NSA, FBI Reveal Hacking Methods Used by Russian Military Hackers

An ongoing brute-force attack campaign targeting enterprise
cloud environments has been spearheaded by the Russian military
intelligence since mid-2019, according to a joint advisory
published by intelligence agencies in the U.K. and U.S.

The National Security Agency (NSA), Cybersecurity and
Infrastructure Security Agency (CISA), Federal Bureau of
Investigation (FBI), and the U.K.’s National Cyber Security Centre
(NCSC) formally attributed the incursions to the Russian General
Staff Main Intelligence Directorate (GRU) 85th Main Special Service
Center (GTsSS).

The threat actor^[1]
is also tracked under various monikers, including APT28^[2]
(FireEye Mandiant), Fancy Bear^[3]
(CrowdStrike), Sofacy^[4]
(Kaspersky), STRONTIUM^[5]
(Microsoft), and Iron Twilight^[6]
(Secureworks).

APT28 has a track record of using password spray and brute-force
login attempts to steal login credentials. In November 2020,
Microsoft disclosed^[7]
cyberattacks staged by the adversary aimed at companies involved in
researching vaccines and treatments for COVID-19. What’s different
this time around is the actor’s reliance on software containers to
scale its brute-force attempts.

“The campaign uses a Kubernetes cluster in brute force access
attempts against the enterprise and cloud environments of
government and private sector targets worldwide,” CISA said^[8]. “After obtaining
credentials via brute force, the GTsSS uses a variety of known
vulnerabilities for further network access via remote code
execution and lateral movement.”

Some of the other security flaws exploited by APT28 to pivot
inside the breached organizations and gain access to internal email
servers include –

• CVE-2020-0688^[9] – Microsoft Exchange
  Validation Key Remote Code Execution Vulnerability
• CVE-2020-17144^[10] – Microsoft Exchange
  Remote Code Execution Vulnerability

The threat actors is also said to utilized different evasion
techniques in an attempt to disguise some components of their
operations, including routing brute-force authentication attempts
through Tor and commercial VPN services, including CactusVPN,
IPVanish, NordVPN, ProtonVPN, Surfshark, and WorldVPN.

The agencies said the attacks primarily focused on the U.S. and
Europe, targeting government and military, defense contractors,
energy companies, higher education, logistics companies, law firms,
media companies, political consultants or political parties, and
think tanks.

“Network managers should adopt and expand usage of multi-factor
authentication to help counter the effectiveness of this
capability,” the advisory noted^[11]. “Additional
mitigations to ensure strong access controls include time-out and
lock-out features, the mandatory use of strong passwords,
implementation of a Zero Trust security model that uses additional
attributes when determining access, and analytics to detect
anomalous accesses.”