November 30, 2022 By Jonathan Reed 2 min read

From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to an advanced cyberattack on a Defense Industrial Base (DIB) organization’s enterprise network.

During that time frame, advanced persistent threat (APT) adversaries used an open-source toolkit called Impacket to breach the environment and further penetrate the organization’s network. Even worse, CISA reported that multiple APT groups may have hacked into the organization’s network.

Data breaches such as these are almost always the result of compromised endpoints and privileged credentials. In this case, the abuse of user and admin privilege played a major role in the success of this attack. The APT group’s attack further proves that monitoring and protecting privileged accounts are crucial for strong security.

Evolution of the attack

In the first stages of the attack, APT actors gained access to the organization’s Microsoft Exchange Server as early as mid-January 2021. The initial access vector remains unknown. Based on log analysis, the actors collected information about the exchange environment and searched mailboxes — all within four hours after the initial breach.

Four days later, the APT actors used Windows Command Shell to study the organization’s environment and begin harvesting data. That exfiltrated data included sensitive contract-related information from shared drives.

At the same time, APT actors implanted Impacket in another system. Impacket is a Python toolkit for programmatically constructing and manipulating network protocols. By using this toolkit, the actors were also able to attempt to move laterally within the network.

Preventing abuse of privilege

One of the hallmarks of this attack was the abuse of privilege. Actors obtained and abused credentials of existing accounts as a means of executing Initial Access, Persistence, Privilege Escalation or Defense Evasion.

Given the actors’ proven capability to maintain persistent, long-term access in compromised enterprise environments, the CISA, FBI and NSA are encouraging organizations to monitor logs for connections from unusual VPSs and VPNs. This includes examining connection logs for access from unexpected ranges.

Organizations should also monitor for suspicious account use, such as inappropriate or unauthorized use of administrator accounts, service accounts or third-party accounts.

According to CISA, suspicious account use can appear as:

  • “Impossible logins” with changing usernames, user agent strings and IP address combinations or logins where IP addresses do not align with the expected user’s geographic location
  • Suspicious privileged account use after resetting passwords or applying user account mitigations
  • Unusual activity in typically dormant accounts
  • Unusual user agent strings, such as strings not typically associated with normal user activity, may indicate bot activity.

Privileged access management offers a solution

Successfully mitigating this type of APT attack is far more effective with privileged access management (PAM) solutions. By establishing least-privilege access on endpoints, unusual user activity can be detected faster. For example, if users access files that aren’t part of their usual work activity, least privilege methods can detect this, or, if a dormant account suddenly becomes active, PAM solutions can trigger an alert.

As illustrated by this DIB organization incident, local administrator rights are prime targets for cyber criminals. To thoroughly protect sensitive data, controls need to be in place that keep both endpoints and privileged credentials secure.

More from News

CISA releases landmark cyber incident reporting proposal

2 min read - Due to ongoing cyberattacks and threats, critical infrastructure organizations have been on high alert. Now, the Cybersecurity and Infrastructure Security Agency (CISA) has introduced a draft of landmark regulation outlining how organizations will be required to report cyber incidents to the federal government. The 447-page Notice of Proposed Rulemaking (NPRM) has been released and is open for public feedback through the Federal Register. CISA was required to develop this report by the Cyber Incident Reporting for Critical Infrastructure Act of…

Recent developments and updates in Biden cyber policy

3 min read - The White House recently released its budget for the 2025 fiscal year, which supports the government’s commitment to cybersecurity. The cybersecurity funding allocations line up with the FY 2025 cybersecurity spending priorities released last year that included the following pillars: Defend critical infrastructure Disrupt and dismantle threat actors Shape market forces to drive security and resilience Invest in a resilient future Forge international partnerships to pursue shared goals. In 2023, the White House released a 35-page document detailing the new…

Change Healthcare cyberattack causes dire billing crisis

3 min read - Last month’s cyberattack on Change Healthcare, a sizable unit of UnitedHealth Group, brought new repercussions rarely seen in a cyberattack. As a result of the threat actor’s actions, healthcare systems and providers suffered cash flow issues, which resulted in providers being unable to pay their rent, owners dipping into their personal savings and patients being prevented from receiving important medications. Most importantly, patients are unable to get insurance approval for procedures, surgeries and prescriptions, which can affect their health outcomes.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today