Five Eyes Agencies Expose APT29’s Evolving Cloud Attack Tactics

Cybersecurity and intelligence organizations from the 5 Eyes nations have introduced a joint advisory detailing the evolving techniques of the Russian state-sponsored menace actor recognised as APT29.

The hacking outfit, also regarded as BlueBravo, Cloaked Ursa, Cozy Bear, Midnight Blizzard (formerly Nobelium), and The Dukes, is assessed to be affiliated with the International Intelligence Assistance (SVR) of the Russian Federation.

Formerly attributed to the offer chain compromise of SolarWinds program, the cyber espionage team attracted awareness in new months for targeting Microsoft, Hewlett Packard Enterprise (HPE), and other businesses with an aim to further more their strategic aims.

“As businesses continue to modernize their systems and shift to cloud-based mostly infrastructure, the SVR has tailored to these adjustments in the working environment,” in accordance to the security bulletin.

These consist of –

• Obtaining obtain to cloud infrastructure by way of support and dormant accounts by indicates of brute-drive and password spraying assaults, pivoting absent from exploiting computer software vulnerabilities in on-premise networks

• Making use of tokens to entry victims’ accounts without the need of the require for a password

• Leveraging password spraying and credential reuse tactics to seize manage of private accounts, use prompt bombing to bypass multi-factor authentication (MFA) necessities, and then registering their personal system to acquire entry to the network

• Earning it more durable to distinguish destructive connections from regular end users by employing residential proxies to make the malicious targeted visitors appear as if it’s originating from IP addresses in just internet assistance service provider (ISP) ranges utilised for household broadband clients and conceal their legitimate origins

“For corporations that have moved to cloud infrastructure, the 1st line of defense in opposition to an actor these as SVR really should be to protect towards SVR’ TTPs for first obtain,” the agencies reported. “The moment the SVR gains preliminary accessibility, the actor is able of deploying extremely advanced write-up compromise abilities such as MagicWeb.”

Found this write-up attention-grabbing? Comply with us on Twitter  and LinkedIn to read far more exclusive written content we put up.

Some parts of this article are sourced from:
thehackernews.com