Threat Actor Objectives

The involvement of nation-states in the ongoing cyber offensives can be attributed to the state of the world economy post-COVID-19. This has driven nation-states to compromise or acquire research data from foreign research entities, in a bid to win the ‘vaccine race,’ that will enable the rapid resurgence of their respective economies.

Threat Description

Threat actors are targeting individuals and organisations by direct methods such as password spraying and by employing social engineering methods, such posing as WHO officials and job recruiters, to make the victims open malicious email attachments. They are also launching attacks on Internet-facing assets, by abusing weak RDP credentials, to gain an initial foothold on the target network to further the attack and compromise the target infrastructure.

Key Threat Actors

[/vc_column_text][vc_column_text]

MITRE ATT&CK HEAT MAP

• Russian Group
• North Korea Groups
• Common TTPs

[/vc_column_text][vc_single_image image="8660" img_size="large" onclick="custom_link" img_link_target="_blank" link="https://cdn.cloudsek.com/wp-content/uploads/2020/11/image1.png"][vc_column_text]

Mitigation measures

Mitigations need to be addressed not only by technical means but also by enforcing security policies that implement technical solutions. 

Mitigations to offset the risks associated with crucial stages in the cyber kill chain:

Initial Access Phase Mitigation

• Administrative policy to enforce strong passwords: Passwords should contain alphanumerics, special characters, and should not contain dictionary words. 
• Lockout Policy: To prevent brute-forcing and password spraying.

Payload Staging/ Execution-Installation Mitigation

• Security administrators should be aware of the “Living-Off-The-Land” approach of the adversaries, which is nothing but using trusted applications on the victim host to do the bidding of the attacker.
• Effective log monitoring for suspicious activities, for example: abnormal use case of “mshta” and “regsvr32.”
• Effective IDR/ XDR solutions to monitor host activities.
• Ingress/ egress traffic flow monitoring.
• Most of the outlined measures can be implemented with a SIEM.
• System Configuration auditing.

Lateral Movement Mitigation

• Proper user privilege auditing, use only standard user accounts
• Enforcement of “Principle of Least Privilege.”
• Implementation of Application Allow Listing. 
• Multi-Factor Authentication.
• Context-based and adaptive access controls.
• Strong password policy.
• Network segmentation and air gaping.
• Deploy threat behavior model detection solutions like modern IDR/ XDR systems. 
• Awareness of tools commonly used by actors to execute lateral movement.

Exfiltration/Objective Mitigation

• Effective DLP solutions to monitor border router egress traffic.
• Awareness of exfiltration techniques used by actors, for example: DNS/ HTTPS
• Attackers can make use of even trusted applications on the victim environment to exfiltrate data out of the target network (Living off The Land).

Basic Incident Response Guidelines 

Appendix

APT28

Tactics, Techniques, and Procedures of APT28:

Software used by APT28:

Lazarus Group

Tactics, Techniques, and Procedures of Lazarus:

Software used by Lazarus: