‎complex,‏ ‎requiring ‎continuous ‎adaptation‏ ‎of ‎fundamental‏ ‎security ‎practices.

Strategies ‎for ‎Strengthening‏ ‎Fundamental‏ ‎Defenses

📌Continuous ‎Risk‏ ‎Assessment: Regularly ‎assessing‏ ‎the ‎organization's ‎security ‎posture ‎to‏ ‎identify‏ ‎vulnerabilities ‎and‏ ‎prioritize ‎remediation‏ ‎efforts.

📌Leveraging ‎Security ‎Frameworks: Adopting ‎comprehensive ‎security‏ ‎frameworks,‏ ‎such‏ ‎as ‎the‏ ‎NIST ‎Cybersecurity‏ ‎Framework, ‎to‏ ‎guide‏ ‎the ‎implementation‏ ‎of ‎best ‎practices ‎and ‎controls.

📌Automating‏ ‎Security ‎Processes:‏ ‎Utilizing‏ ‎automation ‎to ‎streamline‏ ‎security ‎processes,‏ ‎such ‎as ‎patch ‎management‏ ‎and‏ ‎monitoring, ‎to‏ ‎enhance ‎efficiency‏ ‎and ‎effectiveness.

📌Fostering ‎a ‎Culture ‎of‏ ‎Security:‏ ‎Building ‎a‏ ‎strong ‎security‏ ‎culture ‎within ‎the ‎organization, ‎where‏ ‎cybersecurity‏ ‎is‏ ‎viewed ‎as‏ ‎a ‎shared‏ ‎responsibility ‎among‏ ‎all‏ ‎employees.

📌Collaboration ‎and‏ ‎Information ‎Sharing: ‎Engaging ‎in ‎collaboration‏ ‎and ‎information‏ ‎sharing‏ ‎with ‎industry ‎peers‏ ‎and ‎government‏ ‎agencies ‎to ‎stay ‎informed‏ ‎about‏ ‎emerging ‎threats‏ ‎and ‎best‏ ‎practices.

Mitigations ‎to ‎Strengthen ‎Defense ‎Against‏ ‎APT

In‏ ‎the ‎context‏ ‎of ‎heightened‏ ‎cyber ‎threats ‎from ‎sophisticated ‎actors,‏ ‎organizations‏ ‎must‏ ‎employ ‎a‏ ‎comprehensive ‎set‏ ‎of ‎mitigations‏ ‎to‏ ‎strengthen ‎their‏ ‎defenses. ‎These ‎mitigations ‎are ‎designed‏ ‎to ‎address‏ ‎vulnerabilities‏ ‎across ‎various ‎aspects‏ ‎of ‎an‏ ‎organization's ‎infrastructure ‎and ‎operations,‏ ‎thereby‏ ‎reducing ‎the‏ ‎risk ‎of‏ ‎successful ‎cyber-attacks. ‎Implementing ‎these ‎mitigations‏ ‎requires‏ ‎a ‎strategic‏ ‎approach ‎that‏ ‎encompasses ‎both ‎technical ‎solutions ‎and‏ ‎organizational‏ ‎processes.

Key‏ ‎Mitigation ‎Strategies

📌Implement‏ ‎Multi-Factor ‎Authentication‏ ‎(MFA): MFA ‎is‏ ‎one‏ ‎of ‎the‏ ‎most ‎effective ‎controls ‎for ‎securing‏ ‎user ‎accounts‏ ‎against‏ ‎compromise. ‎By ‎requiring‏ ‎multiple ‎forms‏ ‎of ‎verification, ‎MFA ‎makes‏ ‎it‏ ‎significantly ‎more‏ ‎difficult ‎for‏ ‎attackers ‎to ‎gain ‎unauthorized ‎access,‏ ‎even‏ ‎if ‎they‏ ‎have ‎obtained‏ ‎a ‎user's ‎credentials.

📌Regular ‎Patching ‎and‏ ‎Updates:‏ ‎Keeping‏ ‎software ‎and‏ ‎systems ‎up‏ ‎to ‎date‏ ‎with‏ ‎the ‎latest‏ ‎patches ‎is ‎crucial ‎for ‎closing‏ ‎security ‎gaps‏ ‎that‏ ‎could ‎be ‎exploited‏ ‎by ‎attackers.‏ ‎A ‎regular ‎patch ‎management‏ ‎process‏ ‎should ‎be‏ ‎established ‎to‏ ‎ensure ‎timely ‎application ‎of ‎updates.

📌Network‏ ‎Segmentation: Dividing‏ ‎the ‎network‏ ‎into ‎smaller,‏ ‎controlled ‎segments ‎can ‎limit ‎an‏ ‎attacker's‏ ‎ability‏ ‎to ‎move‏ ‎laterally ‎within‏ ‎the ‎network‏ ‎and‏ ‎access ‎sensitive‏ ‎areas. ‎Segmentation ‎also ‎helps ‎contain‏ ‎potential ‎breaches‏ ‎to‏ ‎a ‎smaller ‎subset‏ ‎of ‎the‏ ‎network.

📌Endpoint ‎Protection: ‎Deploying ‎advanced‏ ‎endpoint‏ ‎protection ‎solutions‏ ‎can ‎help‏ ‎detect ‎and ‎prevent ‎malicious ‎activities‏ ‎on‏ ‎devices ‎that‏ ‎access ‎the‏ ‎organization's ‎network. ‎This ‎includes ‎the‏ ‎use‏ ‎of‏ ‎antivirus ‎software,‏ ‎host-based ‎intrusion‏ ‎prevention ‎systems,‏ ‎and‏ ‎endpoint ‎detection‏ ‎and ‎response ‎(EDR) ‎tools.

📌Security ‎Awareness‏ ‎Training: Educating ‎employees‏ ‎about‏ ‎cybersecurity ‎risks ‎and‏ ‎best ‎practices‏ ‎is ‎essential ‎for ‎preventing‏ ‎social‏ ‎engineering ‎attacks,‏ ‎such ‎as‏ ‎phishing. ‎Regular ‎training ‎can ‎help‏ ‎create‏ ‎a ‎culture‏ ‎of ‎security‏ ‎awareness ‎within ‎the ‎organization.

📌Least ‎Privilege‏ ‎Access‏ ‎Control: Ensuring‏ ‎that ‎users‏ ‎have ‎only‏ ‎the ‎access‏ ‎rights‏ ‎necessary ‎for‏ ‎their ‎role ‎helps ‎minimize ‎the‏ ‎potential ‎impact‏ ‎of‏ ‎account ‎compromise. ‎Access‏ ‎controls ‎should‏ ‎be ‎regularly ‎reviewed ‎and‏ ‎adjusted‏ ‎as ‎necessary.

📌IR‏ ‎Planning: ‎Having‏ ‎a ‎well-defined ‎and ‎tested ‎incident‏ ‎response‏ ‎plan ‎enables‏ ‎organizations ‎to‏ ‎respond ‎quickly ‎and ‎effectively ‎to‏ ‎security‏ ‎incidents,‏ ‎minimizing ‎damage‏ ‎and ‎restoring‏ ‎operations ‎as‏ ‎soon‏ ‎as ‎possible.

📌Continuous‏ ‎Monitoring ‎and ‎Detection: Implementing ‎continuous ‎monitoring‏ ‎and ‎detection‏ ‎capabilities‏ ‎can ‎help ‎identify‏ ‎suspicious ‎activities‏ ‎early ‎on. ‎This ‎includes‏ ‎the‏ ‎use ‎of‏ ‎security ‎information‏ ‎and ‎event ‎management ‎(SIEM) ‎systems,‏ ‎intrusion‏ ‎detection ‎systems‏ ‎(IDS), ‎and‏ ‎network ‎traffic ‎analysis.

📌Secure ‎Configuration ‎and‏ ‎Hardening:‏ ‎Systems‏ ‎should ‎be‏ ‎securely ‎configured‏ ‎and ‎hardened‏ ‎against‏ ‎attacks. ‎This‏ ‎involves ‎disabling ‎unnecessary ‎services, ‎applying‏ ‎secure ‎configuration‏ ‎settings,‏ ‎and ‎ensuring ‎that‏ ‎security ‎features‏ ‎are ‎enabled.

📌Backup ‎and ‎Recovery:‏ ‎Regular‏ ‎backups ‎of‏ ‎critical ‎data‏ ‎and ‎systems, ‎along ‎with ‎robust‏ ‎recovery‏ ‎procedures, ‎are‏ ‎essential ‎for‏ ‎resilience ‎against ‎ransomware ‎and ‎other‏ ‎destructive‏ ‎attacks.‏ ‎Backups ‎should‏ ‎be ‎tested‏ ‎regularly ‎to‏ ‎ensure‏ ‎they ‎can‏ ‎be ‎relied ‎upon ‎in ‎an‏ ‎emergency.

Challenges ‎in‏ ‎Implementing‏ ‎Mitigations

While ‎these ‎mitigations‏ ‎are ‎effective‏ ‎in ‎theory, ‎organizations ‎often‏ ‎face‏ ‎challenges ‎in‏ ‎their ‎implementation.‏ ‎These ‎challenges ‎can ‎include ‎limited‏ ‎resources,‏ ‎the ‎complexity‏ ‎of ‎IT‏ ‎environments, ‎the ‎need ‎for ‎specialized‏ ‎skills,‏ ‎and‏ ‎the ‎difficulty‏ ‎of ‎balancing‏ ‎security ‎with‏ ‎business‏ ‎requirements. ‎Additionally,‏ ‎the ‎rapidly ‎evolving ‎nature ‎of‏ ‎cyber ‎threats‏ ‎means‏ ‎that ‎mitigation ‎strategies‏ ‎must ‎be‏ ‎continually ‎reassessed ‎and ‎updated.

Collaborative‏ ‎Efforts‏ ‎and ‎Information‏ ‎Sharing

To ‎overcome‏ ‎these ‎challenges ‎and ‎enhance ‎the‏ ‎effectiveness‏ ‎of ‎mitigations,‏ ‎organizations ‎can‏ ‎engage ‎in ‎collaborative ‎efforts ‎and‏ ‎information‏ ‎sharing‏ ‎with ‎industry‏ ‎partners, ‎government‏ ‎agencies, ‎and‏ ‎cybersecurity‏ ‎communities. ‎This‏ ‎collaboration ‎can ‎provide ‎access ‎to‏ ‎shared ‎knowledge,‏ ‎threat‏ ‎intelligence, ‎and ‎best‏ ‎practices ‎that‏ ‎can ‎inform ‎and ‎improve‏ ‎an‏ ‎organization's ‎mitigation‏ ‎efforts.

Читать: 3+ мин
logo Overkill Security

Sophistication of Cyber Actors. The James Bonds of the Digital Realm

The ‎actors‏ ‎according ‎to ‎document ‎“cyber ‎actors‏ ‎adapt ‎tactics‏ ‎for‏ ‎initial ‎cloud ‎access”‏ ‎has ‎demonstrated‏ ‎a ‎high ‎level ‎of‏ ‎sophistication‏ ‎in ‎its‏ ‎cyber ‎operations,‏ ‎reflecting ‎a ‎deep ‎understanding ‎of‏ ‎the‏ ‎global ‎cyber‏ ‎landscape ‎and‏ ‎an ‎ability ‎to ‎adapt ‎and‏ ‎innovate‏ ‎in‏ ‎the ‎face‏ ‎of ‎evolving‏ ‎security ‎measures.‏ ‎This‏ ‎sophistication ‎is‏ ‎not ‎only ‎evident ‎in ‎the‏ ‎technical ‎capabilities‏ ‎but‏ ‎also ‎in ‎their‏ ‎strategic ‎approach‏ ‎to ‎cyber ‎espionage, ‎which‏ ‎involves‏ ‎careful ‎target‏ ‎selection, ‎meticulous‏ ‎planning, ‎and ‎the ‎use ‎of‏ ‎advanced‏ ‎tactics, ‎techniques,‏ ‎and ‎procedures‏ ‎(TTPs).

Technical ‎Prowess ‎and ‎Innovation

Cyber ‎operations‏ ‎are‏ ‎characterized‏ ‎by ‎the‏ ‎use ‎of‏ ‎custom ‎malware‏ ‎and‏ ‎zero-day ‎vulnerabilities—previously‏ ‎unknown ‎software ‎vulnerabilities ‎that ‎haven't‏ ‎been ‎disclosed‏ ‎to‏ ‎the ‎software ‎maker‏ ‎or ‎the‏ ‎public. ‎The ‎exploitation ‎of‏ ‎these‏ ‎vulnerabilities ‎allows‏ ‎them ‎to‏ ‎infiltrate ‎target ‎networks ‎undetected. ‎An‏ ‎example‏ ‎of ‎this‏ ‎is ‎the‏ ‎SolarWinds ‎supply ‎chain ‎attack, ‎where‏ ‎is‏ ‎believed‏ ‎to ‎have‏ ‎compromised ‎the‏ ‎software ‎development‏ ‎process‏ ‎to ‎insert‏ ‎malicious ‎code ‎into ‎a ‎software‏ ‎update, ‎affecting‏ ‎thousands‏ ‎of ‎SolarWinds' ‎clients,‏ ‎including ‎government‏ ‎agencies ‎and ‎Fortune ‎500‏ ‎companies.

Operational‏ ‎Security ‎and‏ ‎Stealth

Operational ‎security‏ ‎(OpSec) ‎is ‎a ‎hallmark ‎of‏ ‎operations,‏ ‎with ‎the‏ ‎agency ‎going‏ ‎to ‎great ‎lengths ‎to ‎cover‏ ‎its‏ ‎tracks‏ ‎and ‎maintain‏ ‎stealth ‎within‏ ‎compromised ‎networks.‏ ‎This‏ ‎includes ‎the‏ ‎use ‎of ‎encrypted ‎channels ‎for‏ ‎exfiltrating ‎data,‏ ‎the‏ ‎careful ‎management ‎of‏ ‎command-and-control ‎servers‏ ‎to ‎avoid ‎detection, ‎and‏ ‎the‏ ‎use ‎of‏ ‎legitimate ‎tools‏ ‎and ‎services ‎(a ‎technique ‎known‏ ‎as‏ ‎"living ‎off‏ ‎the ‎land")‏ ‎to ‎blend ‎in ‎with ‎normal‏ ‎network‏ ‎activity.‏ ‎The ‎ability‏ ‎to ‎maintain‏ ‎a ‎low‏ ‎profile‏ ‎within ‎target‏ ‎networks ‎often ‎allows ‎them ‎to‏ ‎conduct ‎long-term‏ ‎espionage‏ ‎operations ‎without ‎detection.

Psychological‏ ‎and ‎Social‏ ‎Engineering ‎Tactics

Beyond ‎technical ‎capabilities,‏ ‎it‏ ‎has ‎shown‏ ‎adeptness ‎in‏ ‎psychological ‎and ‎social ‎engineering ‎tactics.‏ ‎These‏ ‎methods ‎are‏ ‎designed ‎to‏ ‎manipulate ‎individuals ‎into ‎divulging ‎sensitive‏ ‎information‏ ‎or‏ ‎performing ‎actions‏ ‎that ‎compromise‏ ‎security. ‎Phishing‏ ‎campaigns,‏ ‎spear-phishing, ‎and‏ ‎other ‎forms ‎of ‎social ‎engineering‏ ‎are ‎frequently‏ ‎used‏ ‎to ‎gain ‎initial‏ ‎access ‎to‏ ‎target ‎networks ‎or ‎to‏ ‎escalate‏ ‎privileges ‎once‏ ‎inside.

Target ‎Selection‏ ‎and ‎Intelligence ‎Gathering

The ‎target ‎selection‏ ‎process‏ ‎is ‎strategic‏ ‎and ‎aligned‏ ‎with ‎Russia's ‎national ‎interests. ‎Targets‏ ‎are‏ ‎carefully‏ ‎chosen ‎based‏ ‎on ‎their‏ ‎potential ‎to‏ ‎provide‏ ‎valuable ‎intelligence,‏ ‎whether ‎it ‎be ‎political, ‎economic,‏ ‎technological, ‎or‏ ‎military.‏ ‎Once ‎a ‎target‏ ‎is ‎compromised,‏ ‎the ‎actors ‎focus ‎on‏ ‎long-term‏ ‎access ‎and‏ ‎intelligence ‎gathering,‏ ‎prioritizing ‎stealth ‎and ‎persistence ‎over‏ ‎immediate‏ ‎gains. ‎This‏ ‎approach ‎allows‏ ‎them ‎to ‎collect ‎a ‎comprehensive‏ ‎picture‏ ‎of‏ ‎the ‎target's‏ ‎activities, ‎relationships,‏ ‎and ‎plans.

Adaptability‏ ‎to‏ ‎the ‎Cybersecurity‏ ‎Landscape

One ‎of ‎the ‎most ‎defining‏ ‎aspects ‎is‏ ‎its‏ ‎adaptability. ‎The ‎shift‏ ‎towards ‎targeting‏ ‎cloud ‎services ‎and ‎exploiting‏ ‎service‏ ‎and ‎dormant‏ ‎accounts ‎is‏ ‎a ‎testament ‎to ‎this ‎adaptability.‏ ‎By‏ ‎continuously ‎refining‏ ‎their ‎methods‏ ‎and ‎exploring ‎new ‎vectors ‎of‏ ‎attack,‏ ‎the‏ ‎actors ‎remain‏ ‎a ‎persistent‏ ‎and ‎evolving‏ ‎threat‏ ‎in ‎the‏ ‎cyber ‎domain.

Читать: 3+ мин
logo Overkill Security

Use of Service and Dormant Accounts. Sleeping Giants

The ‎exploitation‏ ‎of ‎service ‎and ‎dormant ‎accounts‏ ‎by ‎cyber‏ ‎actors‏ ‎represents ‎a ‎sophisticated‏ ‎and ‎often‏ ‎overlooked ‎vector ‎of ‎cyber-attacks.‏ ‎These‏ ‎accounts, ‎which‏ ‎are ‎created‏ ‎for ‎various ‎operational ‎purposes ‎within‏ ‎an‏ ‎organization's ‎cloud‏ ‎and ‎on-premises‏ ‎environments, ‎can ‎provide ‎attackers ‎with‏ ‎the‏ ‎access‏ ‎they ‎need‏ ‎to ‎carry‏ ‎out ‎their‏ ‎objectives‏ ‎if ‎not‏ ‎properly ‎managed ‎and ‎secured.

Understanding ‎Service‏ ‎and ‎Dormant‏ ‎Accounts

Service‏ ‎accounts ‎are ‎specialized‏ ‎accounts ‎used‏ ‎by ‎applications ‎or ‎services‏ ‎to‏ ‎interact ‎with‏ ‎the ‎operating‏ ‎system ‎or ‎other ‎services. ‎They‏ ‎often‏ ‎have ‎elevated‏ ‎privileges ‎to‏ ‎perform ‎specific ‎tasks ‎and ‎may‏ ‎not‏ ‎be‏ ‎tied ‎to‏ ‎an ‎individual‏ ‎user's ‎identity.‏ ‎Dormant‏ ‎accounts, ‎on‏ ‎the ‎other ‎hand, ‎are ‎user‏ ‎accounts ‎that‏ ‎are‏ ‎no ‎longer ‎actively‏ ‎used, ‎either‏ ‎because ‎the ‎user ‎has‏ ‎left‏ ‎the ‎organization‏ ‎or ‎the‏ ‎account's ‎purpose ‎has ‎been ‎fulfilled.‏ ‎These‏ ‎accounts ‎are‏ ‎particularly ‎risky‏ ‎because ‎they ‎are ‎frequently ‎forgotten,‏ ‎left‏ ‎with‏ ‎more ‎privileges‏ ‎than ‎necessary,‏ ‎and ‎not‏ ‎monitored‏ ‎as ‎closely‏ ‎as ‎active ‎user ‎accounts.

Why ‎Service‏ ‎and ‎Dormant‏ ‎Accounts‏ ‎Are ‎Targeted

📌Elevated ‎Privileges: Service‏ ‎accounts ‎often‏ ‎have ‎elevated ‎privileges ‎necessary‏ ‎for‏ ‎system ‎tasks,‏ ‎which ‎can‏ ‎be ‎exploited ‎to ‎gain ‎wide‏ ‎access‏ ‎to ‎an‏ ‎organization's ‎network.

📌Lack‏ ‎of ‎Monitoring: ‎Dormant ‎accounts ‎are‏ ‎not‏ ‎regularly‏ ‎used, ‎making‏ ‎them ‎less‏ ‎likely ‎to‏ ‎be‏ ‎monitored ‎for‏ ‎suspicious ‎activity, ‎and ‎thus ‎an‏ ‎attractive ‎target‏ ‎for‏ ‎attackers.

📌Weak ‎or ‎Default‏ ‎Credentials: ‎Service‏ ‎accounts ‎may ‎be ‎configured‏ ‎with‏ ‎weak ‎or‏ ‎default ‎credentials‏ ‎that ‎are ‎easier ‎for ‎attackers‏ ‎to‏ ‎guess ‎or‏ ‎find ‎through‏ ‎brute ‎force ‎attacks.

📌Bypassing ‎User ‎Behavior‏ ‎Analytics:‏ ‎Since‏ ‎service ‎accounts‏ ‎perform ‎automated‏ ‎tasks, ‎their‏ ‎behavior‏ ‎patterns ‎can‏ ‎be ‎predictable, ‎allowing ‎malicious ‎activities‏ ‎to ‎blend‏ ‎in‏ ‎with ‎normal ‎operations‏ ‎and ‎evade‏ ‎detection.

The ‎Threat ‎Posed ‎by‏ ‎Compromised‏ ‎Accounts

📌Move ‎Laterally: Use‏ ‎the ‎account's‏ ‎privileges ‎to ‎move ‎laterally ‎within‏ ‎the‏ ‎network, ‎accessing‏ ‎other ‎systems‏ ‎and ‎data.

📌Escalate ‎Privileges: Leverage ‎the ‎account‏ ‎to‏ ‎escalate‏ ‎privileges ‎and‏ ‎gain ‎administrative‏ ‎access ‎to‏ ‎critical‏ ‎systems.

📌Maintain ‎Persistence:‏ ‎Establish ‎a ‎persistent ‎presence ‎within‏ ‎the ‎network,‏ ‎making‏ ‎it ‎more ‎difficult‏ ‎to ‎detect‏ ‎and ‎remove ‎the ‎attacker.

📌Exfiltrate‏ ‎Data:‏ ‎Access ‎and‏ ‎exfiltrate ‎sensitive‏ ‎data, ‎leading ‎to ‎data ‎breaches‏ ‎and‏ ‎intellectual ‎property‏ ‎theft.

Mitigating ‎the‏ ‎Risks ‎Associated ‎with ‎Service ‎and‏ ‎Dormant‏ ‎Accounts

📌Regular‏ ‎Audits: ‎Conduct‏ ‎regular ‎audits‏ ‎of ‎all‏ ‎accounts‏ ‎to ‎identify‏ ‎and ‎deactivate ‎dormant ‎accounts ‎and‏ ‎ensure ‎that‏ ‎service‏ ‎accounts ‎have ‎the‏ ‎minimum ‎necessary‏ ‎privileges.

📌Strong ‎Authentication ‎Controls: ‎Enforce‏ ‎strong‏ ‎password ‎policies‏ ‎and ‎use‏ ‎multi-factor ‎authentication ‎(MFA) ‎for ‎service‏ ‎accounts‏ ‎where ‎possible.

📌Monitoring‏ ‎and ‎Alerting: Implement‏ ‎monitoring ‎and ‎alerting ‎mechanisms ‎to‏ ‎detect‏ ‎unusual‏ ‎activities ‎associated‏ ‎with ‎service‏ ‎and ‎dormant‏ ‎accounts.

📌Segregation‏ ‎of ‎Duties: Apply‏ ‎the ‎principle ‎of ‎segregation ‎of‏ ‎duties ‎to‏ ‎service‏ ‎accounts ‎to ‎limit‏ ‎the ‎scope‏ ‎of ‎access ‎and ‎reduce‏ ‎the‏ ‎risk ‎of‏ ‎misuse.

📌Automated ‎Management‏ ‎Tools: Utilize ‎automated ‎account ‎management ‎tools‏ ‎to‏ ‎keep ‎track‏ ‎of ‎account‏ ‎usage ‎and ‎lifecycle, ‎ensuring ‎that‏ ‎accounts‏ ‎are‏ ‎deactivated ‎when‏ ‎no ‎longer‏ ‎needed.

Читать: 3+ мин
logo Overkill Security

Expansion of Targeting. The More, the Merrier

The ‎strategic‏ ‎expansion ‎of ‎targeting ‎by ‎cyber‏ ‎actors ‎to‏ ‎a‏ ‎broader ‎range ‎of‏ ‎sectors ‎is‏ ‎a ‎concerning ‎development ‎in‏ ‎the‏ ‎realm ‎of‏ ‎global ‎cybersecurity.‏ ‎This ‎diversification ‎of ‎targets ‎reflects‏ ‎a‏ ‎calculated ‎approach‏ ‎by ‎these‏ ‎actors ‎to ‎exploit ‎the ‎interconnected‏ ‎nature‏ ‎of‏ ‎modern ‎industries‏ ‎and ‎the‏ ‎increasing ‎reliance‏ ‎on‏ ‎cloud ‎services‏ ‎across ‎various ‎sectors.

Broadening ‎the ‎Scope‏ ‎of ‎Espionage

The‏ ‎expansion‏ ‎into ‎sectors ‎such‏ ‎as ‎aviation,‏ ‎education, ‎law ‎enforcement, ‎local‏ ‎and‏ ‎state ‎councils,‏ ‎government ‎financial‏ ‎departments, ‎and ‎military ‎organizations ‎demonstrates‏ ‎their‏ ‎intent ‎to‏ ‎gather ‎intelligence‏ ‎from ‎a ‎wide ‎spectrum ‎of‏ ‎sources.‏ ‎This‏ ‎broad ‎targeting‏ ‎strategy ‎suggests‏ ‎that ‎the‏ ‎is‏ ‎not ‎only‏ ‎interested ‎in ‎traditional ‎national ‎security-related‏ ‎information ‎but‏ ‎also‏ ‎in ‎acquiring ‎a‏ ‎diverse ‎set‏ ‎of ‎data ‎that ‎could‏ ‎provide‏ ‎economic, ‎political,‏ ‎or ‎technological‏ ‎advantages.

Implications ‎for ‎Different ‎Sectors

📌Aviation: The ‎aviation‏ ‎industry‏ ‎involves ‎a‏ ‎complex ‎ecosystem‏ ‎of ‎airlines, ‎airports, ‎manufacturers, ‎and‏ ‎support‏ ‎services,‏ ‎all ‎of‏ ‎which ‎handle‏ ‎sensitive ‎data‏ ‎related‏ ‎to ‎national‏ ‎security, ‎safety, ‎and ‎proprietary ‎technology.

📌Education:‏ ‎Universities ‎and‏ ‎research‏ ‎institutions ‎are ‎rich‏ ‎sources ‎of‏ ‎cutting-edge ‎research ‎and ‎intellectual‏ ‎property.‏ ‎They ‎are‏ ‎often ‎targeted‏ ‎for ‎their ‎groundbreaking ‎work ‎in‏ ‎science,‏ ‎technology, ‎and‏ ‎defense-related ‎areas.

📌Law‏ ‎Enforcement: ‎Law ‎enforcement ‎agencies ‎hold‏ ‎sensitive‏ ‎data‏ ‎on ‎criminal‏ ‎investigations, ‎national‏ ‎security ‎matters,‏ ‎and‏ ‎personal ‎information‏ ‎of ‎citizens, ‎making ‎them ‎a‏ ‎high-value ‎target‏ ‎for‏ ‎espionage.

📌Local ‎and ‎State‏ ‎Councils: ‎Local‏ ‎and ‎state ‎government ‎entities‏ ‎manage‏ ‎critical ‎infrastructure,‏ ‎citizen ‎services,‏ ‎and ‎have ‎access ‎to ‎vast‏ ‎amounts‏ ‎of ‎personal‏ ‎data, ‎which‏ ‎can ‎be ‎exploited ‎for ‎various‏ ‎malicious‏ ‎purposes.

📌Government‏ ‎Financial ‎Departments:‏ ‎These ‎departments‏ ‎handle ‎sensitive‏ ‎economic‏ ‎data ‎and‏ ‎have ‎insights ‎into ‎national ‎financial‏ ‎strategies ‎and‏ ‎policies,‏ ‎which ‎can ‎be‏ ‎valuable ‎for‏ ‎foreign ‎intelligence ‎services.

📌Military ‎Organizations: Military‏ ‎targets‏ ‎are ‎of‏ ‎high ‎interest‏ ‎due ‎to ‎their ‎strategic ‎importance‏ ‎and‏ ‎access ‎to‏ ‎classified ‎information‏ ‎on ‎defense ‎capabilities, ‎operations, ‎and‏ ‎technologies.

Challenges‏ ‎in‏ ‎Defending ‎a‏ ‎Wide ‎Range‏ ‎of ‎Targets

📌Diverse‏ ‎Security‏ ‎Postures: Different ‎sectors‏ ‎have ‎varying ‎levels ‎of ‎cybersecurity‏ ‎maturity ‎and‏ ‎resources,‏ ‎making ‎some ‎more‏ ‎vulnerable ‎to‏ ‎sophisticated ‎cyber ‎threats.

📌Interconnectedness: ‎The‏ ‎interconnected‏ ‎nature ‎of‏ ‎these ‎sectors‏ ‎means ‎that ‎a ‎breach ‎in‏ ‎one‏ ‎area ‎can‏ ‎have ‎cascading‏ ‎effects ‎on ‎others, ‎as ‎seen‏ ‎in‏ ‎supply‏ ‎chain ‎attacks.

Strategies‏ ‎for ‎Mitigating‏ ‎Expanded ‎Targeting‏ ‎Risks

📌Sector-Specific‏ ‎Cybersecurity ‎Frameworks: Developing‏ ‎and ‎implementing ‎cybersecurity ‎frameworks ‎tailored‏ ‎to ‎the‏ ‎unique‏ ‎needs ‎and ‎risks‏ ‎of ‎each‏ ‎sector ‎can ‎enhance ‎overall‏ ‎security.

📌Information‏ ‎Sharing: ‎Sharing‏ ‎threat ‎intelligence‏ ‎and ‎best ‎practices ‎within ‎and‏ ‎between‏ ‎sectors ‎can‏ ‎help ‎organizations‏ ‎stay ‎ahead ‎of ‎emerging ‎threats‏ ‎and‏ ‎coordinate‏ ‎responses ‎to‏ ‎incidents.

📌Regular ‎Security‏ ‎Assessments: ‎Conducting‏ ‎regular‏ ‎security ‎assessments‏ ‎and ‎penetration ‎testing ‎can ‎help‏ ‎organizations ‎identify‏ ‎and‏ ‎address ‎vulnerabilities ‎before‏ ‎they ‎are‏ ‎exploited.

📌Supply ‎Chain ‎Security: ‎Strengthening‏ ‎the‏ ‎security ‎of‏ ‎the ‎supply‏ ‎chain ‎is ‎critical, ‎as ‎attackers‏ ‎often‏ ‎target ‎less‏ ‎secure ‎elements‏ ‎within ‎the ‎supply ‎chain ‎to‏ ‎gain‏ ‎access‏ ‎to ‎larger‏ ‎organizations.

📌Incident ‎Response‏ ‎Planning: ‎Having‏ ‎a‏ ‎well-defined ‎incident‏ ‎response ‎plan ‎can ‎ensure ‎that‏ ‎organizations ‎are‏ ‎prepared‏ ‎to ‎quickly ‎and‏ ‎effectively ‎respond‏ ‎to ‎a ‎breach.

Читать: 3+ мин
logo Overkill Security

Increased Importance of Cloud Initial Access. First Impressions Matter

The ‎shift‏ ‎in ‎focus ‎by ‎cyber ‎actors‏ ‎to ‎cloud‏ ‎services‏ ‎has ‎brought ‎the‏ ‎importance ‎of‏ ‎securing ‎initial ‎access ‎to‏ ‎the‏ ‎forefront ‎of‏ ‎cybersecurity ‎efforts.‏ ‎In ‎cloud ‎environments, ‎initial ‎access‏ ‎represents‏ ‎the ‎critical‏ ‎juncture ‎at‏ ‎which ‎the ‎security ‎of ‎the‏ ‎entire‏ ‎system‏ ‎is ‎most‏ ‎vulnerable. ‎Unlike‏ ‎traditional ‎on-premises‏ ‎networks,‏ ‎where ‎multiple‏ ‎layers ‎of ‎security ‎can ‎be‏ ‎deployed, ‎cloud‏ ‎services‏ ‎are ‎accessed ‎over‏ ‎the ‎internet,‏ ‎making ‎the ‎initial ‎point‏ ‎of‏ ‎entry ‎a‏ ‎prime ‎target‏ ‎for ‎attackers.

Initial ‎Access ‎as ‎a‏ ‎Foothold‏ ‎for ‎Attackers

Gaining‏ ‎initial ‎access‏ ‎to ‎cloud ‎services ‎allows ‎attackers‏ ‎to‏ ‎establish‏ ‎a ‎foothold‏ ‎within ‎the‏ ‎target ‎environment.‏ ‎From‏ ‎this ‎position,‏ ‎they ‎can ‎potentially ‎escalate ‎privileges,‏ ‎move ‎laterally‏ ‎across‏ ‎the ‎network, ‎and‏ ‎access ‎sensitive‏ ‎data. ‎The ‎distributed ‎nature‏ ‎of‏ ‎cloud ‎services‏ ‎also ‎means‏ ‎that ‎compromising ‎a ‎single ‎account‏ ‎can‏ ‎have ‎far-reaching‏ ‎consequences, ‎potentially‏ ‎giving ‎attackers ‎access ‎to ‎a‏ ‎wide‏ ‎array‏ ‎of ‎resources‏ ‎and ‎data.

Challenges‏ ‎in ‎Securing‏ ‎Initial‏ ‎Access

📌Remote ‎Access: Cloud‏ ‎services ‎are ‎designed ‎to ‎be‏ ‎accessed ‎remotely,‏ ‎which‏ ‎inherently ‎increases ‎the‏ ‎attack ‎surface.‏ ‎Remote ‎access ‎points ‎must‏ ‎be‏ ‎secured ‎against‏ ‎unauthorized ‎entry‏ ‎while ‎still ‎providing ‎legitimate ‎users‏ ‎with‏ ‎the ‎necessary‏ ‎access.

📌Identity ‎and‏ ‎Access ‎Management ‎(IAM): In ‎cloud ‎environments,‏ ‎IAM‏ ‎becomes‏ ‎a ‎critical‏ ‎component ‎of‏ ‎security. ‎Organizations‏ ‎must‏ ‎ensure ‎that‏ ‎IAM ‎policies ‎are ‎robust ‎and‏ ‎that ‎permissions‏ ‎are‏ ‎granted ‎based ‎on‏ ‎the ‎principle‏ ‎of ‎least ‎privilege ‎to‏ ‎minimize‏ ‎the ‎risk‏ ‎of ‎initial‏ ‎access ‎by ‎unauthorized ‎entities.

📌Phishing ‎and‏ ‎Social‏ ‎Engineering: ‎Attackers‏ ‎often ‎use‏ ‎phishing ‎and ‎social ‎engineering ‎tactics‏ ‎to‏ ‎gain‏ ‎initial ‎access.‏ ‎These ‎methods‏ ‎exploit ‎human‏ ‎factors‏ ‎rather ‎than‏ ‎technical ‎vulnerabilities, ‎making ‎them ‎difficult‏ ‎to ‎defend‏ ‎against‏ ‎with ‎traditional ‎security‏ ‎measures.

Examples ‎of‏ ‎Initial ‎Access ‎Techniques

📌Credential ‎Stuffing:‏ ‎This‏ ‎technique ‎involves‏ ‎using ‎previously‏ ‎breached ‎username ‎and ‎password ‎pairs‏ ‎to‏ ‎gain ‎unauthorized‏ ‎access ‎to‏ ‎accounts, ‎banking ‎on ‎the ‎likelihood‏ ‎that‏ ‎individuals‏ ‎reuse ‎credentials‏ ‎across ‎multiple‏ ‎services.

📌Exploiting ‎Misconfigurations:‏ ‎Cloud‏ ‎services ‎can‏ ‎be ‎complex ‎to ‎configure ‎correctly,‏ ‎and ‎attackers‏ ‎often‏ ‎exploit ‎misconfigurations, ‎such‏ ‎as ‎open‏ ‎storage ‎buckets ‎or ‎improperly‏ ‎set‏ ‎access ‎controls,‏ ‎to ‎gain‏ ‎initial ‎access.

📌Compromising ‎Third-Party ‎Services: ‎Attackers‏ ‎may‏ ‎target ‎third-party‏ ‎services ‎that‏ ‎integrate ‎with ‎cloud ‎environments, ‎such‏ ‎as‏ ‎SaaS‏ ‎applications, ‎to‏ ‎gain ‎initial‏ ‎access ‎to‏ ‎the‏ ‎cloud ‎infrastructure.

Mitigating‏ ‎the ‎Risks ‎of ‎Initial ‎Access

📌Comprehensive‏ ‎Access ‎Policies: Establishing‏ ‎and‏ ‎enforcing ‎comprehensive ‎access‏ ‎policies ‎can‏ ‎help ‎control ‎who ‎has‏ ‎access‏ ‎to ‎cloud‏ ‎resources ‎and‏ ‎under ‎what ‎conditions.

📌Regular ‎Audits ‎and‏ ‎Reviews:‏ ‎Conducting ‎regular‏ ‎audits ‎and‏ ‎reviews ‎of ‎access ‎logs ‎and‏ ‎permissions‏ ‎can‏ ‎help ‎identify‏ ‎and ‎rectify‏ ‎potential ‎vulnerabilities‏ ‎before‏ ‎they ‎are‏ ‎exploited.

📌Security ‎Awareness ‎Training: ‎Educating ‎employees‏ ‎about ‎the‏ ‎risks‏ ‎of ‎phishing ‎and‏ ‎social ‎engineering‏ ‎can ‎reduce ‎the ‎likelihood‏ ‎of‏ ‎credentials ‎being‏ ‎compromised.

📌Endpoint ‎Security:‏ ‎Ensuring ‎that ‎all ‎devices ‎used‏ ‎to‏ ‎access ‎cloud‏ ‎services ‎are‏ ‎secure ‎and ‎up-to-date ‎can ‎prevent‏ ‎attackers‏ ‎from‏ ‎exploiting ‎endpoint‏ ‎vulnerabilities ‎to‏ ‎gain ‎initial‏ ‎access.

📌Anomaly‏ ‎Detection: ‎Implementing‏ ‎anomaly ‎detection ‎systems ‎can ‎help‏ ‎identify ‎unusual‏ ‎access‏ ‎patterns ‎or ‎login‏ ‎attempts ‎that‏ ‎may ‎indicate ‎an ‎attempted‏ ‎breach.

Читать: 3+ мин
logo Overkill Security

Authentication as a Key Step. We Don't Need No Stinkin' Passwords!

Authentication ‎as‏ ‎a ‎Key ‎Step ‎in ‎Cloud‏ ‎Security

In ‎the‏ ‎evolving‏ ‎landscape ‎of ‎cybersecurity,‏ ‎the ‎adaptation‏ ‎of ‎cyber ‎actors ‎to‏ ‎target‏ ‎cloud ‎services‏ ‎underscores ‎a‏ ‎pivotal ‎shift ‎in ‎the ‎tactics‏ ‎of‏ ‎cyber ‎espionage.‏ ‎This ‎transition‏ ‎from ‎exploiting ‎on-premises ‎network ‎vulnerabilities‏ ‎to‏ ‎directly‏ ‎targeting ‎cloud-based‏ ‎infrastructures ‎marks‏ ‎a ‎significant‏ ‎evolution‏ ‎in ‎cyber‏ ‎threats. ‎At ‎the ‎heart ‎of‏ ‎this ‎shift‏ ‎is‏ ‎the ‎critical ‎role‏ ‎of ‎authentication‏ ‎as ‎a ‎key ‎step‏ ‎in‏ ‎securing ‎cloud-hosted‏ ‎networks ‎against‏ ‎sophisticated ‎cyber ‎actors.

The ‎Importance ‎of‏ ‎Authentication‏ ‎in ‎Cloud‏ ‎Environments

Authentication ‎serves‏ ‎as ‎the ‎gateway ‎to ‎cloud‏ ‎services,‏ ‎determining‏ ‎whether ‎access‏ ‎should ‎be‏ ‎granted ‎to‏ ‎a‏ ‎user ‎or‏ ‎system. ‎In ‎cloud ‎environments, ‎where‏ ‎resources ‎and‏ ‎data‏ ‎are ‎hosted ‎off-premises‏ ‎and ‎accessed‏ ‎over ‎the ‎internet, ‎the‏ ‎importance‏ ‎of ‎robust‏ ‎authentication ‎mechanisms‏ ‎cannot ‎be ‎overstated. ‎Unlike ‎traditional‏ ‎on-premises‏ ‎setups, ‎where‏ ‎physical ‎security‏ ‎measures ‎and ‎internal ‎network ‎defenses‏ ‎can‏ ‎provide‏ ‎layers ‎of‏ ‎security, ‎cloud‏ ‎services ‎are‏ ‎inherently‏ ‎more ‎exposed‏ ‎to ‎the ‎internet. ‎This ‎exposure‏ ‎makes ‎the‏ ‎initial‏ ‎step ‎of ‎authentication‏ ‎not ‎just‏ ‎a ‎security ‎measure, ‎but‏ ‎a‏ ‎critical ‎defense‏ ‎mechanism ‎against‏ ‎unauthorized ‎access.

Challenges ‎in ‎Cloud ‎Authentication

The‏ ‎shift‏ ‎towards ‎cloud‏ ‎services ‎brings‏ ‎with ‎it ‎unique ‎challenges ‎in‏ ‎implementing‏ ‎effective‏ ‎authentication ‎strategies.‏ ‎One ‎of‏ ‎the ‎primary‏ ‎challenges‏ ‎is ‎the‏ ‎diverse ‎and ‎dynamic ‎nature ‎of‏ ‎cloud ‎environments.‏ ‎Users‏ ‎access ‎cloud ‎services‏ ‎from ‎various‏ ‎locations, ‎devices, ‎and ‎networks,‏ ‎necessitating‏ ‎flexible ‎yet‏ ‎secure ‎authentication‏ ‎mechanisms ‎that ‎can ‎adapt ‎to‏ ‎different‏ ‎contexts ‎without‏ ‎compromising ‎security.

Moreover,‏ ‎the ‎scalability ‎of ‎cloud ‎services‏ ‎means‏ ‎that‏ ‎authentication ‎mechanisms‏ ‎must ‎be‏ ‎able ‎to‏ ‎handle‏ ‎a ‎large‏ ‎number ‎of ‎access ‎requests ‎without‏ ‎introducing ‎significant‏ ‎latency‏ ‎or ‎reducing ‎the‏ ‎user ‎experience.‏ ‎This ‎requirement ‎for ‎scalability‏ ‎and‏ ‎user-friendliness ‎often‏ ‎conflicts ‎with‏ ‎the ‎need ‎for ‎stringent ‎security‏ ‎measures,‏ ‎creating ‎a‏ ‎delicate ‎balance‏ ‎that ‎organizations ‎must ‎navigate.

Strategies ‎for‏ ‎Strengthening‏ ‎Cloud‏ ‎Authentication

To ‎address‏ ‎the ‎challenges‏ ‎of ‎cloud‏ ‎authentication‏ ‎and ‎protect‏ ‎against ‎sophisticated ‎cyber ‎actors, ‎organizations‏ ‎can ‎adopt‏ ‎several‏ ‎strategies:

📌Multi-Factor ‎Authentication ‎(MFA):‏ ‎MFA ‎adds‏ ‎an ‎extra ‎layer ‎of‏ ‎security‏ ‎by ‎requiring‏ ‎users ‎to‏ ‎provide ‎two ‎or ‎more ‎verification‏ ‎factors‏ ‎to ‎gain‏ ‎access. ‎This‏ ‎approach ‎significantly ‎reduces ‎the ‎risk‏ ‎of‏ ‎unauthorized‏ ‎access, ‎as‏ ‎obtaining ‎multiple‏ ‎authentication ‎factors‏ ‎is‏ ‎considerably ‎more‏ ‎difficult ‎for ‎attackers.

📌Adaptive ‎Authentication: ‎Adaptive‏ ‎authentication ‎mechanisms‏ ‎adjust‏ ‎the ‎authentication ‎requirements‏ ‎based ‎on‏ ‎the ‎context ‎of ‎the‏ ‎access‏ ‎request. ‎Factors‏ ‎such ‎as‏ ‎the ‎user's ‎location, ‎device, ‎and‏ ‎behavior‏ ‎can ‎influence‏ ‎the ‎authentication‏ ‎process, ‎allowing ‎for ‎stricter ‎controls‏ ‎in‏ ‎higher-risk‏ ‎scenarios.

📌Zero ‎Trust‏ ‎Architecture: Adopting ‎a‏ ‎zero-trust ‎approach‏ ‎to‏ ‎cloud ‎security,‏ ‎where ‎no ‎user ‎or ‎system‏ ‎is ‎trusted‏ ‎by‏ ‎default, ‎can ‎enhance‏ ‎the ‎effectiveness‏ ‎of ‎authentication. ‎This ‎model‏ ‎requires‏ ‎strict ‎identity‏ ‎verification ‎for‏ ‎every ‎user ‎and ‎device ‎trying‏ ‎to‏ ‎access ‎resources,‏ ‎regardless ‎of‏ ‎their ‎location ‎or ‎network.

📌Use ‎of‏ ‎Biometrics:‏ ‎Biometric‏ ‎authentication ‎methods,‏ ‎such ‎as‏ ‎fingerprint ‎scans‏ ‎or‏ ‎facial ‎recognition,‏ ‎offer ‎a ‎high ‎level ‎of‏ ‎security ‎by‏ ‎leveraging‏ ‎unique ‎physical ‎characteristics‏ ‎of ‎users.‏ ‎These ‎methods ‎can ‎be‏ ‎particularly‏ ‎effective ‎in‏ ‎preventing ‎unauthorized‏ ‎access ‎in ‎cloud ‎environments.

📌Encryption ‎of‏ ‎Authentication‏ ‎Data: ‎Ensuring‏ ‎that ‎all‏ ‎authentication ‎data ‎is ‎encrypted, ‎both‏ ‎in‏ ‎transit‏ ‎and ‎at‏ ‎rest, ‎can‏ ‎protect ‎against‏ ‎interception‏ ‎and ‎misuse‏ ‎by ‎attackers. ‎This ‎includes ‎encryption‏ ‎of ‎passwords,‏ ‎authentication‏ ‎tokens, ‎and ‎other‏ ‎sensitive ‎information‏ ‎involved ‎in ‎the ‎authentication‏ ‎process.

Читать: 8+ мин
logo Overkill Security

Cloud TTPs Details. The Cyber Magician's Handbook

Key ‎TTPs‏ ‎of ‎document ‎“cyber ‎actors ‎adapt‏ ‎tactics ‎for‏ ‎initial‏ ‎cloud ‎access"

📌Credential ‎Access‏ ‎/ ‎T1110‏ ‎Brute ‎Forcing: actors ‎utilize ‎password‏ ‎spraying‏ ‎and ‎brute‏ ‎forcing ‎as‏ ‎initial ‎infection ‎vectors. ‎This ‎approach‏ ‎involves‏ ‎attempting ‎multiple‏ ‎passwords ‎against‏ ‎different ‎accounts ‎(password ‎spraying) ‎or‏ ‎numerous‏ ‎password‏ ‎attempts ‎on‏ ‎a ‎single‏ ‎account ‎(brute‏ ‎forcing)‏ ‎to ‎gain‏ ‎unauthorized ‎access.

📌Initial ‎Access ‎/ ‎T1078.004‏ ‎Valid ‎Accounts:‏ ‎Cloud‏ ‎Accounts: ‎The ‎actors‏ ‎gains ‎access‏ ‎to ‎cloud ‎services ‎by‏ ‎using‏ ‎compromised ‎credentials.‏ ‎This ‎includes‏ ‎targeting ‎both ‎system ‎accounts ‎(used‏ ‎for‏ ‎automated ‎tasks‏ ‎and ‎services)‏ ‎and ‎dormant ‎accounts ‎(inactive ‎accounts‏ ‎that‏ ‎still‏ ‎remain ‎on‏ ‎the ‎system).

📌Credential‏ ‎Access ‎/‏ ‎T1528‏ ‎Steal ‎Application‏ ‎Access ‎Token: ‎Actors ‎exploit ‎stolen‏ ‎access ‎tokens‏ ‎to‏ ‎log ‎into ‎accounts‏ ‎without ‎needing‏ ‎the ‎passwords. ‎Access ‎tokens‏ ‎are‏ ‎digital ‎keys‏ ‎that ‎allow‏ ‎access ‎to ‎user ‎accounts, ‎and‏ ‎obtaining‏ ‎these ‎can‏ ‎bypass ‎traditional‏ ‎login ‎mechanisms.

📌Credential ‎Access ‎/ ‎T1621‏ ‎Multi-Factor‏ ‎Authentication‏ ‎Request ‎Generation: Known‏ ‎as ‎'MFA‏ ‎bombing' ‎or‏ ‎'MFA‏ ‎fatigue,' ‎this‏ ‎technique ‎involves ‎actors ‎repeatedly ‎sending‏ ‎MFA ‎requests‏ ‎to‏ ‎a ‎victim's ‎device.‏ ‎The ‎goal‏ ‎is ‎to ‎overwhelm ‎or‏ ‎fatigue‏ ‎the ‎victim‏ ‎into ‎accepting‏ ‎the ‎request, ‎thus ‎granting ‎the‏ ‎attacker‏ ‎access.

📌Command ‎and‏ ‎Control ‎/‏ ‎T1090.002 ‎Proxy: ‎External ‎Proxy: ‎To‏ ‎maintain‏ ‎covert‏ ‎operations ‎and‏ ‎blend ‎in‏ ‎with ‎normal‏ ‎traffic,‏ ‎actors ‎use‏ ‎open ‎proxies ‎located ‎in ‎residential‏ ‎IP ‎ranges.‏ ‎This‏ ‎makes ‎malicious ‎connections‏ ‎harder ‎to‏ ‎distinguish ‎from ‎legitimate ‎user‏ ‎activity‏ ‎in ‎access‏ ‎logs.

📌Persistence ‎/‏ ‎T1098.005 ‎Account ‎Manipulation: ‎Device ‎Registration:‏ ‎After‏ ‎gaining ‎access‏ ‎to ‎accounts,‏ ‎actors ‎attempt ‎to ‎register ‎their‏ ‎own‏ ‎devices‏ ‎on ‎the‏ ‎cloud ‎tenant.‏ ‎Successful ‎device‏ ‎registration‏ ‎can ‎provide‏ ‎persistent ‎access ‎to ‎the ‎cloud‏ ‎environment.

Access ‎via‏ ‎Service‏ ‎and ‎Dormant ‎Accounts

One‏ ‎of ‎the‏ ‎key ‎strategies ‎employed ‎by‏ ‎actors‏ ‎involves ‎targeting‏ ‎service ‎and‏ ‎dormant ‎accounts ‎within ‎cloud ‎environments.‏ ‎Service‏ ‎accounts ‎are‏ ‎used ‎to‏ ‎run ‎and ‎manage ‎applications ‎and‏ ‎services‏ ‎without‏ ‎direct ‎human‏ ‎interaction. ‎These‏ ‎accounts ‎are‏ ‎particularly‏ ‎vulnerable ‎because‏ ‎they ‎often ‎cannot ‎be ‎protected‏ ‎with ‎multi-factor‏ ‎authentication‏ ‎(MFA) ‎and ‎may‏ ‎have ‎highly‏ ‎privileged ‎access ‎depending ‎on‏ ‎their‏ ‎role ‎in‏ ‎managing ‎applications‏ ‎and ‎services. ‎By ‎gaining ‎access‏ ‎to‏ ‎these ‎accounts,‏ ‎threat ‎actors‏ ‎can ‎obtain ‎privileged ‎initial ‎access‏ ‎to‏ ‎a‏ ‎network, ‎which‏ ‎they ‎can‏ ‎use ‎as‏ ‎a‏ ‎launchpad ‎for‏ ‎further ‎operations

The ‎document ‎also ‎highlights‏ ‎that ‎campaigns‏ ‎have‏ ‎targeted ‎dormant ‎accounts—accounts‏ ‎belonging ‎to‏ ‎users ‎who ‎are ‎no‏ ‎longer‏ ‎active ‎within‏ ‎the ‎victim‏ ‎organization ‎but ‎have ‎not ‎been‏ ‎removed‏ ‎from ‎the‏ ‎system. ‎These‏ ‎accounts ‎can ‎be ‎exploited ‎by‏ ‎attackers‏ ‎to‏ ‎regain ‎access‏ ‎to ‎a‏ ‎network, ‎especially‏ ‎following‏ ‎incident ‎response‏ ‎measures ‎such ‎as ‎enforced ‎password‏ ‎resets. ‎actors‏ ‎have‏ ‎been ‎observed ‎logging‏ ‎into ‎these‏ ‎inactive ‎accounts ‎and ‎following‏ ‎password‏ ‎reset ‎instructions,‏ ‎allowing ‎them‏ ‎to ‎maintain ‎access ‎even ‎after‏ ‎incident‏ ‎response ‎teams‏ ‎have ‎attempted‏ ‎to ‎evict ‎them

Cloud-Based ‎Token ‎Authentication

Another‏ ‎TTP‏ ‎mentioned‏ ‎in ‎the‏ ‎document ‎is‏ ‎the ‎use‏ ‎of‏ ‎cloud-based ‎token‏ ‎authentication. ‎Actors ‎have ‎been ‎observed‏ ‎using ‎system-issued‏ ‎access‏ ‎tokens ‎to ‎authenticate‏ ‎victims' ‎accounts‏ ‎without ‎needing ‎a ‎password.‏ ‎This‏ ‎technique ‎bypasses‏ ‎traditional ‎credential-based‏ ‎authentication ‎methods ‎and ‎can ‎be‏ ‎particularly‏ ‎effective ‎if‏ ‎the ‎validity‏ ‎period ‎of ‎these ‎tokens ‎is‏ ‎long‏ ‎or‏ ‎if ‎the‏ ‎tokens ‎are‏ ‎not ‎properly‏ ‎secured‏ ‎and ‎managed

Brute‏ ‎Forcing ‎and ‎Password ‎Spraying

The ‎document‏ ‎also ‎describes‏ ‎the‏ ‎use ‎of ‎brute‏ ‎forcing ‎(T1110)‏ ‎and ‎password ‎spraying ‎by‏ ‎actors‏ ‎as ‎initial‏ ‎infection ‎vectors.‏ ‎These ‎techniques ‎involve ‎attempting ‎to‏ ‎access‏ ‎accounts ‎by‏ ‎trying ‎many‏ ‎passwords ‎or ‎using ‎common ‎passwords‏ ‎against‏ ‎many‏ ‎accounts, ‎respectively.‏ ‎Such ‎methods‏ ‎are ‎often‏ ‎successful‏ ‎due ‎to‏ ‎the ‎use ‎of ‎weak ‎or‏ ‎reused ‎passwords‏ ‎across‏ ‎different ‎accounts

The ‎Role‏ ‎of ‎Access‏ ‎Tokens

Access ‎tokens ‎are ‎an‏ ‎integral‏ ‎part ‎of‏ ‎modern ‎authentication‏ ‎systems, ‎especially ‎in ‎cloud ‎environments.‏ ‎They‏ ‎are ‎designed‏ ‎to ‎simplify‏ ‎the ‎login ‎process ‎for ‎users‏ ‎and‏ ‎provide‏ ‎a ‎secure‏ ‎method ‎of‏ ‎accessing ‎resources‏ ‎without‏ ‎repeatedly ‎entering‏ ‎credentials. ‎Tokens ‎are ‎typically ‎issued‏ ‎after ‎a‏ ‎user‏ ‎logs ‎in ‎with‏ ‎a ‎username‏ ‎and ‎password, ‎and ‎they‏ ‎can‏ ‎be ‎used‏ ‎for ‎subsequent‏ ‎authentication ‎requests.

Risks ‎Associated ‎with ‎Token‏ ‎Authentication

While‏ ‎token-based ‎authentication‏ ‎can ‎offer‏ ‎convenience ‎and ‎security, ‎it ‎also‏ ‎introduces‏ ‎specific‏ ‎risks ‎if‏ ‎not ‎properly‏ ‎managed. ‎If‏ ‎threat‏ ‎actors ‎obtain‏ ‎these ‎tokens, ‎they ‎can ‎gain‏ ‎access ‎to‏ ‎accounts‏ ‎without ‎needing ‎to‏ ‎know ‎the‏ ‎passwords. ‎This ‎can ‎be‏ ‎particularly‏ ‎problematic ‎if‏ ‎the ‎tokens‏ ‎have ‎a ‎long ‎validity ‎period‏ ‎or‏ ‎if ‎they‏ ‎are ‎not‏ ‎adequately ‎secured.

Adjusting ‎Token ‎Validity

The ‎document‏ ‎notes‏ ‎that‏ ‎the ‎default‏ ‎validity ‎time‏ ‎of ‎system-issued‏ ‎tokens‏ ‎can ‎vary‏ ‎depending ‎on ‎the ‎system ‎in‏ ‎use. ‎However,‏ ‎it‏ ‎is ‎crucial ‎for‏ ‎cloud ‎platforms‏ ‎to ‎provide ‎administrators ‎with‏ ‎the‏ ‎ability ‎to‏ ‎adjust ‎the‏ ‎validity ‎time ‎of ‎these ‎tokens‏ ‎to‏ ‎suit ‎their‏ ‎security ‎needs.‏ ‎Shortening ‎the ‎validity ‎period ‎of‏ ‎tokens‏ ‎can‏ ‎reduce ‎the‏ ‎window ‎of‏ ‎opportunity ‎for‏ ‎unauthorized‏ ‎access ‎if‏ ‎tokens ‎are ‎compromised.

Bypassing ‎Password ‎Authentication‏ ‎and ‎MFA

The‏ ‎document‏ ‎details ‎how ‎actors‏ ‎have ‎successfully‏ ‎bypassed ‎password ‎authentication ‎on‏ ‎personal‏ ‎accounts ‎through‏ ‎techniques ‎such‏ ‎as ‎password ‎spraying ‎and ‎credential‏ ‎reuse.‏ ‎Password ‎spraying‏ ‎involves ‎attempting‏ ‎to ‎access ‎a ‎large ‎number‏ ‎of‏ ‎accounts‏ ‎using ‎commonly‏ ‎used ‎passwords,‏ ‎while ‎credential‏ ‎reuse‏ ‎exploits ‎the‏ ‎tendency ‎of ‎users ‎to ‎recycle‏ ‎the ‎same‏ ‎passwords‏ ‎across ‎multiple ‎accounts.‏ ‎These ‎methods‏ ‎exploit ‎weaknesses ‎in ‎password-based‏ ‎authentication‏ ‎systems ‎to‏ ‎gain ‎initial‏ ‎access ‎to ‎accounts.

Furthermore, ‎actors ‎have‏ ‎employed‏ ‎a ‎technique‏ ‎known ‎as‏ ‎'MFA ‎bombing' ‎or ‎'MFA ‎fatigue'‏ ‎(T1621)‏ ‎to‏ ‎bypass ‎multi-factor‏ ‎authentication ‎(MFA)‏ ‎systems. ‎This‏ ‎technique‏ ‎involves ‎repeatedly‏ ‎sending ‎MFA ‎requests ‎to ‎a‏ ‎victim's ‎device‏ ‎until‏ ‎the ‎victim, ‎overwhelmed‏ ‎or ‎frustrated‏ ‎by ‎the ‎constant ‎notifications,‏ ‎accepts‏ ‎the ‎request.‏ ‎This ‎method‏ ‎effectively ‎exploits ‎human ‎psychology ‎and‏ ‎the‏ ‎inconvenience ‎of‏ ‎repeated ‎notifications‏ ‎to ‎circumvent ‎an ‎otherwise ‎robust‏ ‎security‏ ‎measure.

Enrolling‏ ‎New ‎Devices‏ ‎to ‎the‏ ‎Cloud

Once ‎past‏ ‎these‏ ‎initial ‎security‏ ‎barriers, ‎the ‎document ‎reports ‎that‏ ‎actors ‎have‏ ‎been‏ ‎observed ‎registering ‎their‏ ‎own ‎devices‏ ‎as ‎new ‎devices ‎on‏ ‎the‏ ‎cloud ‎tenant‏ ‎(T1098.005). ‎This‏ ‎step ‎is ‎critical ‎for ‎maintaining‏ ‎access‏ ‎to ‎the‏ ‎cloud ‎environment‏ ‎and ‎facilitating ‎further ‎malicious ‎activities.‏ ‎The‏ ‎success‏ ‎of ‎this‏ ‎tactic ‎hinges‏ ‎on ‎the‏ ‎absence‏ ‎of ‎stringent‏ ‎device ‎validation ‎rules ‎within ‎the‏ ‎cloud ‎tenant's‏ ‎security‏ ‎configuration. ‎Without ‎proper‏ ‎device ‎validation‏ ‎measures, ‎attackers ‎can ‎easily‏ ‎add‏ ‎unauthorized ‎devices‏ ‎to ‎the‏ ‎network, ‎granting ‎them ‎access ‎to‏ ‎sensitive‏ ‎data ‎and‏ ‎systems.

Defense ‎Against‏ ‎Unauthorized ‎Device ‎Enrollment

The ‎document ‎highlights‏ ‎the‏ ‎importance‏ ‎of ‎configuring‏ ‎the ‎network‏ ‎with ‎robust‏ ‎device‏ ‎enrollment ‎policies‏ ‎as ‎a ‎defense ‎mechanism ‎against‏ ‎such ‎attacks.‏ ‎By‏ ‎implementing ‎strict ‎device‏ ‎validation ‎rules‏ ‎and ‎enrollment ‎policies, ‎organizations‏ ‎can‏ ‎significantly ‎reduce‏ ‎the ‎risk‏ ‎of ‎unauthorized ‎device ‎registration. ‎Instances‏ ‎where‏ ‎these ‎measures‏ ‎have ‎been‏ ‎effectively ‎applied ‎have ‎successfully ‎defended‏ ‎against‏ ‎actors,‏ ‎denying ‎them‏ ‎access ‎to‏ ‎the ‎cloud‏ ‎tenant.

Residential‏ ‎Proxies ‎and‏ ‎Their ‎Use ‎by ‎Actors

Residential ‎proxies‏ ‎are ‎intermediary‏ ‎services‏ ‎that ‎allow ‎users‏ ‎to ‎route‏ ‎their ‎internet ‎traffic ‎through‏ ‎an‏ ‎IP ‎address‏ ‎provided ‎by‏ ‎an ‎internet ‎service ‎provider ‎(ISP)‏ ‎that‏ ‎is ‎typically‏ ‎assigned ‎to‏ ‎a ‎residential ‎address. ‎This ‎makes‏ ‎the‏ ‎traffic‏ ‎appear ‎as‏ ‎if ‎it‏ ‎is ‎originating‏ ‎from‏ ‎a ‎regular‏ ‎home ‎user, ‎which ‎can ‎be‏ ‎particularly ‎useful‏ ‎for‏ ‎cyber ‎actors ‎looking‏ ‎to ‎blend‏ ‎in ‎with ‎normal ‎internet‏ ‎traffic‏ ‎and ‎avoid‏ ‎raising ‎red‏ ‎flags.

The ‎use ‎of ‎residential ‎proxies‏ ‎by‏ ‎actors ‎serves‏ ‎to ‎obfuscate‏ ‎their ‎true ‎location ‎and ‎the‏ ‎source‏ ‎of‏ ‎their ‎malicious‏ ‎activities. ‎By‏ ‎making ‎their‏ ‎traffic‏ ‎appear ‎to‏ ‎come ‎from ‎legitimate ‎ISP ‎ranges‏ ‎used ‎by‏ ‎residential‏ ‎broadband ‎customers, ‎they‏ ‎can ‎significantly‏ ‎reduce ‎the ‎likelihood ‎of‏ ‎their‏ ‎connections ‎being‏ ‎flagged ‎as‏ ‎malicious. ‎This ‎tactic ‎complicates ‎the‏ ‎efforts‏ ‎of ‎cybersecurity‏ ‎defenses ‎that‏ ‎rely ‎on ‎IP ‎address ‎reputation‏ ‎or‏ ‎geolocation‏ ‎as ‎indicators‏ ‎of ‎compromise.

Challenges‏ ‎Posed ‎by‏ ‎Residential‏ ‎Proxies

The ‎effectiveness‏ ‎of ‎residential ‎proxies ‎in ‎hiding‏ ‎the ‎origin‏ ‎of‏ ‎traffic ‎presents ‎a‏ ‎challenge ‎for‏ ‎network ‎defenses. ‎Traditional ‎security‏ ‎measures‏ ‎that ‎track‏ ‎and ‎block‏ ‎known ‎malicious ‎IP ‎addresses ‎may‏ ‎not‏ ‎be ‎effective‏ ‎against ‎attackers‏ ‎using ‎residential ‎proxies, ‎as ‎these‏ ‎IP‏ ‎addresses‏ ‎may ‎not‏ ‎have ‎a‏ ‎prior ‎history‏ ‎of‏ ‎malicious ‎activity‏ ‎and ‎are ‎indistinguishable ‎from ‎those‏ ‎of ‎legitimate‏ ‎users.

Читать: 2+ мин
logo Overkill Security

Adaptation to Cloud Services. Chameleons of the Cyber World

The ‎adaptation‏ ‎of ‎attacks ‎to ‎target ‎cloud‏ ‎services ‎marks‏ ‎a‏ ‎significant ‎evolution ‎in‏ ‎the ‎landscape‏ ‎of ‎cyber ‎espionage ‎and‏ ‎cyber‏ ‎warfare. ‎This‏ ‎shift ‎is‏ ‎not ‎merely ‎a ‎change ‎in‏ ‎target‏ ‎but ‎represents‏ ‎a ‎deeper‏ ‎strategic ‎adaptation ‎to ‎the ‎changing‏ ‎technological‏ ‎environment‏ ‎and ‎the‏ ‎increasing ‎reliance‏ ‎of ‎governments‏ ‎and‏ ‎corporations ‎on‏ ‎cloud ‎infrastructure. ‎The ‎move ‎towards‏ ‎cloud ‎services‏ ‎by‏ ‎organizations ‎is ‎driven‏ ‎by ‎the‏ ‎benefits ‎of ‎scalability, ‎cost-efficiency,‏ ‎and‏ ‎the ‎ability‏ ‎to ‎rapidly‏ ‎deploy ‎and ‎update ‎services. ‎However,‏ ‎this‏ ‎transition ‎also‏ ‎presents ‎new‏ ‎vulnerabilities ‎and ‎challenges ‎for ‎cybersecurity.

Strategic‏ ‎Shift‏ ‎to‏ ‎Cloud

As ‎organizations‏ ‎have ‎modernized‏ ‎their ‎systems‏ ‎and‏ ‎migrated ‎to‏ ‎cloud-based ‎infrastructure, ‎actors ‎have ‎adapted‏ ‎their ‎tactics,‏ ‎techniques,‏ ‎and ‎procedures ‎(TTPs)‏ ‎to ‎this‏ ‎new ‎environment. ‎This ‎adaptation‏ ‎is‏ ‎driven ‎by‏ ‎the ‎realization‏ ‎that ‎cloud ‎services, ‎by ‎centralizing‏ ‎vast‏ ‎amounts ‎of‏ ‎data ‎and‏ ‎resources, ‎present ‎a ‎lucrative ‎target‏ ‎for‏ ‎espionage‏ ‎and ‎intelligence‏ ‎gathering. ‎The‏ ‎cloud's ‎architecture,‏ ‎while‏ ‎offering ‎numerous‏ ‎advantages ‎to ‎organizations, ‎also ‎necessitates‏ ‎a ‎reevaluation‏ ‎of‏ ‎security ‎strategies ‎to‏ ‎address ‎unique‏ ‎vulnerabilities.

Tactics, ‎Techniques, ‎and ‎Procedures‏ ‎(TTPs)

The‏ ‎adaptation ‎of‏ ‎actors ‎to‏ ‎cloud ‎services ‎involves ‎a ‎range‏ ‎of‏ ‎sophisticated ‎TTPs‏ ‎designed ‎to‏ ‎exploit ‎the ‎specific ‎characteristics ‎of‏ ‎cloud‏ ‎environments.‏ ‎One ‎of‏ ‎the ‎primary‏ ‎methods ‎of‏ ‎gaining‏ ‎initial ‎access‏ ‎to ‎cloud-hosted ‎networks ‎involves ‎authenticating‏ ‎to ‎the‏ ‎cloud‏ ‎provider. ‎This ‎can‏ ‎be ‎achieved‏ ‎through ‎various ‎means, ‎including‏ ‎brute‏ ‎forcing ‎and‏ ‎password ‎spraying‏ ‎to ‎access ‎services ‎and ‎dormant‏ ‎accounts.‏ ‎These ‎accounts,‏ ‎often ‎used‏ ‎to ‎run ‎and ‎manage ‎applications‏ ‎without‏ ‎direct‏ ‎human ‎oversight,‏ ‎are ‎particularly‏ ‎vulnerable ‎as‏ ‎they‏ ‎may ‎not‏ ‎be ‎protected ‎by ‎multi-factor ‎authentication‏ ‎(MFA) ‎and‏ ‎may‏ ‎possess ‎high ‎levels‏ ‎of ‎privilege.

Furthermore,‏ ‎actors ‎have ‎been ‎observed‏ ‎using‏ ‎system-issued ‎tokens‏ ‎for ‎authentication,‏ ‎bypassing ‎the ‎need ‎for ‎passwords.‏ ‎They‏ ‎have ‎also‏ ‎exploited ‎the‏ ‎process ‎of ‎enrolling ‎new ‎devices‏ ‎to‏ ‎the‏ ‎cloud, ‎bypassing‏ ‎MFA ‎through‏ ‎techniques ‎such‏ ‎as‏ ‎"MFA ‎bombing"‏ ‎or ‎"MFA ‎fatigue." ‎Additionally, ‎the‏ ‎use ‎of‏ ‎residential‏ ‎proxies ‎to ‎obscure‏ ‎their ‎internet‏ ‎presence ‎and ‎make ‎malicious‏ ‎activity‏ ‎harder ‎to‏ ‎detect ‎represents‏ ‎another ‎layer ‎of ‎sophistication ‎in‏ ‎their‏ ‎operations.

Implications ‎and‏ ‎Mitigations

The ‎adaptation‏ ‎of ‎actors ‎to ‎target ‎cloud‏ ‎services‏ ‎has‏ ‎significant ‎implications‏ ‎for ‎cybersecurity.‏ ‎It ‎underscores‏ ‎the‏ ‎need ‎for‏ ‎organizations ‎to ‎implement ‎robust ‎security‏ ‎measures ‎tailored‏ ‎to‏ ‎the ‎cloud ‎environment.‏ ‎This ‎includes‏ ‎enforcing ‎strong ‎password ‎policies,‏ ‎implementing‏ ‎MFA, ‎managing‏ ‎and ‎monitoring‏ ‎service ‎and ‎dormant ‎accounts, ‎and‏ ‎configuring‏ ‎device ‎enrollment‏ ‎policies ‎to‏ ‎prevent ‎unauthorized ‎access. ‎Additionally, ‎adjusting‏ ‎the‏ ‎validity‏ ‎time ‎of‏ ‎system-issued ‎tokens‏ ‎and ‎employing‏ ‎network-level‏ ‎defenses ‎to‏ ‎detect ‎and ‎mitigate ‎the ‎use‏ ‎of ‎residential‏ ‎proxies‏ ‎are ‎critical ‎steps‏ ‎in ‎defending‏ ‎against ‎these ‎threats.

Читать: 2+ мин
logo Overkill Security

AdaptTactics' Advisory: The Art of Cloud Sneakery

The ‎document‏ ‎titled ‎“cyber ‎actors ‎adapt ‎tactics‏ ‎for ‎initial‏ ‎cloud‏ ‎access” ‎released ‎by‏ ‎the ‎National‏ ‎Security ‎Agency ‎(NSA) ‎warns‏ ‎of‏ ‎use ‎of‏ ‎cyber ‎actors‏ ‎have ‎adapted ‎their ‎tactics ‎to‏ ‎gain‏ ‎initial ‎access‏ ‎to ‎cloud‏ ‎services, ‎as ‎opposed ‎to ‎exploiting‏ ‎on-premise‏ ‎network‏ ‎vulnerabilities.

This ‎shift‏ ‎is ‎in‏ ‎response ‎to‏ ‎organizations‏ ‎modernizing ‎their‏ ‎systems ‎and ‎moving ‎to ‎cloud-based‏ ‎infrastructure. ‎The‏ ‎high-profile‏ ‎cyber ‎campaigns ‎like‏ ‎the ‎SolarWinds‏ ‎supply ‎chain ‎compromise ‎are‏ ‎now‏ ‎expanding ‎to‏ ‎sectors ‎such‏ ‎as ‎aviation, ‎education, ‎law ‎enforcement,‏ ‎local‏ ‎and ‎state‏ ‎councils, ‎government‏ ‎financial ‎departments, ‎and ‎military ‎organizations.

The‏ ‎stark‏ ‎reality‏ ‎is ‎that‏ ‎to ‎breach‏ ‎cloud-hosted ‎networks,‏ ‎these‏ ‎actors ‎need‏ ‎only ‎to ‎authenticate ‎with ‎the‏ ‎cloud ‎provider,‏ ‎and‏ ‎if ‎they ‎succeed,‏ ‎the ‎defenses‏ ‎are ‎breached. ‎The ‎document‏ ‎highlights‏ ‎a ‎particularly‏ ‎disconcerting ‎aspect‏ ‎of ‎cloud ‎environments: ‎the ‎reduced‏ ‎network‏ ‎exposure ‎compared‏ ‎to ‎on-premises‏ ‎systems ‎paradoxically ‎makes ‎initial ‎access‏ ‎a‏ ‎more‏ ‎significant ‎linchpin.

Over‏ ‎the ‎past‏ ‎year, ‎the‏ ‎TTPs‏ ‎observed ‎have‏ ‎been ‎alarmingly ‎simple ‎yet ‎effective,‏ ‎with ‎the‏ ‎cyber‏ ‎actors ‎exploiting ‎service‏ ‎and ‎dormant‏ ‎accounts ‎through ‎brute ‎force‏ ‎attacks.‏ ‎The ‎document‏ ‎offers ‎a‏ ‎cold ‎comfort ‎implies ‎a ‎race‏ ‎against‏ ‎time ‎to‏ ‎fortify ‎their‏ ‎defenses ‎against ‎these ‎TTPs ‎to‏ ‎prevent‏ ‎initial‏ ‎access.

Keypoints

📌Adaptation ‎to‏ ‎Cloud ‎Services:‏ ‎Cyber ‎actors‏ ‎have‏ ‎shifted ‎their‏ ‎focus ‎from ‎exploiting ‎on-premises ‎network‏ ‎vulnerabilities ‎to‏ ‎directly‏ ‎targeting ‎cloud ‎services.‏ ‎This ‎change‏ ‎is ‎a ‎response ‎to‏ ‎the‏ ‎modernization ‎of‏ ‎systems ‎and‏ ‎the ‎migration ‎of ‎organizational ‎infrastructure‏ ‎to‏ ‎the ‎cloud.

📌Authentication‏ ‎as ‎a‏ ‎Key ‎Step: ‎To ‎compromise ‎cloud-hosted‏ ‎networks,‏ ‎cyber‏ ‎actors ‎must‏ ‎first ‎successfully‏ ‎authenticate ‎with‏ ‎the‏ ‎cloud ‎provider.‏ ‎Preventing ‎this ‎initial ‎access ‎is‏ ‎crucial ‎for‏ ‎stopping‏ ‎from ‎compromising ‎the‏ ‎target.

📌Expansion ‎of‏ ‎Targeting: ‎Cyber ‎actors ‎have‏ ‎broadened‏ ‎their ‎targeting‏ ‎to ‎include‏ ‎sectors ‎such ‎as ‎aviation, ‎education,‏ ‎law‏ ‎enforcement, ‎local‏ ‎and ‎state‏ ‎councils, ‎government ‎financial ‎departments, ‎and‏ ‎military‏ ‎organizations.‏ ‎This ‎expansion‏ ‎indicates ‎a‏ ‎strategic ‎diversification‏ ‎of‏ ‎targets ‎for‏ ‎intelligence ‎gathering.

📌Use ‎of ‎Service ‎and‏ ‎Dormant ‎Accounts: it‏ ‎highlights‏ ‎that ‎cyber ‎actors‏ ‎have ‎been‏ ‎observed ‎using ‎brute ‎force‏ ‎attacks‏ ‎to ‎access‏ ‎service ‎and‏ ‎dormant ‎accounts ‎over ‎the ‎last‏ ‎12‏ ‎months. ‎This‏ ‎tactic ‎allows‏ ‎to ‎gain ‎initial ‎access ‎to‏ ‎cloud‏ ‎environments.

📌Sophistication‏ ‎of ‎cyber‏ ‎actors: ‎The‏ ‎cyber ‎actors‏ ‎can‏ ‎execute ‎global‏ ‎supply ‎chain ‎compromises, ‎such ‎as‏ ‎the ‎2020‏ ‎SolarWinds‏ ‎incident.

📌Defense ‎through ‎Cybersecurity‏ ‎Fundamentals: ‎The‏ ‎advisory ‎emphasizes ‎that ‎a‏ ‎strong‏ ‎baseline ‎of‏ ‎cybersecurity ‎fundamentals‏ ‎can ‎defend ‎against ‎cyber ‎actors.‏ ‎For‏ ‎organizations ‎that‏ ‎have ‎transitioned‏ ‎to ‎cloud ‎infrastructure, ‎protecting ‎against‏ ‎TTPs‏ ‎for‏ ‎initial ‎access‏ ‎is ‎presented‏ ‎as ‎a‏ ‎first‏ ‎line ‎of‏ ‎defense.

Читать: 2+ мин
logo Overkill Security

MASEPIE Malware. Because One Malware Isn't Enough

In ‎December‏ ‎2023, ‎APT28 ‎actors ‎developed ‎MASEPIE,‏ ‎a ‎small‏ ‎Python‏ ‎backdoor ‎capable ‎of‏ ‎executing ‎arbitrary‏ ‎commands ‎on ‎victim ‎machines.‏ ‎An‏ ‎FBI ‎investigation‏ ‎revealed ‎that‏ ‎on ‎more ‎than ‎one ‎occasion,‏ ‎APT28‏ ‎used ‎compromised‏ ‎Ubiquiti ‎EdgeRouters‏ ‎as ‎command-and-control ‎(C2) ‎infrastructure ‎for‏ ‎MASEPIE‏ ‎backdoors‏ ‎deployed ‎against‏ ‎targets.

Command-and-Control ‎Infrastructure

While‏ ‎APT28 ‎does‏ ‎not‏ ‎deploy ‎MASEPIE‏ ‎on ‎EdgeRouters ‎themselves, ‎the ‎compromised‏ ‎routers ‎have‏ ‎been‏ ‎used ‎as ‎C2‏ ‎infrastructure ‎to‏ ‎communicate ‎with ‎and ‎control‏ ‎MASEPIE‏ ‎backdoors ‎installed‏ ‎on ‎systems‏ ‎belonging ‎to ‎targeted ‎individuals ‎and‏ ‎organizations.

The‏ ‎data ‎sent‏ ‎to ‎and‏ ‎from ‎the ‎EdgeRouters ‎acting ‎as‏ ‎C2‏ ‎servers‏ ‎was ‎encrypted‏ ‎using ‎a‏ ‎randomly ‎generated‏ ‎16-character‏ ‎AES ‎key,‏ ‎making ‎it ‎more ‎difficult ‎to‏ ‎detect ‎and‏ ‎analyze‏ ‎the ‎malicious ‎traffic.

MASEPIE‏ ‎Backdoor ‎Functionality

MASEPIE‏ ‎is ‎a ‎Python-based ‎backdoor‏ ‎that‏ ‎allows ‎APT28‏ ‎actors ‎to‏ ‎execute ‎arbitrary ‎commands ‎on ‎the‏ ‎infected‏ ‎systems. ‎This‏ ‎backdoor ‎provides‏ ‎the ‎threat ‎actors ‎with ‎a‏ ‎persistent‏ ‎foothold‏ ‎and ‎remote‏ ‎control ‎capabilities,‏ ‎enabling ‎them‏ ‎to‏ ‎carry ‎out‏ ‎various ‎malicious ‎activities, ‎such ‎as:

Data‏ ‎exfiltration

📌 Lateral ‎movement‏ ‎within‏ ‎the ‎compromised ‎network

📌 Deployment‏ ‎of ‎additional‏ ‎malware ‎or ‎tools

📌 Execution ‎of‏ ‎reconnaissance‏ ‎and ‎intelligence-gathering‏ ‎commands

Mitigation ‎and‏ ‎Investigation

To ‎mitigate ‎the ‎risk ‎of‏ ‎MASEPIE‏ ‎backdoors ‎and‏ ‎the ‎use‏ ‎of ‎compromised ‎EdgeRouters ‎as ‎C2‏ ‎infrastructure,‏ ‎network‏ ‎defenders ‎and‏ ‎users ‎should‏ ‎take ‎the‏ ‎following‏ ‎steps:

📌 Implement ‎endpoint‏ ‎protection: ‎Deploy ‎advanced ‎endpoint ‎protection‏ ‎solutions ‎capable‏ ‎of‏ ‎detecting ‎and ‎preventing‏ ‎the ‎execution‏ ‎of ‎MASEPIE ‎and ‎other‏ ‎malicious‏ ‎Python ‎scripts‏ ‎or ‎backdoors.

📌 Monitor‏ ‎network ‎traffic: Closely ‎monitor ‎network ‎traffic‏ ‎for‏ ‎any ‎suspicious‏ ‎encrypted ‎communications‏ ‎or ‎connections ‎to ‎known ‎APT28‏ ‎infrastructure,‏ ‎including‏ ‎compromised ‎EdgeRouters.

📌 Analyze‏ ‎network ‎logs:‏ ‎Review ‎network‏ ‎logs‏ ‎for ‎any‏ ‎indications ‎of ‎encrypted ‎communications ‎or‏ ‎connections ‎to‏ ‎EdgeRouters‏ ‎that ‎may ‎be‏ ‎acting ‎as‏ ‎C2 ‎servers.

Читать: 1+ мин
logo Overkill Security

Proxy and Tunnel. Ubiquiti's Unofficial Features

APT28 ‎actors‏ ‎have ‎been ‎using ‎compromised ‎Ubiquiti‏ ‎EdgeRouters ‎to‏ ‎establish‏ ‎proxy ‎connections ‎and‏ ‎reverse ‎SSH‏ ‎tunnels ‎to ‎their ‎dedicated‏ ‎infrastructure.‏ ‎This ‎allows‏ ‎them ‎to‏ ‎maintain ‎persistent ‎access ‎and ‎control‏ ‎over‏ ‎the ‎compromised‏ ‎devices, ‎even‏ ‎after ‎password ‎changes ‎or ‎other‏ ‎mitigation‏ ‎attempts.

Reverse‏ ‎Proxy ‎Connections

APT28‏ ‎actors ‎have‏ ‎utilized ‎iptables‏ ‎rules‏ ‎on ‎EdgeRouters‏ ‎to ‎establish ‎reverse ‎proxy ‎connections‏ ‎to ‎their‏ ‎dedicated‏ ‎infrastructure. ‎Network ‎defenders‏ ‎and ‎users‏ ‎can ‎review ‎iptables ‎chains‏ ‎and‏ ‎Bash ‎histories‏ ‎on ‎EdgeRouters‏ ‎for ‎unusual ‎invocations, ‎such ‎as‏ ‎the‏ ‎following ‎example:

iptables‏ ‎-t ‎nat‏ ‎-I ‎PREROUTING ‎-d ‎<router ‎IP‏ ‎address>‏ ‎-p‏ ‎tcp ‎-m‏ ‎tcp ‎--dport‏ ‎4443 ‎-j‏ ‎DNAT‏ ‎-to-destination ‎<APT28‏ ‎dedicated ‎infrastructure>:10081

This ‎iptables ‎rule ‎redirects‏ ‎incoming ‎traffic‏ ‎on‏ ‎port ‎4443 ‎of‏ ‎the ‎EdgeRouter‏ ‎to ‎the ‎APT28 ‎dedicated‏ ‎infrastructure‏ ‎on ‎port‏ ‎10081, ‎effectively‏ ‎creating ‎a ‎reverse ‎proxy ‎connection.

Reverse‏ ‎SSH‏ ‎Tunnels

Additionally, ‎APT28‏ ‎actors ‎have‏ ‎uploaded ‎adversary ‎controlled ‎SSH ‎RSA‏ ‎keys‏ ‎to‏ ‎compromised ‎EdgeRouters‏ ‎to ‎establish‏ ‎reverse ‎SSH‏ ‎tunnels.‏ ‎These ‎tunnels‏ ‎allow ‎the ‎actors ‎to ‎access‏ ‎the ‎compromised‏ ‎devices,‏ ‎even ‎after ‎password‏ ‎changes ‎or‏ ‎other ‎mitigation ‎attempts.

Network ‎defenders‏ ‎and‏ ‎users ‎can‏ ‎review ‎the‏ ‎following ‎directories ‎on ‎EdgeRouters ‎for‏ ‎unknown‏ ‎RSA ‎keys:

/root/.ssh/

/home/<user>/.ssh/

The‏ ‎presence ‎of‏ ‎unknown ‎RSA ‎keys ‎in ‎these‏ ‎directories‏ ‎may‏ ‎indicate ‎that‏ ‎adversaries ‎have‏ ‎used ‎them‏ ‎to‏ ‎access ‎the‏ ‎EdgeRouters, ‎bypassing ‎password ‎authentication.

Furthermore, ‎network‏ ‎defenders ‎can‏ ‎query‏ ‎network ‎traffic ‎logs‏ ‎on ‎EdgeRouters‏ ‎to ‎identify ‎abnormal ‎SSH‏ ‎sessions.‏ ‎An ‎invocation‏ ‎of ‎a‏ ‎reverse ‎SSH ‎tunnel ‎used ‎by‏ ‎APT28‏ ‎actors ‎is‏ ‎provided ‎below:

ssh‏ ‎–i ‎<RSA ‎key> ‎-p ‎<port>‏ ‎root@<router‏ ‎IP‏ ‎address> ‎-R‏ ‎<router ‎IP‏ ‎address>:<port>

This ‎command‏ ‎establishes‏ ‎a ‎reverse‏ ‎SSH ‎tunnel ‎from ‎the ‎EdgeRouter‏ ‎to ‎the‏ ‎APT28‏ ‎infrastructure, ‎allowing ‎the‏ ‎actors ‎to‏ ‎maintain ‎remote ‎access ‎and‏ ‎control‏ ‎over ‎the‏ ‎compromised ‎device.

Читать: 2+ мин
logo Overkill Security

CVE-2023-23397. The Exploit That Keeps on Exploiting

APT28 ‎actors‏ ‎have ‎been ‎exploiting ‎CVE-2023-23397, ‎a‏ ‎critical ‎elevation‏ ‎of‏ ‎privilege ‎vulnerability ‎in‏ ‎Microsoft ‎Outlook‏ ‎on ‎Windows, ‎to ‎facilitate‏ ‎NTLMv2‏ ‎credential ‎leaks.‏ ‎This ‎vulnerability,‏ ‎which ‎was ‎a ‎zero-day ‎at‏ ‎the‏ ‎time ‎of‏ ‎its ‎initial‏ ‎exploitation ‎by ‎APT28 ‎in ‎early‏ ‎2022,‏ ‎allows‏ ‎Net-NTLMv2 ‎hashes‏ ‎to ‎be‏ ‎leaked ‎to‏ ‎actor-controlled‏ ‎infrastructure.

NTLMv2 ‎Credential‏ ‎Harvesting

To ‎exploit ‎CVE-2023-23397 ‎and ‎harvest‏ ‎NTLMv2 ‎credentials,‏ ‎APT28‏ ‎actors ‎have ‎been‏ ‎using ‎two‏ ‎publicly ‎available ‎tools:

📌 http://ntlmrelayx.py: This ‎tool‏ ‎is‏ ‎part ‎of‏ ‎the ‎Impacket‏ ‎suite, ‎a ‎collection ‎of ‎Python‏ ‎classes‏ ‎for ‎working‏ ‎with ‎network‏ ‎protocols. ‎APT28 ‎actors ‎have ‎used‏ ‎http://ntlmrelayx.py to‏ ‎execute‏ ‎NTLM ‎relay‏ ‎attacks ‎[T1557]‏ ‎and ‎facilitate‏ ‎the‏ ‎leakage ‎of‏ ‎NTLMv2 ‎credentials.

📌 Responder: ‎Responder ‎is ‎a‏ ‎tool ‎designed‏ ‎to‏ ‎capture ‎and ‎relay‏ ‎NTLMv2 ‎hashes‏ ‎by ‎setting ‎up ‎a‏ ‎rogue‏ ‎authentication ‎server‏ ‎[T1556]. ‎APT28‏ ‎actors ‎have ‎installed ‎Responder ‎on‏ ‎compromised‏ ‎Ubiquiti ‎EdgeRouters‏ ‎to ‎collect‏ ‎NTLMv2 ‎credentials ‎from ‎targeted ‎Outlook‏ ‎accounts.

The‏ ‎FBI‏ ‎has ‎collected‏ ‎evidence ‎of‏ ‎APT28's ‎CVE-2023-23397‏ ‎exploitation‏ ‎activity ‎on‏ ‎numerous ‎compromised ‎EdgeRouters.

Logging ‎and ‎Detection

📌 When‏ ‎using ‎the‏ ‎default‏ ‎configurations, ‎Responder ‎logs‏ ‎its ‎activity‏ ‎to ‎the ‎following ‎files:

📌 Responder-Session.log

📌 Responder.db

Network‏ ‎defenders‏ ‎and ‎users‏ ‎can ‎search‏ ‎for ‎these ‎log ‎files, ‎as‏ ‎well‏ ‎as ‎the‏ ‎presence ‎of‏ ‎http://ntlmrelayx.py and ‎Responder ‎tooling, ‎on ‎EdgeRouters‏ ‎to‏ ‎identify‏ ‎potential ‎APT28‏ ‎activity ‎related‏ ‎to ‎the‏ ‎exploitation‏ ‎of ‎CVE-2023-23397.

Mitigation‏ ‎and ‎Investigation

To ‎mitigate ‎the ‎risk‏ ‎of ‎CVE-2023-23397‏ ‎exploitation‏ ‎and ‎NTLMv2 ‎credential‏ ‎leaks, ‎network‏ ‎defenders ‎and ‎users ‎should‏ ‎take‏ ‎the ‎following‏ ‎steps:

📌 Apply ‎the‏ ‎Microsoft ‎patch: Microsoft ‎has ‎released ‎a‏ ‎patch‏ ‎to ‎address‏ ‎CVE-2023-23397. ‎Ensure‏ ‎that ‎all ‎Outlook ‎installations ‎are‏ ‎updated‏ ‎with‏ ‎the ‎latest‏ ‎security ‎updates.

📌 Scan‏ ‎for ‎compromised‏ ‎EdgeRouters:‏ ‎Use ‎the‏ ‎provided ‎information ‎to ‎scan ‎EdgeRouters‏ ‎for ‎the‏ ‎presence‏ ‎of ‎http://ntlmrelayx.py, Responder, ‎and‏ ‎their ‎associated‏ ‎log ‎files. ‎Identify ‎and‏ ‎isolate‏ ‎any ‎compromised‏ ‎routers ‎for‏ ‎further ‎investigation.

📌 Reset ‎compromised ‎credentials: ‎If‏ ‎NTLMv2‏ ‎credential ‎leaks‏ ‎are ‎detected,‏ ‎reset ‎the ‎affected ‎user ‎accounts‏ ‎and‏ ‎implement‏ ‎additional ‎security‏ ‎measures, ‎such‏ ‎as ‎multi-factor‏ ‎authentication.

📌 Implement‏ ‎recommended ‎mitigation:‏ ‎Follow ‎the ‎recommended ‎mitigation ‎for‏ ‎compromised ‎EdgeRouters‏ ‎,‏ ‎including ‎performing ‎a‏ ‎hardware ‎factory‏ ‎reset, ‎upgrading ‎to ‎the‏ ‎latest‏ ‎firmware ‎version,‏ ‎and ‎changing‏ ‎default ‎usernames ‎and ‎passwords.

Читать: 2+ мин
logo Overkill Security

Making Credential Theft Easier Since... Always

APT28 ‎actors‏ ‎have ‎been ‎hosting ‎custom ‎Python‏ ‎scripts ‎on‏ ‎compromised‏ ‎Ubiquiti ‎EdgeRouters ‎to‏ ‎collect ‎and‏ ‎validate ‎stolen ‎webmail ‎account‏ ‎credentials.‏ ‎These ‎scripts‏ ‎are ‎typically‏ ‎stored ‎alongside ‎related ‎log ‎files‏ ‎in‏ ‎the ‎home‏ ‎directory ‎of‏ ‎a ‎compromised ‎user, ‎such ‎as:

/home/<compromised‏ ‎user>/srv/http://core.py

/home/<compromised‏ ‎user>/srv/debug.txt

The‏ ‎FBI ‎claims‏ ‎that ‎they‏ ‎have ‎recovered‏ ‎verbose‏ ‎log ‎files‏ ‎containing ‎information ‎about ‎APT28 ‎activity‏ ‎on ‎the‏ ‎compromised‏ ‎EdgeRouters.


Custom ‎Python ‎Scripts

📌 The‏ ‎custom ‎Python‏ ‎scripts ‎hosted ‎on ‎the‏ ‎compromised‏ ‎EdgeRouters ‎serve‏ ‎the ‎purpose‏ ‎of ‎collecting ‎and ‎validating ‎stolen‏ ‎webmail‏ ‎account ‎credentials.‏ ‎APT28 ‎actors‏ ‎use ‎these ‎scripts ‎as ‎part‏ ‎of‏ ‎their‏ ‎credential ‎harvesting‏ ‎operations, ‎targeting‏ ‎specific ‎webmail‏ ‎users.

📌 The‏ ‎scripts ‎are‏ ‎designed ‎to ‎automatically ‎break ‎captcha‏ ‎problems ‎on‏ ‎webmail‏ ‎login ‎pages, ‎allowing‏ ‎the ‎actors‏ ‎to ‎bypass ‎this ‎security‏ ‎measure‏ ‎and ‎gain‏ ‎unauthorized ‎access‏ ‎to ‎the ‎targeted ‎accounts. ‎To‏ ‎achieve‏ ‎this, ‎the‏ ‎scripts ‎make‏ ‎connections ‎to ‎the ‎API ‎endpoint‏ ‎api[.]anti-captcha[.]com,‏ ‎which‏ ‎is ‎used‏ ‎by ‎APT28‏ ‎actors ‎for‏ ‎captcha-solving‏ ‎purposes.


Yara ‎Rule‏ ‎for ‎Detection

📌 To ‎help ‎network ‎defenders‏ ‎locate ‎credential‏ ‎collection‏ ‎scripts ‎on ‎compromised‏ ‎EdgeRouters, ‎the‏ ‎FBI ‎has ‎created ‎a‏ ‎Yara‏ ‎rule. ‎Yara‏ ‎is ‎a‏ ‎tool ‎used ‎to ‎identify ‎and‏ ‎classify‏ ‎malware ‎based‏ ‎on ‎textual‏ ‎or ‎binary ‎patterns. ‎The ‎FBI-provided‏ ‎Yara‏ ‎rule‏ ‎can ‎be‏ ‎used ‎to‏ ‎scan ‎the‏ ‎file‏ ‎system ‎of‏ ‎EdgeRouters ‎and ‎detect ‎the ‎presence‏ ‎of ‎the‏ ‎custom‏ ‎Python ‎scripts ‎used‏ ‎by ‎APT28‏ ‎actors.

📌 In ‎addition ‎to ‎using‏ ‎the‏ ‎Yara ‎rule,‏ ‎network ‎defenders‏ ‎can ‎also ‎query ‎network ‎traffic‏ ‎for‏ ‎connections ‎to‏ ‎the ‎api[.]anti-captcha[.]com‏ ‎endpoint. ‎Detecting ‎traffic ‎to ‎this‏ ‎API‏ ‎can‏ ‎help ‎identify‏ ‎compromised ‎EdgeRouters‏ ‎and ‎potential‏ ‎credential‏ ‎harvesting ‎activities.


Mitigation‏ ‎and ‎Investigation

📌 Upon ‎detecting ‎the ‎presence‏ ‎of ‎custom‏ ‎Python‏ ‎scripts ‎or ‎connections‏ ‎to ‎the‏ ‎api[.]anti-captcha[.]com ‎endpoint, ‎network ‎defenders‏ ‎should‏ ‎take ‎immediate‏ ‎action ‎to‏ ‎mitigate ‎the ‎risk ‎and ‎investigate‏ ‎the‏ ‎extent ‎of‏ ‎the ‎compromise:

📌 Isolating‏ ‎the ‎affected ‎EdgeRouters ‎from ‎the‏ ‎network

📌 Performing‏ ‎a‏ ‎thorough ‎analysis‏ ‎of ‎the‏ ‎scripts ‎and‏ ‎log‏ ‎files ‎to‏ ‎understand ‎the ‎scope ‎of ‎the‏ ‎credential ‎harvesting‏ ‎activities

📌 Resetting‏ ‎passwords ‎for ‎potentially‏ ‎compromised ‎webmail‏ ‎accounts

Читать: 2+ мин
logo Overkill Security

Moobot Trojan. When Ubiquiti Router Becomes a Botnet's Best Friend

APT28 ‎actors‏ ‎have ‎been ‎leveraging ‎default ‎credentials‏ ‎and ‎trojanized‏ ‎OpenSSH‏ ‎server ‎processes ‎to‏ ‎access ‎Ubiquiti‏ ‎EdgeRouters. ‎The ‎trojanized ‎OpenSSH‏ ‎server‏ ‎processes ‎are‏ ‎associated ‎with‏ ‎Moobot, ‎a ‎Mirai-based ‎botnet ‎that‏ ‎infects‏ ‎Internet ‎of‏ ‎Things ‎(IoT)‏ ‎devices ‎using ‎remotely ‎exploitable ‎vulnerabilities,‏ ‎such‏ ‎as‏ ‎weak ‎or‏ ‎default ‎passwords.

Trojanized‏ ‎OpenSSH ‎Server‏ ‎Binaries

📌 Trojanized‏ ‎OpenSSH ‎server‏ ‎binaries ‎downloaded ‎from ‎packinstall[.]kozow[.]com ‎have‏ ‎replaced ‎legitimate‏ ‎binaries‏ ‎on ‎EdgeRouters ‎accessed‏ ‎by ‎APT28.‏ ‎These ‎trojanized ‎binaries ‎allow‏ ‎remote‏ ‎attackers ‎to‏ ‎bypass ‎authentication‏ ‎and ‎gain ‎unauthorized ‎access ‎to‏ ‎the‏ ‎compromised ‎routers.

📌 The‏ ‎Moobot ‎botnet‏ ‎is ‎known ‎for ‎its ‎ability‏ ‎to‏ ‎exploit‏ ‎vulnerabilities ‎in‏ ‎IoT ‎devices,‏ ‎particularly ‎those‏ ‎with‏ ‎weak ‎or‏ ‎default ‎passwords. ‎By ‎replacing ‎the‏ ‎legitimate ‎OpenSSH‏ ‎server‏ ‎binaries ‎with ‎trojanized‏ ‎versions, ‎APT28‏ ‎actors ‎can ‎maintain ‎persistent‏ ‎access‏ ‎to ‎the‏ ‎compromised ‎EdgeRouters‏ ‎and ‎use ‎them ‎for ‎various‏ ‎malicious‏ ‎purposes.

Mirai-based ‎Botnet

📌 Moobot‏ ‎is ‎a‏ ‎Mirai-based ‎botnet, ‎which ‎means ‎it‏ ‎is‏ ‎derived‏ ‎from ‎the‏ ‎infamous ‎Mirai‏ ‎malware ‎that‏ ‎first‏ ‎emerged ‎in‏ ‎2016. ‎Mirai ‎is ‎designed ‎to‏ ‎scan ‎for‏ ‎and‏ ‎infect ‎IoT ‎devices‏ ‎by ‎exploiting‏ ‎common ‎vulnerabilities ‎and ‎using‏ ‎default‏ ‎credentials. ‎Once‏ ‎a ‎device‏ ‎is ‎infected, ‎it ‎becomes ‎part‏ ‎of‏ ‎the ‎botnet‏ ‎and ‎can‏ ‎be ‎used ‎for ‎distributed ‎denial-of-service‏ ‎(DDoS)‏ ‎attacks,‏ ‎credential ‎stuffing,‏ ‎and ‎other‏ ‎malicious ‎activities.

📌 The‏ ‎use‏ ‎of ‎a‏ ‎Mirai-based ‎botnet ‎like ‎Moobot ‎highlights‏ ‎the ‎importance‏ ‎of‏ ‎securing ‎IoT ‎devices,‏ ‎such ‎as‏ ‎routers, ‎by ‎changing ‎default‏ ‎passwords‏ ‎and ‎keeping‏ ‎the ‎firmware‏ ‎up ‎to ‎date. ‎The ‎combination‏ ‎of‏ ‎weak ‎or‏ ‎default ‎passwords‏ ‎and ‎unpatched ‎vulnerabilities ‎makes ‎these‏ ‎devices‏ ‎an‏ ‎attractive ‎target‏ ‎for ‎threat‏ ‎actors ‎like‏ ‎APT28.

Impact‏ ‎on ‎Compromised‏ ‎EdgeRouters

With ‎the ‎trojanized ‎OpenSSH ‎server‏ ‎processes ‎in‏ ‎place,‏ ‎APT28 ‎actors ‎can‏ ‎maintain ‎persistent‏ ‎access ‎to ‎the ‎compromised‏ ‎EdgeRouters.‏ ‎This ‎allows‏ ‎them ‎to‏ ‎use ‎the ‎routers ‎as ‎a‏ ‎platform‏ ‎for ‎various‏ ‎malicious ‎activities,‏ ‎such ‎as:

📌 Harvesting ‎credentials

📌 Collecting ‎NTLMv2 ‎digests

📌 Proxying‏ ‎network‏ ‎traffic

📌 Hosting‏ ‎spear-phishing ‎landing‏ ‎pages ‎and‏ ‎custom ‎tools

Читать: 2+ мин
logo Overkill Security

Threat Actors Love Ubiquiti. A Match Made in Cyber Heaven

Threat ‎Actor's‏ ‎operations ‎have ‎targeted ‎various ‎industries,‏ ‎including ‎Aerospace‏ ‎&‏ ‎Defense, ‎Education, ‎Energy‏ ‎& ‎Utilities,‏ ‎Governments, ‎Hospitality, ‎Manufacturing, ‎Oil‏ ‎&‏ ‎Gas, ‎Retail,‏ ‎Technology, ‎and‏ ‎Transportation. ‎The ‎targeted ‎countries ‎include‏ ‎the‏ ‎Czech ‎Republic,‏ ‎Italy, ‎Lithuania,‏ ‎Jordan, ‎Montenegro, ‎Poland, ‎Slovakia, ‎Turkey,‏ ‎Ukraine,‏ ‎United‏ ‎Arab ‎Emirates,‏ ‎and ‎the‏ ‎US, ‎with‏ ‎a‏ ‎strategic ‎focus‏ ‎on ‎individuals ‎in ‎Ukraine.

Potential ‎consequences‏ ‎and ‎impacts‏ ‎on‏ ‎these ‎affected ‎industries‏ ‎include:

📌 Data ‎breaches‏ ‎and ‎theft ‎of ‎sensitive‏ ‎information,‏ ‎intellectual ‎property,‏ ‎or ‎trade‏ ‎secrets.

📌 Disruption ‎of ‎critical ‎infrastructure ‎operations,‏ ‎such‏ ‎as ‎power‏ ‎grids, ‎transportation‏ ‎systems, ‎or ‎manufacturing ‎processes.

📌 Compromise ‎of‏ ‎government‏ ‎networks‏ ‎and ‎systems,‏ ‎potentially ‎leading‏ ‎to ‎espionage‏ ‎or‏ ‎national ‎security‏ ‎threats.

📌 Financial ‎losses ‎due ‎to ‎operational‏ ‎disruptions, ‎theft‏ ‎of‏ ‎customer ‎data, ‎or‏ ‎reputational ‎damage.

📌 Potential‏ ‎safety ‎risks ‎if ‎control‏ ‎systems‏ ‎or ‎operational‏ ‎technology ‎(OT)‏ ‎networks ‎are ‎compromised.

📌 Loss ‎of ‎customer‏ ‎trust‏ ‎and ‎confidence‏ ‎in ‎the‏ ‎affected ‎organizations.

MITRE ‎ATT&CK ‎TTPs

Resource ‎Development:

T1587‏ ‎(Develop‏ ‎Capabilities): APT28‏ ‎authored ‎custom‏ ‎Python ‎scripts‏ ‎to ‎collect‏ ‎webmail‏ ‎account ‎credentials.

T1588‏ ‎(Obtain ‎Capabilities): ‎APT28 ‎accessed ‎EdgeRouters‏ ‎compromised ‎by‏ ‎the‏ ‎Moobot ‎botnet, ‎which‏ ‎installs ‎OpenSSH‏ ‎trojans.

Initial ‎Access:

T1584 ‎(Compromise ‎Infrastructure): APT28‏ ‎accessed‏ ‎EdgeRouters ‎previously‏ ‎compromised ‎by‏ ‎an ‎OpenSSH ‎trojan.

📌 T1566 ‎(Phishing): ‎APT28‏ ‎conducted‏ ‎cross-site ‎scripting‏ ‎and ‎browser-in-the-browser‏ ‎spear-phishing ‎campaigns.

Execution:

T1203 ‎(Exploitation ‎for ‎Client‏ ‎Execution):‏ ‎APT28‏ ‎exploited ‎the‏ ‎CVE-2023-23397 ‎vulnerability.

Persistence:

📌 T1546‏ ‎(Event ‎Triggered‏ ‎Execution):‏ ‎The ‎compromised‏ ‎routers ‎housed ‎Bash ‎scripts ‎and‏ ‎ELF ‎binaries‏ ‎designed‏ ‎to ‎backdoor ‎OpenSSH‏ ‎daemons ‎and‏ ‎related ‎services.

Credential ‎Access:

📌 T1557 ‎(Adversary-in-the-Middle):‏ ‎APT28‏ ‎installed ‎tools‏ ‎like ‎Impacket‏ ‎http://ntlmrelayx.py and ‎Responder ‎on ‎compromised ‎routers‏ ‎to‏ ‎execute ‎NTLM‏ ‎relay ‎attacks.

📌 T1556‏ ‎(Modify ‎Authentication ‎Process): ‎APT28 ‎hosted‏ ‎NTLMv2‏ ‎rogue‏ ‎authentication ‎servers‏ ‎to ‎modify‏ ‎the ‎authentication‏ ‎process‏ ‎using ‎stolen‏ ‎credentials ‎from ‎NTLM ‎relay ‎attacks.

Collection:

📌 T1119‏ ‎(Automated ‎Collection): APT28‏ ‎utilized‏ ‎CVE-2023-23397 ‎to ‎automate‏ ‎the ‎collection‏ ‎of ‎NTLMv2 ‎hashes.

Exfiltration:

📌 T1020 ‎(Automated‏ ‎Exfiltration): APT28‏ ‎utilized ‎CVE-2023-23397‏ ‎to ‎automate‏ ‎the ‎exfiltration ‎of ‎data ‎to‏ ‎actor-controlled‏ ‎infrastructure.


Читать: 3+ мин
logo Overkill Security

Ubiquiti: Where Security is Optional and keypoint is «change your password, seriously!»

The ‎document‏ ‎titled ‎«Cyber ‎Actors ‎Use ‎Compromised‏ ‎Routers ‎to‏ ‎Facilitate‏ ‎Cyber ‎Operations» ‎released‏ ‎by ‎the‏ ‎Federal ‎Bureau ‎of ‎Investigation‏ ‎(FBI),‏ ‎National ‎Security‏ ‎Agency ‎(NSA),‏ ‎US ‎Cyber ‎Command, ‎and ‎international‏ ‎partners‏ ‎warns ‎of‏ ‎use ‎of‏ ‎compromised ‎Ubiquiti ‎EdgeRouters ‎to ‎facilitate‏ ‎malicious‏ ‎cyber‏ ‎operations ‎worldwide.

The‏ ‎popularity ‎of‏ ‎Ubiquiti ‎EdgeRouters‏ ‎is‏ ‎attributed ‎to‏ ‎their ‎user-friendly, ‎Linux-based ‎operating ‎system,‏ ‎default ‎credentials,‏ ‎and‏ ‎limited ‎firewall ‎protections.‏ ‎The ‎routers‏ ‎are ‎often ‎shipped ‎with‏ ‎insecure‏ ‎default ‎configurations‏ ‎and ‎do‏ ‎not ‎automatically ‎update ‎firmware ‎unless‏ ‎configured‏ ‎by ‎the‏ ‎user.

The ‎compromised‏ ‎EdgeRouters ‎have ‎been ‎used ‎by‏ ‎APT28‏ ‎to‏ ‎harvest ‎credentials,‏ ‎collect ‎NTLMv2‏ ‎digests, ‎proxy‏ ‎network‏ ‎traffic, ‎and‏ ‎host ‎spear-phishing ‎landing ‎pages ‎and‏ ‎custom ‎tools.‏ ‎APT28‏ ‎accessed ‎the ‎routers‏ ‎using ‎default‏ ‎credentials ‎and ‎trojanized ‎OpenSSH‏ ‎server‏ ‎processes. ‎With‏ ‎root ‎access‏ ‎to ‎the ‎compromised ‎routers, ‎the‏ ‎actors‏ ‎had ‎unfettered‏ ‎access ‎to‏ ‎the ‎Linux-based ‎operating ‎systems ‎to‏ ‎install‏ ‎tooling‏ ‎and ‎obfuscate‏ ‎their ‎identity.

APT28‏ ‎also ‎deployed‏ ‎custom‏ ‎Python ‎scripts‏ ‎on ‎the ‎compromised ‎routers ‎to‏ ‎collect ‎and‏ ‎validate‏ ‎stolen ‎webmail ‎account‏ ‎credentials ‎obtained‏ ‎through ‎cross-site ‎scripting ‎and‏ ‎browser-in-the-browser‏ ‎spear-phishing ‎campaigns.‏ ‎Additionally, ‎they‏ ‎exploited ‎a ‎critical ‎zero-day ‎elevation-of-privilege‏ ‎vulnerability‏ ‎in ‎Microsoft‏ ‎Outlook ‎(CVE-2023-23397)‏ ‎to ‎collect ‎NTLMv2 ‎digests ‎from‏ ‎targeted‏ ‎Outlook‏ ‎accounts ‎and‏ ‎used ‎publicly‏ ‎available ‎tools‏ ‎to‏ ‎assist ‎with‏ ‎NTLM ‎relay ‎attacks

Keypoints ‎and ‎takeaways

📌 APT28‏ ‎(also ‎known‏ ‎as‏ ‎Fancy ‎Bear, ‎Forest‏ ‎Blizzard, ‎and‏ ‎Strontium) ‎have ‎been ‎exploiting‏ ‎compromised‏ ‎Ubiquiti ‎EdgeRouters‏ ‎to ‎conduct‏ ‎malicious ‎cyber ‎ops ‎globally.

📌 The ‎exploitation‏ ‎includes‏ ‎harvesting ‎credentials,‏ ‎collecting ‎NTLMv2‏ ‎digests, ‎proxying ‎network ‎traffic, ‎and‏ ‎hosting‏ ‎spear-phishing‏ ‎landing ‎pages‏ ‎and ‎custom‏ ‎tools.

📌 The ‎FBI,‏ ‎NSA,‏ ‎US ‎Cyber‏ ‎Command, ‎and ‎international ‎partners ‎have‏ ‎issued ‎a‏ ‎joint‏ ‎Cybersecurity ‎Advisory ‎(CSA)‏ ‎detailing ‎the‏ ‎threat ‎and ‎providing ‎mitigation‏ ‎recommendations.

📌 The‏ ‎advisory ‎includes‏ ‎observed ‎tactics,‏ ‎techniques, ‎and ‎procedures ‎(TTPs), ‎indicators‏ ‎of‏ ‎compromise ‎(IOCs),‏ ‎and ‎maps‏ ‎the ‎threat ‎actors' ‎activity ‎to‏ ‎the‏ ‎MITRE‏ ‎ATT& ‎CK‏ ‎framework.

📌 The ‎advisory‏ ‎urges ‎immediate‏ ‎action‏ ‎to ‎mitigate‏ ‎the ‎threat, ‎including ‎performing ‎hardware‏ ‎factory ‎resets,‏ ‎updating‏ ‎firmware, ‎changing ‎default‏ ‎credentials, ‎and‏ ‎implementing ‎strategic ‎firewall ‎rules.

📌 APT28‏ ‎has‏ ‎used ‎compromised‏ ‎EdgeRouters ‎since‏ ‎at ‎least ‎2022 ‎to ‎facilitate‏ ‎covert‏ ‎operations ‎against‏ ‎various ‎industries‏ ‎and ‎countries, ‎including ‎the ‎US.

📌 The‏ ‎EdgeRouters‏ ‎are‏ ‎popular ‎due‏ ‎to ‎their‏ ‎user-friendly ‎Linux-based‏ ‎operating‏ ‎system ‎but‏ ‎are ‎often ‎shipped ‎with ‎default‏ ‎credentials ‎and‏ ‎limited‏ ‎firewall ‎protections.

📌 The ‎advisory‏ ‎provides ‎detailed‏ ‎TTPs ‎and ‎IOCs ‎to‏ ‎help‏ ‎network ‎defenders‏ ‎identify ‎and‏ ‎mitigate ‎the ‎threat.

📌 The ‎advisory ‎also‏ ‎includes‏ ‎information ‎on‏ ‎how ‎to‏ ‎map ‎malicious ‎cyber ‎activity ‎to‏ ‎the‏ ‎MITRE‏ ‎ATT& ‎CK‏ ‎framework.

📌 Organizations ‎using‏ ‎Ubiquiti ‎EdgeRouters‏ ‎must‏ ‎take ‎immediate‏ ‎action ‎to ‎secure ‎their ‎devices‏ ‎against ‎APT28‏ ‎exploitation.

📌 The‏ ‎recommended ‎actions ‎include‏ ‎resetting ‎hardware‏ ‎to ‎factory ‎settings, ‎updating‏ ‎to‏ ‎the ‎latest‏ ‎firmware, ‎changing‏ ‎default ‎usernames ‎and ‎passwords, ‎and‏ ‎implementing‏ ‎strategic ‎firewall‏ ‎rules.

📌 Network ‎defenders‏ ‎should ‎be ‎aware ‎of ‎the‏ ‎TTPs‏ ‎and‏ ‎IOCs ‎provided‏ ‎in ‎the‏ ‎advisory ‎to‏ ‎detect‏ ‎and ‎respond‏ ‎to ‎potential ‎compromises.

Читать: 2+ мин
logo Overkill Security

The Fallout: Consequences of Ignoring SOHO Router Security

📌 Widespread ‎Vulnerabilities:‏ ‎A ‎significant ‎number ‎of ‎vulnerabilities,‏ ‎some ‎226‏ ‎in‏ ‎total, ‎collectively ‎pose‏ ‎a ‎substantial‏ ‎security ‎risk.

📌 Outdated ‎Components: Core ‎components‏ ‎such‏ ‎as ‎the‏ ‎Linux ‎kernel‏ ‎and ‎additional ‎services ‎like ‎VPN‏ ‎or‏ ‎multimedia ‎software‏ ‎in ‎these‏ ‎routers ‎are ‎often ‎outdated, ‎making‏ ‎them‏ ‎susceptible‏ ‎to ‎known‏ ‎exploits.

📌 Default ‎Passwords‏ ‎and ‎Unencrypted‏ ‎Connections: Many‏ ‎routers ‎come‏ ‎with ‎easy-to-guess ‎default ‎passwords ‎and‏ ‎use ‎unencrypted‏ ‎connections,‏ ‎which ‎can ‎be‏ ‎easily ‎exploited‏ ‎by ‎attackers.

📌 Compromised ‎Devices ‎and‏ ‎Data: Once‏ ‎a ‎router‏ ‎is ‎compromised,‏ ‎all ‎devices ‎protected ‎by ‎its‏ ‎firewall‏ ‎become ‎vulnerable,‏ ‎allowing ‎attackers‏ ‎to ‎monitor, ‎redirect, ‎block, ‎or‏ ‎tamper‏ ‎with‏ ‎data.

📌 Risk ‎to‏ ‎Critical ‎Infrastructure: Compromised‏ ‎routers ‎can‏ ‎be‏ ‎used ‎to‏ ‎attack ‎critical ‎infrastructure, ‎potentially ‎disrupting‏ ‎essential ‎services‏ ‎in‏ ‎communications, ‎energy, ‎transportation,‏ ‎and ‎water‏ ‎sectors.

📌 DoS ‎and ‎Traffic ‎Interception: Vulnerabilities‏ ‎in‏ ‎protocols ‎can‏ ‎lead ‎to‏ ‎denial-of-service ‎attacks ‎against ‎host ‎services‏ ‎and‏ ‎interception ‎of‏ ‎both ‎internal‏ ‎and ‎external ‎traffic.

📌 Eavesdropping ‎and ‎attacks:‏ ‎Attackers‏ ‎can‏ ‎eavesdrop ‎on‏ ‎traffic ‎and‏ ‎launch ‎further‏ ‎network-based‏ ‎attacks, ‎making‏ ‎it ‎difficult ‎for ‎users ‎to‏ ‎detect ‎a‏ ‎breach‏ ‎due ‎to ‎minimal‏ ‎router ‎user‏ ‎interfaces.

📌 Potential ‎for ‎Large-Scale ‎Exploitation: The‏ ‎sheer‏ ‎number ‎of‏ ‎vulnerable ‎devices,‏ ‎estimated ‎in ‎the ‎millions, ‎indicates‏ ‎a‏ ‎significant ‎potential‏ ‎for ‎widespread‏ ‎exploitation ‎by ‎malicious ‎actors.

📌 Legal ‎and‏ ‎Technical‏ ‎Challenges: Identifying‏ ‎specific ‎vulnerable‏ ‎devices ‎is‏ ‎complex ‎due‏ ‎to‏ ‎legal ‎and‏ ‎technical ‎issues, ‎which ‎complicates ‎the‏ ‎process ‎of‏ ‎mitigating‏ ‎these ‎vulnerabilities.

Challenges ‎and‏ ‎Considerations

📌 Balancing ‎Security‏ ‎and ‎Usability: One ‎of ‎the‏ ‎challenges‏ ‎is ‎maintaining‏ ‎user-friendliness. ‎Security‏ ‎measures ‎should ‎not ‎overly ‎complicate‏ ‎the‏ ‎user ‎experience.

📌 Cost‏ ‎Implications: Developing ‎secure‏ ‎products ‎can ‎incur ‎additional ‎costs.‏ ‎However,‏ ‎the‏ ‎long-term ‎benefits‏ ‎of ‎reducing‏ ‎the ‎risk‏ ‎of‏ ‎breaches ‎and‏ ‎attacks ‎justify ‎these ‎investments.

📌 Continuous ‎Evolution: Security‏ ‎is ‎not‏ ‎a‏ ‎one-time ‎effort ‎but‏ ‎requires ‎ongoing‏ ‎attention ‎to ‎adapt ‎to‏ ‎new‏ ‎threats ‎and‏ ‎vulnerabilities.

📌 Building ‎Trust: By‏ ‎prioritizing ‎security, ‎manufacturers ‎can ‎build‏ ‎trust‏ ‎with ‎customers,‏ ‎differentiating ‎their‏ ‎products ‎in ‎a ‎competitive ‎market.

📌 Engaging‏ ‎with‏ ‎Customers: Actively‏ ‎engaging ‎with‏ ‎customers ‎to‏ ‎understand ‎their‏ ‎security‏ ‎concerns ‎and‏ ‎providing ‎clear, ‎accessible ‎information ‎on‏ ‎how ‎to‏ ‎secure‏ ‎their ‎devices.

📌 Global ‎Supply‏ ‎Chain: routers ‎are‏ ‎often ‎produced ‎as ‎part‏ ‎of‏ ‎a ‎complex‏ ‎global ‎supply‏ ‎chain. ‎Ensuring ‎security ‎across ‎this‏ ‎chain,‏ ‎from ‎component‏ ‎manufacturers ‎to‏ ‎final ‎assembly, ‎requires ‎coordination ‎and‏ ‎adherence‏ ‎to‏ ‎security ‎best‏ ‎practices ‎at‏ ‎every ‎stage.

📌 Industry‏ ‎Collaboration: Working‏ ‎with ‎industry‏ ‎peers, ‎security ‎organizations, ‎and ‎regulatory‏ ‎bodies ‎to‏ ‎establish‏ ‎and ‎adhere ‎to‏ ‎security ‎best‏ ‎practices.

Читать: 9+ мин
logo Overkill Security

SOHO Meets New Best Friends: Malicious Cyber Actors

📌 Exploitation ‎by‏ ‎State-Sponsored ‎Groups: The ‎People’s ‎Republic ‎of‏ ‎China ‎(PRC)-sponsored‏ ‎Volt‏ ‎Typhoon ‎group ‎is‏ ‎actively ‎compromising‏ ‎SOHO ‎routers ‎by ‎exploiting‏ ‎software‏ ‎defects. ‎These‏ ‎compromised ‎routers‏ ‎are ‎then ‎used ‎as ‎launching‏ ‎pads‏ ‎to ‎further‏ ‎compromise ‎U.S.‏ ‎critical ‎infrastructure ‎entities.

📌 Impact ‎on ‎Critical‏ ‎Infrastructure:‏ ‎Compromised‏ ‎SOHO ‎routers‏ ‎pose ‎a‏ ‎significant ‎threat‏ ‎as‏ ‎they ‎can‏ ‎be ‎used ‎to ‎move ‎laterally‏ ‎within ‎networks‏ ‎and‏ ‎further ‎compromise ‎critical‏ ‎infrastructure ‎sectors‏ ‎in ‎the ‎U.S., ‎including‏ ‎communications,‏ ‎energy, ‎transportation,‏ ‎and ‎water‏ ‎sectors.

📌 ZuoRAT ‎Campaign: ‎A ‎sophisticated ‎campaign‏ ‎leveraging‏ ‎infected ‎SOHO‏ ‎routers, ‎dubbed‏ ‎ZuoRAT, ‎has ‎been ‎identified. ‎This‏ ‎campaign‏ ‎involves‏ ‎a ‎multistage‏ ‎remote ‎access‏ ‎trojan ‎(RAT)‏ ‎developed‏ ‎for ‎SOHO‏ ‎devices, ‎enabling ‎attackers ‎to ‎maintain‏ ‎a ‎low-detection‏ ‎presence‏ ‎on ‎target ‎networks‏ ‎and ‎exploit‏ ‎sensitive ‎information.

📌 FBI’s ‎Response ‎to‏ ‎Chinese‏ ‎Malware: ‎The‏ ‎FBI ‎has‏ ‎taken ‎proactive ‎measures ‎to ‎disrupt‏ ‎the‏ ‎activities ‎of‏ ‎Chinese ‎hackers,‏ ‎specifically ‎targeting ‎SOHO ‎routers ‎infected‏ ‎with‏ ‎the‏ ‎KV ‎Botnet‏ ‎malware. ‎This‏ ‎involved ‎issuing‏ ‎covert‏ ‎commands ‎to‏ ‎infected ‎devices ‎to ‎remove ‎the‏ ‎malware ‎and‏ ‎prevent‏ ‎further ‎access ‎by‏ ‎the ‎hackers,‏ ‎highlighting ‎the ‎ongoing ‎efforts‏ ‎to‏ ‎counteract ‎the‏ ‎threats ‎posed‏ ‎by ‎compromised ‎SOHO ‎routers.

Tactics ‎and‏ ‎Techniques

📌 KV‏ ‎Botnet ‎Malware:‏ ‎Volt ‎Typhoon‏ ‎actors ‎have ‎implanted ‎KV ‎Botnet‏ ‎malware‏ ‎into‏ ‎end-of-life ‎Cisco‏ ‎and ‎NETGEAR‏ ‎SOHO ‎routers,‏ ‎which‏ ‎are ‎no‏ ‎longer ‎supported ‎with ‎security ‎patches‏ ‎or ‎software‏ ‎updates.

📌 Concealment‏ ‎of ‎Origin: ‎By‏ ‎routing ‎their‏ ‎malicious ‎activities ‎through ‎SOHO‏ ‎routers,‏ ‎these ‎actors‏ ‎can ‎conceal‏ ‎the ‎PRC ‎origin ‎of ‎their‏ ‎hacking‏ ‎activities, ‎making‏ ‎it ‎more‏ ‎challenging ‎to ‎detect ‎and ‎attribute‏ ‎the‏ ‎attacks.

📌 Targeting‏ ‎Personal ‎Emails:‏ ‎Volt ‎Typhoon‏ ‎actors ‎have‏ ‎been‏ ‎observed ‎targeting‏ ‎the ‎personal ‎emails ‎of ‎key‏ ‎network ‎and‏ ‎IT‏ ‎staff ‎to ‎gain‏ ‎initial ‎access‏ ‎to ‎networks.

📌 Use ‎of ‎Multi-Hop‏ ‎Proxies:‏ ‎For ‎command‏ ‎and ‎control‏ ‎(C2) ‎infrastructure, ‎the ‎actors ‎use‏ ‎multi-hop‏ ‎proxies ‎typically‏ ‎composed ‎of‏ ‎virtual ‎private ‎servers ‎(VPSs) ‎or‏ ‎SOHO‏ ‎routers.

📌 Living‏ ‎Off ‎the‏ ‎Land ‎(LOTL)‏ ‎Techniques: ‎Instead‏ ‎of‏ ‎relying ‎on‏ ‎malware ‎for ‎post-compromise ‎execution, ‎Volt‏ ‎Typhoon ‎actors‏ ‎use‏ ‎hands-on-keyboard ‎activity ‎via‏ ‎command-line ‎and‏ ‎other ‎native ‎tools ‎and‏ ‎processes‏ ‎on ‎systems,‏ ‎a ‎strategy‏ ‎known ‎as ‎LOTL, ‎to ‎maintain‏ ‎and‏ ‎expand ‎access‏ ‎to ‎victim‏ ‎networks.

📌 Man-in-the-Middle ‎Attacks: ‎Attackers ‎can ‎exploit‏ ‎vulnerabilities‏ ‎in‏ ‎routers ‎to‏ ‎intercept ‎and‏ ‎manipulate ‎data‏ ‎passing‏ ‎through ‎the‏ ‎network, ‎leading ‎to ‎data ‎breaches,‏ ‎identity ‎theft,‏ ‎and‏ ‎espionage.

📌 Gateway ‎to ‎Further‏ ‎Exploitation: ‎Once‏ ‎compromised, ‎a ‎router ‎can‏ ‎serve‏ ‎as ‎a‏ ‎gateway ‎for‏ ‎attackers ‎to ‎launch ‎further ‎attacks‏ ‎on‏ ‎connected ‎devices,‏ ‎including ‎computers,‏ ‎smartphones, ‎and ‎smart ‎home ‎devices.

📌 Botnet‏ ‎Recruitment:‏ ‎Insecure‏ ‎routers ‎can‏ ‎be ‎easily‏ ‎compromised ‎and‏ ‎recruited‏ ‎into ‎botnets,‏ ‎large ‎networks ‎of ‎infected ‎devices‏ ‎used ‎to‏ ‎launch‏ ‎distributed ‎denial-of-service ‎(DDoS)‏ ‎attacks, ‎spam‏ ‎campaigns, ‎and ‎other ‎malicious‏ ‎activities.

Impact‏ ‎and ‎Response

📌 Public-Private‏ ‎Partnerships: ‎The‏ ‎response ‎to ‎the ‎Volt ‎Typhoon‏ ‎compromises‏ ‎involved ‎close‏ ‎collaboration ‎between‏ ‎government ‎agencies, ‎including ‎the ‎FBI‏ ‎and‏ ‎CISA,‏ ‎and ‎private‏ ‎sector ‎entities.‏ ‎This ‎partnership‏ ‎facilitated‏ ‎the ‎sharing‏ ‎of ‎threat ‎intelligence, ‎technical ‎indicators‏ ‎of ‎compromise‏ ‎(IoCs),‏ ‎and ‎best ‎practices‏ ‎for ‎mitigation.

📌 Firmware‏ ‎Analysis ‎and ‎Patching: Manufacturers ‎of‏ ‎affected‏ ‎SOHO ‎routers‏ ‎were ‎alerted‏ ‎to ‎the ‎vulnerabilities ‎being ‎exploited‏ ‎by‏ ‎Volt ‎Typhoon‏ ‎actors. ‎Efforts‏ ‎were ‎made ‎to ‎analyze ‎the‏ ‎malicious‏ ‎firmware,‏ ‎understand ‎the‏ ‎exploitation ‎techniques,‏ ‎and ‎develop‏ ‎patches‏ ‎to ‎address‏ ‎the ‎vulnerabilities.

📌 Disruption ‎Operations: ‎Law ‎enforcement‏ ‎and ‎cybersecurity‏ ‎agencies‏ ‎undertook ‎operations ‎to‏ ‎disrupt ‎the‏ ‎Volt ‎Typhoon ‎campaign. ‎This‏ ‎included‏ ‎identifying ‎and‏ ‎taking ‎down‏ ‎C2 ‎servers, ‎removing ‎malicious ‎firmware‏ ‎from‏ ‎compromised ‎routers,‏ ‎and ‎blocking‏ ‎traffic ‎to ‎known ‎malicious ‎IP‏ ‎addresses.

📌 Global‏ ‎Notification‏ ‎and ‎Mitigation‏ ‎Campaign: A ‎global‏ ‎campaign ‎was‏ ‎launched‏ ‎to ‎notify‏ ‎owners ‎of ‎compromised ‎SOHO ‎routers‏ ‎and ‎provide‏ ‎them‏ ‎with ‎guidance ‎on‏ ‎mitigating ‎the‏ ‎threat. ‎This ‎included ‎instructions‏ ‎for‏ ‎resetting ‎devices‏ ‎to ‎factory‏ ‎settings, ‎updating ‎firmware, ‎and ‎changing‏ ‎default‏ ‎passwords.

📌 Disruption ‎of‏ ‎Critical ‎Infrastructure: The‏ ‎exploitation ‎of ‎these ‎routers ‎poses‏ ‎a‏ ‎significant‏ ‎threat ‎as‏ ‎it ‎could‏ ‎potentially ‎disrupt‏ ‎essential‏ ‎services ‎provided‏ ‎by ‎critical ‎infrastructure ‎sectors.

📌 Federal ‎Response: The‏ ‎FBI ‎and‏ ‎the‏ ‎Justice ‎Department ‎have‏ ‎conducted ‎operations‏ ‎to ‎disrupt ‎the ‎KV‏ ‎Botnet‏ ‎by ‎remotely‏ ‎deleting ‎the‏ ‎malware ‎from ‎infected ‎routers ‎and‏ ‎taking‏ ‎steps ‎to‏ ‎sever ‎their‏ ‎connection ‎to ‎the ‎botnet.

📌 Mitigation ‎Efforts:‏ ‎The‏ ‎FBI‏ ‎has ‎been‏ ‎notifying ‎owners‏ ‎or ‎operators‏ ‎of‏ ‎SOHO ‎routers‏ ‎that ‎were ‎accessed ‎during ‎the‏ ‎takedown ‎operation.‏ ‎The‏ ‎mitigation ‎steps ‎authorized‏ ‎by ‎the‏ ‎court ‎are ‎temporary, ‎and‏ ‎a‏ ‎router ‎restart‏ ‎without ‎proper‏ ‎mitigation ‎will ‎leave ‎the ‎device‏ ‎vulnerable‏ ‎to ‎reinfection.

📌 Secure‏ ‎by ‎Design: CISA‏ ‎and ‎the ‎FBI ‎urge ‎SOHO‏ ‎router‏ ‎manufacturers‏ ‎to ‎build‏ ‎security ‎into‏ ‎the ‎design,‏ ‎development,‏ ‎and ‎maintenance‏ ‎of ‎SOHO ‎routers ‎to ‎eliminate‏ ‎the ‎paths‏ ‎these‏ ‎threat ‎actors ‎take‏ ‎to ‎compromise‏ ‎devices ‎and ‎critical ‎infrastructure‏ ‎entities.

📌 Transparency‏ ‎and ‎Disclosure:‏ ‎Manufacturers ‎are‏ ‎encouraged ‎to ‎protect ‎against ‎Volt‏ ‎Typhoon‏ ‎activity ‎and‏ ‎other ‎cyber‏ ‎threats ‎by ‎disclosing ‎vulnerabilities ‎through‏ ‎the‏ ‎CVE‏ ‎program ‎and‏ ‎accurately ‎classifying‏ ‎them ‎using‏ ‎the‏ ‎CWE ‎system.

📌 User‏ ‎Vigilance: ‎Device ‎operators ‎are ‎advised‏ ‎to ‎update‏ ‎software,‏ ‎harden ‎configurations, ‎and‏ ‎add ‎security‏ ‎solutions ‎where ‎necessary ‎to‏ ‎combat‏ ‎threats

Public ‎and‏ ‎Customer ‎Demand‏ ‎for ‎Security

In ‎today’s ‎digital ‎age,‏ ‎the‏ ‎security ‎of‏ ‎network ‎devices‏ ‎has ‎become ‎a ‎paramount ‎concern‏ ‎for‏ ‎both‏ ‎the ‎public‏ ‎and ‎businesses‏ ‎alike. ‎This‏ ‎heightened‏ ‎awareness ‎stems‏ ‎from ‎an ‎increasing ‎number ‎of‏ ‎high-profile ‎cyberattacks‏ ‎and‏ ‎data ‎breaches, ‎which‏ ‎have ‎underscored‏ ‎the ‎vulnerabilities ‎inherent ‎in‏ ‎connected‏ ‎devices. ‎As‏ ‎a ‎result,‏ ‎there ‎is ‎a ‎growing ‎demand‏ ‎from‏ ‎customers ‎and‏ ‎the ‎public‏ ‎for ‎manufacturers ‎to ‎prioritize ‎security‏ ‎in‏ ‎their‏ ‎products.

Factors ‎Driving‏ ‎Demand

📌 Increased ‎Awareness‏ ‎of ‎Cyber‏ ‎Threats:‏ ‎The ‎general‏ ‎public ‎and ‎businesses ‎are ‎becoming‏ ‎more ‎aware‏ ‎of‏ ‎the ‎risks ‎associated‏ ‎with ‎cyber‏ ‎threats, ‎including ‎the ‎potential‏ ‎for‏ ‎financial ‎loss,‏ ‎privacy ‎breaches,‏ ‎and ‎disruption ‎of ‎services.

📌 Regulatory ‎Pressure: Governments‏ ‎and‏ ‎regulatory ‎bodies‏ ‎worldwide ‎are‏ ‎implementing ‎stricter ‎regulations ‎and ‎standards‏ ‎for‏ ‎cybersecurity,‏ ‎compelling ‎manufacturers‏ ‎to ‎enhance‏ ‎the ‎security‏ ‎features‏ ‎of ‎their‏ ‎products.

📌 Economic ‎Impact ‎of ‎Cyberattacks: ‎The‏ ‎economic ‎repercussions‏ ‎of‏ ‎cyberattacks, ‎including ‎the‏ ‎cost ‎of‏ ‎recovery ‎and ‎the ‎impact‏ ‎on‏ ‎brand ‎reputation,‏ ‎have ‎made‏ ‎security ‎a ‎critical ‎consideration ‎for‏ ‎customers‏ ‎when ‎selecting‏ ‎products.

📌 Interconnectedness ‎of‏ ‎Devices: ‎The ‎proliferation ‎of ‎IoT‏ ‎devices‏ ‎and‏ ‎the ‎interconnectedness‏ ‎of ‎digital‏ ‎ecosystems ‎have‏ ‎amplified‏ ‎the ‎potential‏ ‎impact ‎of ‎compromised ‎devices, ‎making‏ ‎security ‎a‏ ‎top‏ ‎priority ‎for ‎ensuring‏ ‎the ‎integrity‏ ‎of ‎personal ‎and ‎corporate‏ ‎data.

Customer‏ ‎Expectations

📌 Built-in ‎Security‏ ‎Features: Customers ‎now‏ ‎expect ‎devices ‎to ‎come ‎with‏ ‎robust,‏ ‎built-in ‎security‏ ‎features ‎that‏ ‎protect ‎against ‎a ‎wide ‎range‏ ‎of‏ ‎threats‏ ‎without ‎requiring‏ ‎extensive ‎technical‏ ‎knowledge ‎to‏ ‎configure.

📌 Regular‏ ‎Security ‎Updates: There‏ ‎is ‎an ‎expectation ‎for ‎manufacturers‏ ‎to ‎provide‏ ‎regular‏ ‎and ‎timely ‎security‏ ‎updates ‎to‏ ‎address ‎new ‎vulnerabilities ‎as‏ ‎they‏ ‎are ‎discovered.

📌 Transparency:‏ ‎Customers ‎demand‏ ‎transparency ‎from ‎manufacturers ‎regarding ‎the‏ ‎security‏ ‎of ‎their‏ ‎products, ‎including‏ ‎clear ‎information ‎about ‎known ‎vulnerabilities‏ ‎and‏ ‎the‏ ‎steps ‎being‏ ‎taken ‎to‏ ‎address ‎them.

Manufacturer‏ ‎Responsibility‏ ‎of ‎Implementing‏ ‎Secure ‎by ‎Design ‎in ‎SOHO‏ ‎Routers

📌 Automatic ‎Updates: Implementing‏ ‎mechanisms‏ ‎for ‎automatic ‎firmware‏ ‎updates ‎to‏ ‎ensure ‎that ‎routers ‎are‏ ‎always‏ ‎running ‎the‏ ‎latest ‎version‏ ‎with ‎the ‎most ‎recent ‎security‏ ‎patches.‏ ‎This ‎reduces‏ ‎the ‎reliance‏ ‎on ‎users ‎to ‎manually ‎update‏ ‎their‏ ‎devices.

📌 Digital‏ ‎Signing: Ensuring ‎that‏ ‎updates ‎are‏ ‎digitally ‎signed‏ ‎to‏ ‎verify ‎their‏ ‎authenticity ‎and ‎integrity. ‎This ‎prevents‏ ‎the ‎installation‏ ‎of‏ ‎malicious ‎firmware ‎updates‏ ‎that ‎could‏ ‎compromise ‎the ‎router.

📌 Secure ‎Web‏ ‎Management‏ ‎Interface: ‎Placing‏ ‎the ‎web‏ ‎management ‎interface ‎on ‎LAN-side ‎ports‏ ‎and‏ ‎improving ‎its‏ ‎security ‎to‏ ‎allow ‎safe ‎usage ‎when ‎exposed‏ ‎to‏ ‎the‏ ‎public ‎internet.

📌 Secure‏ ‎Defaults: ‎Shipping‏ ‎routers ‎with‏ ‎secure‏ ‎configurations ‎by‏ ‎default, ‎such ‎as ‎strong, ‎unique‏ ‎passwords, ‎and‏ ‎disabled‏ ‎unnecessary ‎services ‎while‏ ‎users ‎should‏ ‎be ‎warned ‎against ‎insecure‏ ‎configurations.

📌 Access‏ ‎Controls: ‎Restricting‏ ‎access ‎to‏ ‎the ‎router’s ‎web ‎management ‎interface‏ ‎from‏ ‎the ‎LAN‏ ‎side ‎by‏ ‎default ‎and ‎providing ‎options ‎to‏ ‎securely‏ ‎enable‏ ‎remote ‎management‏ ‎if ‎needed.

📌 Encryption:‏ ‎Utilizing ‎strong‏ ‎encryption‏ ‎for ‎the‏ ‎web ‎management ‎interface ‎to ‎protect‏ ‎communications ‎between‏ ‎the‏ ‎router ‎and ‎the‏ ‎user.

📌 Authentication: Implementing ‎strong‏ ‎authentication ‎mechanisms, ‎including ‎the‏ ‎option‏ ‎for ‎MFA,‏ ‎to ‎secure‏ ‎access ‎to ‎the ‎router’s ‎management‏ ‎interface.

📌 Vulnerability‏ ‎Disclosure ‎and‏ ‎Patching: Establishing ‎a‏ ‎clear, ‎responsible ‎disclosure ‎policy ‎for‏ ‎vulnerabilities‏ ‎and‏ ‎providing ‎timely‏ ‎patches. ‎This‏ ‎includes ‎participating‏ ‎in‏ ‎the ‎CVE‏ ‎program ‎to ‎track ‎and ‎disclose‏ ‎vulnerabilities.

📌 End-of-Life ‎Support:‏ ‎Clearly‏ ‎communicating ‎the ‎end-of-life‏ ‎(EOL) ‎policy‏ ‎for ‎products ‎and ‎providing‏ ‎support‏ ‎and ‎updates‏ ‎throughout ‎the‏ ‎product’s ‎lifecycle ‎are ‎critical. ‎For‏ ‎devices‏ ‎that ‎are‏ ‎no ‎longer‏ ‎supported, ‎manufacturers ‎should ‎offer ‎guidance‏ ‎on‏ ‎secure‏ ‎disposal ‎or‏ ‎replacement.

Читать: 1+ мин
logo Overkill Security

SOHO's Screwed: Affected Industries

The ‎exploitation‏ ‎of ‎insecure ‎SOHO ‎routers ‎poses‏ ‎a ‎significant‏ ‎threat‏ ‎across ‎multiple ‎sectors,‏ ‎highlighting ‎the‏ ‎need ‎for ‎improved ‎security‏ ‎practices‏ ‎and ‎awareness.‏ ‎

Communications

📌 Data ‎Breaches‏ ‎and ‎Eavesdropping: Insecure ‎routers ‎can ‎lead‏ ‎to‏ ‎unauthorized ‎access‏ ‎to ‎network‏ ‎traffic, ‎allowing ‎attackers ‎to ‎intercept‏ ‎sensitive‏ ‎communications.

📌 Disruption‏ ‎of ‎Services: Compromised‏ ‎routers ‎can‏ ‎be ‎used‏ ‎to‏ ‎launch ‎Distributed‏ ‎Denial ‎of ‎Service ‎(DDoS) ‎attacks,‏ ‎disrupting ‎communication‏ ‎services.

Transportation

📌 Infrastructure‏ ‎Vulnerability: ‎The ‎transportation‏ ‎sector ‎relies‏ ‎heavily ‎on ‎networked ‎systems‏ ‎for‏ ‎operations. ‎Compromised‏ ‎routers ‎could‏ ‎allow ‎attackers ‎to ‎disrupt ‎traffic‏ ‎management‏ ‎systems ‎and‏ ‎logistics ‎operations.

Water

📌 Operational‏ ‎Technology ‎(OT) ‎Threats: Insecure ‎routers ‎can‏ ‎provide‏ ‎a‏ ‎gateway ‎for‏ ‎attackers ‎to‏ ‎target ‎OT‏ ‎systems‏ ‎within ‎the‏ ‎water ‎sector, ‎potentially ‎affecting ‎water‏ ‎treatment ‎and‏ ‎distribution‏ ‎systems.

Energy

📌 Grid ‎Security: The ‎energy‏ ‎sector, ‎particularly‏ ‎electric ‎utilities, ‎is ‎at‏ ‎risk‏ ‎of ‎targeted‏ ‎attacks ‎through‏ ‎insecure ‎routers. ‎Attackers ‎could ‎gain‏ ‎access‏ ‎to ‎control‏ ‎systems, ‎posing‏ ‎a ‎threat ‎to ‎the ‎stability‏ ‎of‏ ‎the‏ ‎power ‎grid.

Other‏ ‎Industries

📌 Healthcare: Insecure ‎routers‏ ‎can ‎compromise‏ ‎patient‏ ‎data ‎and‏ ‎disrupt ‎medical ‎services ‎by ‎providing‏ ‎attackers ‎access‏ ‎to‏ ‎healthcare ‎networks.

📌 Retail ‎and‏ ‎Hospitality: ‎These‏ ‎sectors ‎are ‎vulnerable ‎to‏ ‎data‏ ‎breaches ‎involving‏ ‎customer ‎information‏ ‎and ‎financial ‎transactions ‎due ‎to‏ ‎insecure‏ ‎network ‎devices.

📌 Manufacturing: Industrial‏ ‎control ‎systems‏ ‎can ‎be ‎compromised ‎through ‎insecure‏ ‎routers,‏ ‎affecting‏ ‎production ‎lines‏ ‎and ‎industrial‏ ‎processes.

📌 Education: ‎Schools‏ ‎and‏ ‎universities ‎are‏ ‎at ‎risk ‎of ‎data ‎breaches‏ ‎and ‎disruption‏ ‎of‏ ‎educational ‎services.

📌 Government ‎and‏ ‎Public ‎Sector: Insecure‏ ‎routers ‎can ‎lead ‎to‏ ‎unauthorized‏ ‎access ‎to‏ ‎government ‎networks,‏ ‎risking ‎sensitive ‎information ‎and ‎critical‏ ‎services

Показать еще

Обновления проекта

Метки

overkillsecurity 142 overkillsecuritypdf 52 news 47 keypoints 38 nsa 26 fbi 25 adapt tactics 11 Living Off the Land 11 LOTL 11 unpacking 10 vulnerability 9 cyber security 8 Digest 8 edge routers 8 Essential Eight Maturity Model 8 malware 8 Maturity Model 8 Monthly Digest 8 research 8 ubiquiti 8 IoT 7 lolbin 7 lolbins 7 Cyber Attacks 6 phishing 6 Forensics 5 Ransomware 5 soho 5 authToken 4 BYOD 4 MDM 4 OAuth 4 Energy Consumption 3 IoMT 3 medical 3 ai 2 AnonSudan 2 authentication 2 av 2 battery 2 Buffer Overflow 2 console architecture 2 cve 2 cybersecurity 2 energy 2 Google 2 incident response 2 MITM 2 mqtt 2 Passkeys 2 Retro 2 Velociraptor 2 video 2 Vintage 2 vmware 2 windows 2 1981 1 5g network research 1 8-bit 1 Ad Removal 1 Ad-Free Experience 1 ADCS 1 advisory 1 airwatch 1 AlphV 1 AMSI 1 android 1 Android15 1 announcement 1 antiPhishing 1 AntiPhishStack 1 antivirus 1 Apple 1 Atlassian 1 Attack 1 AttackGen 1 BatBadBut 1 Behavioral Analytics 1 BianLian 1 bias 1 Biocybersecurity 1 Biometric 1 bite 1 bitlocker 1 bitlocker bypass 1 Black Lotus Labs 1 blackberry 1 blizzard 1 botnet 1 Browser Data Theft 1 BucketLoot 1 CellularSecurity 1 checkpoint 1 china 1 chisel 1 cisa 1 CloudSecurity 1 CloudStorage 1 content 1 content category 1 cpu 1 Credential Dumping 1 CVE-2023-22518 1 CVE-2023-35080 1 CVE-2023-38043 1 CVE-2023-38543 1 CVE-2024-0204 1 CVE-2024-21111 1 CVE-2024-21345 1 cve-2024-21447 1 CVE-2024-24919 1 CVE-2024-26218 1 cve-2024-27129 1 cve-2024-27130 1 cve-2024-27131 1 cve-2024-3400 1 cvss 1 cyber operations 1 Cyber Toufan Al-Aqsa 1 cyberops 1 D-Link 1 dark pink apt 1 data leakage 1 dcrat 1 Demoscene 1 DevSecOps 1 Dex 1 disassembler 1 DOS 1 e8mm 1 EDR 1 Embedded systems 1 Employee Training 1 EntraID 1 ESC8 1 Event ID 4663 1 Event ID 4688 1 Event ID 5145 1 Evilginx 1 EvilLsassTwin 1 Facebook 1 FBI IC3 1 FIDO2 1 filewave 1 Firebase 1 Firmware 1 Fortra's GoAnywhere MFT 1 france 1 FraudDetection 1 fuxnet 1 fuzzer 1 game console 1 gamification 1 GeminiNanoAI 1 genzai 1 go 1 GoogleIO2024 1 GooglePlayProtect 1 GoPhish 1 gpu 1 ICS 1 ICSpector 1 IDA 1 IncidentResponse 1 Industrial Control Systems 1 jazzer 1 jetbrains 1 jvm 1 KASLR 1 KillNet 1 LeftOverLocals 1 Leviathan 1 lg smart tv 1 lockbit 1 LSASS 1 m-trends 1 Machine Learning Integration 1 Mallox 1 MalPurifier 1 mandiant 1 MediHunt 1 Meta Pixel 1 ML 1 mobile network analysis 1 mobileiron 1 nes 1 nexus 1 NGO 1 Nim 1 Nimfilt 1 NtQueryInformationThread 1 OFGB 1 oracle 1 paid content 1 panos 1 Passwordless 1 Phishing Resilience 1 PingFederate 1 Platform Lock-in Tool 1 PlayIntegrityAPI 1 PlayStation 1 playstation 2 1 playstation 3 1 plc 1 podcast 1 Privilege Escalation 1 ps2 1 ps3 1 PulseVPN 1 qcsuper 1 qemu 1 qualcomm diag protocol 1 radio frame capture 1 Raytracing 1 Real-time Attack Detection 1 Red Team 1 Registry Modification 1 Risk Mitigation 1 RiskManagement 1 rodrigo copetti 1 rooted android devices 1 Router 1 rust 1 Sagemcom 1 sandworm 1 ScamCallDetection 1 security 1 Security Awareness 1 session hijacking 1 SharpADWS 1 SharpTerminator 1 shellcode 1 SIEM 1 Siemens 1 skimming 1 Smart Devices 1 snes 1 SSO 1 stack overflow 1 TA427 1 TA547 1 TDDP 1 telecom security 1 Telegram 1 telerik 1 TeleTracker 1 TEMP.Periscope 1 Terminator 1 Think Tanks 1 Threat 1 threat intelligence 1 threat intelligence analysis 1 Threat Simulation 1 tool 1 toolkit 1 tp-link 1 UK 1 UserManagerEoP 1 uta0218 1 virtualbox 1 VPN 1 vu 1 wargame 1 Web Authentication 1 WebAuthn 1 webos 1 What2Log 1 Windows 11 1 Windows Kernel 1 Windstream 1 women 1 WSUS 1 wt-2024-0004 1 wt-2024-0005 1 wt-2024-0006 1 xbox 1 xbox 360 1 xbox original 1 xss 1 Yubico 1 Z80A 1 ZX Spectrum 1 Больше тегов

Фильтры

Пн
Вт
Ср
Чт
Пт
Сб
Вс
28
29
30
31
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
1

Подарить подписку

Будет создан код, который позволит адресату получить бесплатный для него доступ на определённый уровень подписки.

Оплата за этого пользователя будет списываться с вашей карты вплоть до отмены подписки. Код может быть показан на экране или отправлен по почте вместе с инструкцией.

Будет создан код, который позволит адресату получить сумму на баланс.

Разово будет списана указанная сумма и зачислена на баланс пользователя, воспользовавшегося данным промокодом.

Добавить карту
0/2048