From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to an advanced cyberattack on a Defense Industrial Base (DIB) organization’s enterprise network.

During that time frame, advanced persistent threat (APT) adversaries used an open-source toolkit called Impacket to breach the environment and further penetrate the organization’s network. Even worse, CISA reported that multiple APT groups may have hacked into the organization’s network.

Data breaches such as these are almost always the result of compromised endpoints and privileged credentials. In this case, the abuse of user and admin privilege played a major role in the success of this attack. The APT group’s attack further proves that monitoring and protecting privileged accounts are crucial for strong security.

Evolution of the attack

In the first stages of the attack, APT actors gained access to the organization’s Microsoft Exchange Server as early as mid-January 2021. The initial access vector remains unknown. Based on log analysis, the actors collected information about the exchange environment and searched mailboxes — all within four hours after the initial breach.

Four days later, the APT actors used Windows Command Shell to study the organization’s environment and begin harvesting data. That exfiltrated data included sensitive contract-related information from shared drives.

At the same time, APT actors implanted Impacket in another system. Impacket is a Python toolkit for programmatically constructing and manipulating network protocols. By using this toolkit, the actors were also able to attempt to move laterally within the network.

Preventing abuse of privilege

One of the hallmarks of this attack was the abuse of privilege. Actors obtained and abused credentials of existing accounts as a means of executing Initial Access, Persistence, Privilege Escalation or Defense Evasion.

Given the actors’ proven capability to maintain persistent, long-term access in compromised enterprise environments, the CISA, FBI and NSA are encouraging organizations to monitor logs for connections from unusual VPSs and VPNs. This includes examining connection logs for access from unexpected ranges.

Organizations should also monitor for suspicious account use, such as inappropriate or unauthorized use of administrator accounts, service accounts or third-party accounts.

According to CISA, suspicious account use can appear as:

• “Impossible logins” with changing usernames, user agent strings and IP address combinations or logins where IP addresses do not align with the expected user’s geographic location
• Suspicious privileged account use after resetting passwords or applying user account mitigations
• Unusual activity in typically dormant accounts
• Unusual user agent strings, such as strings not typically associated with normal user activity, may indicate bot activity.

Privileged access management offers a solution

Successfully mitigating this type of APT attack is far more effective with privileged access management (PAM) solutions. By establishing least-privilege access on endpoints, unusual user activity can be detected faster. For example, if users access files that aren’t part of their usual work activity, least privilege methods can detect this, or, if a dormant account suddenly becomes active, PAM solutions can trigger an alert.

As illustrated by this DIB organization incident, local administrator rights are prime targets for cyber criminals. To thoroughly protect sensitive data, controls need to be in place that keep both endpoints and privileged credentials secure.