November 30, 2022 By Jonathan Reed 2 min read

From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to an advanced cyberattack on a Defense Industrial Base (DIB) organization’s enterprise network.

During that time frame, advanced persistent threat (APT) adversaries used an open-source toolkit called Impacket to breach the environment and further penetrate the organization’s network. Even worse, CISA reported that multiple APT groups may have hacked into the organization’s network.

Data breaches such as these are almost always the result of compromised endpoints and privileged credentials. In this case, the abuse of user and admin privilege played a major role in the success of this attack. The APT group’s attack further proves that monitoring and protecting privileged accounts are crucial for strong security.

Evolution of the attack

In the first stages of the attack, APT actors gained access to the organization’s Microsoft Exchange Server as early as mid-January 2021. The initial access vector remains unknown. Based on log analysis, the actors collected information about the exchange environment and searched mailboxes — all within four hours after the initial breach.

Four days later, the APT actors used Windows Command Shell to study the organization’s environment and begin harvesting data. That exfiltrated data included sensitive contract-related information from shared drives.

At the same time, APT actors implanted Impacket in another system. Impacket is a Python toolkit for programmatically constructing and manipulating network protocols. By using this toolkit, the actors were also able to attempt to move laterally within the network.

Preventing abuse of privilege

One of the hallmarks of this attack was the abuse of privilege. Actors obtained and abused credentials of existing accounts as a means of executing Initial Access, Persistence, Privilege Escalation or Defense Evasion.

Given the actors’ proven capability to maintain persistent, long-term access in compromised enterprise environments, the CISA, FBI and NSA are encouraging organizations to monitor logs for connections from unusual VPSs and VPNs. This includes examining connection logs for access from unexpected ranges.

Organizations should also monitor for suspicious account use, such as inappropriate or unauthorized use of administrator accounts, service accounts or third-party accounts.

According to CISA, suspicious account use can appear as:

  • “Impossible logins” with changing usernames, user agent strings and IP address combinations or logins where IP addresses do not align with the expected user’s geographic location
  • Suspicious privileged account use after resetting passwords or applying user account mitigations
  • Unusual activity in typically dormant accounts
  • Unusual user agent strings, such as strings not typically associated with normal user activity, may indicate bot activity.

Privileged access management offers a solution

Successfully mitigating this type of APT attack is far more effective with privileged access management (PAM) solutions. By establishing least-privilege access on endpoints, unusual user activity can be detected faster. For example, if users access files that aren’t part of their usual work activity, least privilege methods can detect this, or, if a dormant account suddenly becomes active, PAM solutions can trigger an alert.

As illustrated by this DIB organization incident, local administrator rights are prime targets for cyber criminals. To thoroughly protect sensitive data, controls need to be in place that keep both endpoints and privileged credentials secure.

More from News

New memo reveals Biden’s cybersecurity priorities through fiscal year 2026

2 min read - On July 10, 2024, the White House released a new memo regarding the Biden administration’s cybersecurity investment priorities, initially proposed in July 2022. This new memorandum now marks the third time the Office of the National Cyber Director (ONCD), headed by Harry Coker, has released updated priorities and outlined procedures regarding the five core pillars of the National Cybersecurity Strategy Implementation Plan (NCSIP), now relevant through fiscal year 2026. Key highlights from the FY26 memorandum In the latest annual version…

Hackers are increasingly targeting auto dealers

3 min read - Update as of July 11, 2024 In late June, more than 15,000 car dealerships across North America were affected by a cyberattack on CDK Global, which provides software to car dealers. After two cyberattacks over two days, CDK shut down all systems, which caused delays for car buyers and disruptions for the dealerships. Many dealerships went back to manual processes, including handwriting up orders, so that sales could continue at a slower pace. Car buyers who recently bought a car from…

CISA director says banning ransomware payments is off the table

3 min read - The FBI, CISA and NSA all strongly advise against organizations making ransomware payments if they fall victim to ransomware attacks. If so, why not place a ban on paying ransomware demands? The topic came up at a recent Oxford Cyber Forum. Jen Easterly, Director of CISA, commented on the issue, saying, “I think within our system in the U.S. — just from a practical perspective — I don’t see it happening.” It’s unlikely this was a purely spontaneous remark as the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today