November 30, 2022 By Jonathan Reed 2 min read

From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to an advanced cyberattack on a Defense Industrial Base (DIB) organization’s enterprise network.

During that time frame, advanced persistent threat (APT) adversaries used an open-source toolkit called Impacket to breach the environment and further penetrate the organization’s network. Even worse, CISA reported that multiple APT groups may have hacked into the organization’s network.

Data breaches such as these are almost always the result of compromised endpoints and privileged credentials. In this case, the abuse of user and admin privilege played a major role in the success of this attack. The APT group’s attack further proves that monitoring and protecting privileged accounts are crucial for strong security.

Evolution of the attack

In the first stages of the attack, APT actors gained access to the organization’s Microsoft Exchange Server as early as mid-January 2021. The initial access vector remains unknown. Based on log analysis, the actors collected information about the exchange environment and searched mailboxes — all within four hours after the initial breach.

Four days later, the APT actors used Windows Command Shell to study the organization’s environment and begin harvesting data. That exfiltrated data included sensitive contract-related information from shared drives.

At the same time, APT actors implanted Impacket in another system. Impacket is a Python toolkit for programmatically constructing and manipulating network protocols. By using this toolkit, the actors were also able to attempt to move laterally within the network.

Preventing abuse of privilege

One of the hallmarks of this attack was the abuse of privilege. Actors obtained and abused credentials of existing accounts as a means of executing Initial Access, Persistence, Privilege Escalation or Defense Evasion.

Given the actors’ proven capability to maintain persistent, long-term access in compromised enterprise environments, the CISA, FBI and NSA are encouraging organizations to monitor logs for connections from unusual VPSs and VPNs. This includes examining connection logs for access from unexpected ranges.

Organizations should also monitor for suspicious account use, such as inappropriate or unauthorized use of administrator accounts, service accounts or third-party accounts.

According to CISA, suspicious account use can appear as:

  • “Impossible logins” with changing usernames, user agent strings and IP address combinations or logins where IP addresses do not align with the expected user’s geographic location
  • Suspicious privileged account use after resetting passwords or applying user account mitigations
  • Unusual activity in typically dormant accounts
  • Unusual user agent strings, such as strings not typically associated with normal user activity, may indicate bot activity.

Privileged access management offers a solution

Successfully mitigating this type of APT attack is far more effective with privileged access management (PAM) solutions. By establishing least-privilege access on endpoints, unusual user activity can be detected faster. For example, if users access files that aren’t part of their usual work activity, least privilege methods can detect this, or, if a dormant account suddenly becomes active, PAM solutions can trigger an alert.

As illustrated by this DIB organization incident, local administrator rights are prime targets for cyber criminals. To thoroughly protect sensitive data, controls need to be in place that keep both endpoints and privileged credentials secure.

More from News

Zero-day exploits underscore rising risks for internet-facing interfaces

3 min read - Recent reports confirm the active exploitation of a critical zero-day vulnerability targeting Palo Alto Networks’ Next-Generation Firewalls (NGFW) management interfaces. While Palo Alto’s swift advisories and mitigation guidance offer a starting point for remediation, the broader implications of such vulnerabilities demand attention from organizations globally. The surge in attacks on internet-facing management interfaces highlights an evolving threat landscape and necessitates rethinking how organizations secure critical assets. Who is exploiting the NGFW zero-day? As of now, little is known about the…

Will arresting the National Public Data threat actor make a difference?

3 min read - The arrest of USDoD, the mastermind behind the colossal National Public Data breach, was a victory for law enforcement. It also raises some fundamental questions. Do arrests and takedowns truly deter cyberattacks? Or do they merely mark the end of one criminal’s chapter while others rise to take their place? As authorities continue to crack down on cyber criminals, the arrest of high-profile threat actors like USDoD reveals a deeper, more complex reality about the state of global cyber crime.…

CISA adds Microsoft SharePoint vulnerability to the KEV Catalog

3 min read - In late October, the United States Cybersecurity & Infrastructure Security Agency (CISA) added a new threat to its Known Exploited Vulnerability (KEV) Catalog. Cyber criminals used remote code execution vulnerability in Microsoft SharePoint to gain access to organizations’ networks. The CISA press release states that “these types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.” However, Microsoft identified and released a patch for this vulnerability in July 2024. Cybersecurity experts…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today