Threat Signal Report
Joint CyberSecurity Advisory on GRU Bruteforce Attacks Targeting Organizations Worldwide (NSA-CISA-NCSC-FBI)
Today, The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and the UK's National Cyber Security Centre (NCSC) have released a joint cybersecurity advisory titled "Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments."
This report highlights an almost two-year campaign attributed to the Russian General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS), military unit 26165, that utilized a Kubernetes cluster conduct brute force attacks on various global entities such as government and private sector companies on a global scale.
What are the Technical Details of the Report?
The advisory highlights numerous TTPs used by the GTsSS to conduct their operations. The GTsSS was observed to use password spraying techniques to exploit target networks, move laterally, and used data exfiltration to steal access credentials to further reconnaissance. Protocols such as HTTP(S), IMAP(S), POP3, and NTLM were observed being targeted as well. After gaining access, the threat actors would then conduct further operations such as lateral movement to further along their objective. The usage of CVE 2020-0688 (Microsoft Exchange Validation Key Remote Code Execution Vulnerability) and CVE 2020-17144 (Microsoft Exchange Remote Code Execution Vulnerability), were observed as well. The Kubernetes clusters utilized by the bad actor were using commercial VPN and TOR services to obfuscate the origin of the attacker and their origin IP addresses.
Is GTsSS the same as APT28?
Yes. According to the advisory Fancy Bear, APT28, Strontium are the same threat actor as GTsSSS. APT28 was responsible for the World Anti-Doping Agency (WADA) attacks before the Rio Olympics (2016) and was also responsible for the DNC attacks in 2016 as well.
This is not to be confused with APT29/Cozy Bear/Duke, which is also attributed to Russia and has been attributed to attacks on the United States Pentagon in 2015, the Democratic National Committee (DNC) email leaks in 2016, and against various United States think tanks and NGOs in 2017.
How Serious of an Issue is This?
What is the Status of Coverage?
All network IOC's mentioned in this advisory are blocked by the Fortinet Web Filtering client.
Any Other Suggested Mitigation?
As the attackers have been observed using TOR and VPN services to conduct their attacks, it is suggested to block all known inbound TOR and VPN IP addresses if possible, especially to Microsoft Exchange.
Due to the ease of disruption and damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc. it is important to keep all AV and IPS signatures up to date.
It is also important to ensure that all known vendor vulnerabilities are addressed, and updated to protect from attackers having a foothold within a network. Attackers are well aware of the difficulty of patching and if it is determined that patching is not feasible at this time, an assessment should be conducted to determine risk.
Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spear phishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spear phishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.
Traffic Light Protocol
|Color||When Should it Be used?||How may it be shared?|
TLP: REDNot for disclosure, restricted to participants only.
|Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused.||Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.|
TLP: AMBERLimited disclosure, restricted to participants’ organizations.
|Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved.||Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.|
TLP: GREENLimited disclosure, restricted to the community.
|Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector.||Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.|
TLP: WHITEDisclosure is not limited.
|Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release.||Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.|