Joint CyberSecurity Advisory on APT40 Attacks Targeting Organizations Worldwide (CISA-FBI)

Description

On July 19th, a joint cybersecurity advisory was issued by the United States Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) on APT40. The alert provides insight into the tactics, techniques, and procedures along with indicators of compromise used by APT40, which has been operating since 2009. This announcement coincided with the July 19th indictment of four threat actors by the U.S. Department of Justice (DOJ) for their role in various cyberattacks across the globe.


Who is APT 40?

APT40, also known as BRONZE MOHAWK, FEVERDREAM, G0065, Gadolinium, GreenCrash, Hellsing, Kryptonite Panda, Leviathan, MUDCARP, Periscope, Temp.Periscope, and Temp.Jumper is a state sponsored group operating out of China. APT40 has been observed over the past decade targeting various verticals and organizations around the world including, but not limited to - academia, aerospace/aviation, biomedical, defense industrial base, education, government, healthcare, manufacturing, maritime, research institutes, and transportation (rail and shipping).


What are the Technical Details of the Attack(s)?

Technical details were limited. The advisory was not a specific advisory, but a general overview of APT40. The advisory provided a blanket overview of known TTPs and associated malware/IOC's observed used by APT40. The usage of various open source tools, shared malware between other state sponsored groups, and various tradecraft which allowed APT40 to establish a foothold, maintain persistence and ultimately exfiltrate data, was shared and highlighted.


Is this State Sponsored?

Yes.


Why are there so Many Designations for APT40?

This is due to the lack of standardized nomenclature conventions for threat actors between various security vendors.


What is the Status of Coverage?

Fortinet customers running the latest (AV) definitions are protected from all publicly known samples by the following signatures:


Adware/Agent

BAT/BitMin.M!tr

ELF/ShadowBrokers.AG!tr

ELF/ShadowBrokers.AP!tr

Malware_fam.gw

MalwThreat!df3bIV

MSWord/CVE20170199.A!exploit

PossibleThreat

Riskware/Agent

Riskware/Agent.AF!tr.pws

Riskware/Mimikatz

Riskware/UtilityCmdShell

Riskware/WinCred

Riskware/Winexe

VBS/Agent.NPX!tr

W32/Agent.4030!tr

W32/Agent.AKVY!tr

W32/Agent.APUY!tr

W32/Agent.AW!tr.rkit

W32/Agent.GECSMGG!tr

W32/Agent.NDP!tr

W32/Agent.NDS!tr

W32/Backdr.KX!tr

W32/BDoor.CKB!tr.bdr

W32/Cometer.A!tr

W32/ETap.A

W32/Fareit.A

W32/Farfli.AIL!tr

W32/Generic!tr

W32/Generic.A!tr

W32/Generic.AC.3167!tr

W32/Generic.AC.3BC1AF!tr

W32/Generic.AC.3F14FB!tr

W32/Generik.DIOYXCO!tr

W32/Gulpix.BUS!tr.bdr

W32/Sedkom.AA!tr

W32/ShadowBrokers.AB!tr

W32/ShadowBrokers.AD!tr

W32/ShadowBrokers.AE!exploit

W32/ShadowBrokers.AJ!tr

W32/ShadowBrokers.U!tr

W32/ShadowBrokers.X!tr

W32/Svectas.A!tr

W32/Waski.B!tr

W64/Derusbi.AZ!tr

WM/Agent.AA!tr

WM/Agent.BBE0!tr


All network IOC's are blocked by the WebFiltering client.


Any Other Suggested Mitigation?

Due to the ease of disruption and damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc. it is important to keep all AV and IPS signatures up to date.


It is also important to ensure that all known vendor vulnerabilities are addressed, and updated to protect from attackers having a foothold within a network. Attackers are well aware of the difficulty of patching and if it is determined that patching is not feasible at this time, an assessment should be conducted to determine risk.


Also - organizations are encouraged to conduct ongoing training sessions to educate and inform personnel about the latest phishing/spear phishing attacks. They also need to encourage employees to never open attachments from someone they don't know, and to always treat emails from unrecognized/untrusted senders with caution. Since it has been reported that various phishing and spear phishing attacks have been delivered via social engineering distribution mechanisms, it is crucial that end users within an organization be made aware of the various types of attacks being delivered. This can be accomplished through regular training sessions and impromptu tests using predetermined templates by an organizations' internal security department. Simple user awareness training on how to spot emails with malicious attachments or links could also help prevent initial access into the network.