Federal Agency Compromised by Malicious Cyber Actor

guest · Sep 24, 2020

Federal Agency Compromised by Malicious Cyber Actor
Analysis Report (AR20-268A)
September 24, 2020
https://us-cert.cisa.gov/ncas/analysis-reports/ar20-268a

Summary
The Cybersecurity and Infrastructure Security Agency (CISA) responded to a recent threat actor’s cyberattack on a federal agency’s enterprise network. By leveraging compromised credentials, the cyber threat actor implanted sophisticated malware—including multi-stage malware that evaded the affected agency’s anti-malware protection—and gained persistent access through two reverse Socket Secure (SOCKS) proxies that exploited weaknesses in the agency’s firewall.
Click to expand...

Description
CISA became aware—via EINSTEIN, CISA’s intrusion detection system that monitors federal civilian networks—of a potential compromise of a federal agency’s network. In coordination with the affected agency, CISA conducted an incident response engagement, confirming malicious activity. The following information is derived exclusively from the incident response engagement and provides the threat actor’s tactics, techniques, and procedures as well as indicators of compromise that CISA observed as part of the engagement.
Click to expand...

guest · Sep 24, 2020

Feds Hit with Successful Cyberattack, Data Stolen
September 24, 2020
https://threatpost.com/feds-cyberattack-data-stolen/159541/

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an alert on Thursday, not naming the agency but providing technical details of the attack. Hackers, it said, gained initial access by using employees’ legitimate Microsoft Office 365 log-in credentials to sign onto an agency computer remotely.

“The cyber-threat actor had valid access credentials for multiple users’ Microsoft Office 365 (O365) accounts and domain administrator accounts,” according to CISA.
As for how the attackers managed to get their hands on the credentials in the first place, CISA’s investigation turned up no definitive answer – however, it speculated that it could have been a result of a vulnerability exploit that it said has been rampant across government networks.

“It is possible the cyber-actor obtained the credentials from an unpatched agency VPN server by exploiting a known vulnerability—CVE-2019-11510—in Pulse Secure,” according to the alert.
Click to expand...

CISA didn’t specify what the secondary payload was – Threatpost has reached out for additional information.
The attack has been remediated – and it’s unclear when it took place. CISA said that it’s intrusion-detection system was thankfully able to eventually flag the activity, however.
Click to expand...

guest · Oct 1, 2020

Russia’s Fancy Bear Hackers Likely Penetrated a US Federal Agency
New clues indicate that APT28 may be behind a mysterious intrusion
October 1, 2020
https://www.wired.com/story/russias-fancy-bear-hack-us-federal-agency/

A warning that unidentified hackers broke into an agency of the US federal government and stole its data is troubling enough. But it becomes all the more disturbing when those unidentified intruders are identified—and appear likely to be part of a notorious team of cyberspies working in the service of Russia's military intelligence agency, the GRU.

Last week the Cybersecurity and Infrastructure Security Agency published an advisory that hackers had penetrated a US federal agency.
Now, clues uncovered by a researcher at cybersecurity firm Dragos and an FBI notification to hacking victims obtained by WIRED in July suggest a likely answer to the mystery of who was behind the intrusion: They appear to be Fancy Bear, a team of hackers working for Russia's GRU
Click to expand...

"Based on the infrastructure overlap, the series of behaviors associated with the event, and the general timing and targeting of the US government, this seems to be something very similar to—if not a part of—the campaign linked to APT28 earlier this year," says Slowik, the former head of Los Alamos National Labs’ Computer Emergency Response Team.

While CISA didn't make a sample of the hackers' custom trojan available to researchers, security researcher Costin Raiu says that the attributes of the malware matched another sample uploaded to the malware research repository VirusTotal from somewhere in the United Arab Emirates.
By analyzing that sample, Raiu found that it appears to be a unique creation built from a combination of the common hacking tools Meterpreter and Cobalt Strike,

"It's certainly not surprising that Russian intelligence would be trying penetrate the US government. That's kind of what they do," says Slowik. "But it is worth identifying that not only is such activity continuing, it's been successful."
Click to expand...

guest · Dec 20, 2021

US federal agency compromised in suspected APT attack
December 17, 2021

A sophisticated threat actor has gained access and has backdoored the internal network of a US federal government agency, antivirus maker Avast reported this week.

The security firm did not name the agency in its report, but The Record understands that the target of the attack was the United States Commission on International Religious Freedom (USCIRF).
But despite the sensitive nature of the data it processes, Avast said in a report on Thursday that the agency was unresponsive after notifying it of a security breach of its internal network.
Click to expand...

Backdoor and traffic interception malware discovered
Avast researchers said they found traces of two malicious files on its network that effectively granted attackers full control over internal systems.

“[B]ased on our analysis of the files in question, we believe it’s reasonable to conclude that the attackers were able to intercept and possibly exfiltrate all local network traffic in this organization,” the Avast team said.
“We also have indications that the attackers could run code of their choosing in the operating system’s context on infected systems, giving them complete control,” the Czech security firm added.
Click to expand...

However, the security firm said it believes the attack was “a classic APT-type operation,” where APT stands for “andvanced persistent threat,” a term used by the cybersecurity industry to describe state-sponsored groups.
Click to expand...

Avast: Avast Finds Backdoor on US Government Commission Network

We have found a new targeted attack against a small, lesser-known U.S. federal government commission associated with international rights. Despite repeated attempts through multiple channels over the course of months to make them aware of and resolve this issue they would not engage.

Because they would not engage with us, we have limited information about the attack. We are unable to attribute the attack, its impact, or duration. We are only able to describe two files we observed in the attack. In this blog, we are providing our analysis of these two files.
Click to expand...

Log in or Sign up

Federal Agency Compromised by Malicious Cyber Actor

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Federal Agency Compromised by Malicious Cyber Actor

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches