Threat Signal Report

FireEye Internal Penetration Testing Tools Stolen by Russian Threat Actors (APT29)

Description

Editorial Note: This Threat Signal was created by FortiGuard Labs using all of the information we had available to us on December 9th, which included a number of media reports attributing the attack to the threat actor APT29/Cozy Bear. Today, December 17th, the United States Cybersecurity and Infrastructure Security Agency (CISA) issued their report on the attack (AA20-352A). CISA has not attributed this activity to APT29 or any other specific actor at this time. Because of this, FortiGuard Labs will update this Threat Signal accordingly once CISA provides any clarification on which specific APT group it is, and will subsequently remove all designations to APT29/Cozy Bear if warranted. We have included the CISA report in the APPENDIX. All other aspects of this Threat Signal are unchanged.

FortiGuard Labs is aware of a new nation-state sponsored attack on FireEye Corporation that involved the theft of its internal penetration testing tools used by its Red Team on customer engagements. These tools were used by FireEye Red Team personnel to perform tests on customer environments to isolate and identify potential vulnerabilities for various purposes.

Multiple reports by news media outlets have attributed this attack to the Russian government, specifically, APT29/Cozy Bear.

Why is APT29/Cozy Bear/Duke Significant?

APT29/Cozy Bear/Duke has been in operation since 2008. Previous attacks attributed to this threat actor have targeted various companies, governmental agencies, research institutions, non-governmental organizations, and think tanks across multiple countries. Other high profile attacks attributed to this group are the attacks on the United States Pentagon in 2015, the Democratic National Committee (DNC) email leaks in 2016, and against various United States think tanks and NGOs in 2017.

Although APT29 is attributed to Russia, it is not to be confused with APT28/Fancy Bear/Pawn Storm, which is another group attributed to Russia. APT28 was responsible for the World Anti-Doping Agency (WADA) attacks before the Rio Olympics (2016) and was also responsible for the DNC attacks in 2016 as well.

Do The Tools Contain Zeroday Vulnerabilities?

No. According to the press release by FireEye, no zero days are contained within this toolset.

FireEye has an Updated List of Known CVE's on their GitHub Repository. What Does This Mean?

The CVEs listed appear to be a list of existing vulnerabilities that were likely used by FireEye's red team when performing customer security evaluations. They are listed in order of exploitation and CVSS score (10 being the highest).

All of the CVE's mentioned by FireEye below have been patched or incorporated into version updates by their respective vendors:

CVE-2019-11510 - pre-auth arbitrary file reading from Pulse Secure SSL VPNs - CVSS 10.0

CVE-2020-1472 - Microsoft Active Directory escalation of privileges - CVSS 10.0

CVE-2018-13379 - pre-auth arbitrary file reading from Fortinet Fortigate SSL VPN - CVSS 9.8

CVE-2018-15961 - RCE via Adobe ColdFusion (arbitrary file upload that can be used to upload a JSP web shell) - CVSS 9.8

CVE-2019-0604 - RCE for Microsoft Sharepoint - CVSS 9.8

CVE-2019-0708 - RCE of Windows Remote Desktop Services (RDS) - CVSS 9.8

CVE-2019-11580 - Atlassian Crowd Remote Code Execution - CVSS 9.8

CVE-2019-19781 - RCE of Citrix Application Delivery Controller and Citrix Gateway - CVSS 9.8

CVE-2020-10189 - RCE for ZoHo ManageEngine Desktop Central - CVSS 9.8

CVE-2014-1812 - Windows Local Privilege Escalation - CVSS 9.0

CVE-2019-3398 - Confluence Authenticated Remote Code Execution - CVSS 8.8

CVE-2020-0688 - Remote Command Execution in Microsoft Exchange - CVSS 8.8

CVE-2016-0167 - local privilege escalation on older versions of Microsoft Windows - CVSS 7.8

CVE-2017-11774 - RCE in Microsoft Outlook via crafted document execution (phishing) - CVSS 7.8

CVE-2018-8581 - Microsoft Exchange Server escalation of privileges - CVSS 7.4

CVE-2019-8394 - arbitrary pre-auth file upload to ZoHo ManageEngine ServiceDesk Plus - CVSS 6.5

Have There Been any Observed Attacks in the Wild?

According to the press release by FireEye, no in the wild attacks using these tools have been observed.

How Serious of an Issue is This?

Medium. This is because the stolen tools contain known, publicly disclosed vulnerabilities. All affected vendors of listed CVE's have already released patches and/or newer software versions to address said vulnerabilities.

What is the Status of Coverage?

FortiGuard Labs has recently developed an IPS signature and coverage is in place as:

FireEye.Red.Team.Tool (16.978)

FortiGuard Labs has existing coverage in place for the following CVEs:

CVE-2020-1472 "MS.Windows.Server.Netlogon.Elevation.of.Privilege"

CVE-2020-10189 "ZOHO.ManageEngine.DC.getChartImage.Remote.Code.Execution"

CVE-2020-0688 "MS.Exchange.Validation.Key.ViewState.Remote.Code.Execution"

CVE-2019-8394 "ZOHO.ManageEngine.ServiceDesk.Plus.Arbitrary.File.Upload"

CVE-2019-3398 "Confluence.downloadallattachments.Resource.Path.Traversal"

CVE-2019-19781 "Citrix.Application.Delivery.Controller.VPNs.Directory.Traversal"

CVE-2019-11580 "Atlassian.Crowd.Pdkinstall.Plugin.Remote.Code.Execution"

CVE-2019-11510 "Pulse.Secure.SSL.VPN.HTML5.Information.Disclosure"

CVE-2019-0708 "MS.Windows.RDP.Channel.MS_T120.Remote.Code.Execution"

CVE-2019-0604 "MS.SharePoint.CVE-2019-0604.Remote.Code.Execution"

CVE-2018-8581 "MS.Exchange.Server.CVE-2018-8581.Privilege.Elevation"

CVE-2018-15961"Adobe.ColdFusion.Arbitrary.JSP.File.Upload"

CVE-2018-13379 "FortiOS.SSL.VPN.Web.Portal.Pathname.Information.Disclosure"

CVE-2017-11774 "MS.Office.Outlook.CVE-2017-11774.Security.Bypass"

CVE-2016-0167 "MS.Windows.Win32k.PopupMenu.Privilege.Elevation"

Regarding CVE-2018-13379, What Is FortiGuard Labs Current Stance on This?

Please refer to our recent blog "Update Regarding CVE-2018-13379" which contains detailed insight along with mitigation suggestions. Also, for further information, please refer to our PSIRT page, published on May 24, 2019 for further guidance. Links for these can be found in the APPENDIX section.

Any Other Suggested Mitigation?

Due to the ease of disruption and damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc. it is important to keep all AV and IPS signatures up to date.

It is also important to ensure that all known vendor vulnerabilities are addressed, and updated to protect from attackers having a foothold within a network. Attackers are well aware of the difficulty of patching and if it is determined that patching is not feasible at this time, an assessment should be conducted to determine risk.

Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spear phishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spear phishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.