الرئيسية / ENGLISH / Lockdown does not mean vacation: APT groups continue to update and diversify their arsenal

Lockdown does not mean vacation: APT groups continue to update and diversify their arsenal

2020 is the year when nothing is the same and yet life goes on, for
cybercriminals and APT groups alike. The COVID-19 pandemic is actively used
as bait for many campaigns, large and small. Kaspersky researchers have
seenthe continued development of APT arsenals on different fronts – from
targeting new platforms and active vulnerability exploitation to shifting to
new tools entirely. These and other APT trends from across the world are
covered in Kaspersky’s latest quarterly threat intelligence summary.
 
A three-month APT trends summary for the last quarter is based on
Kaspersky’s private threat intelligence research, as well as other sources that cover the major developments the company’s researchers believe corporate
sector should be aware of.
In Q2 2020, Kaspersky researchers observed multiple developments in the
TTPs of APT groupsacross the world. The most significant changes were
implemented by the following groups:
• The Lazarus group, which has been a major threat actor for several
years,now is investing even further in attacks for financial gain. Alongside
goals like cyber-espionage and cyber-sabotage, this threat actor has targeted
banks and other financial companies around the globe. This quarter,
Kaspersky researchers were also able to identify that Lazarus started
operating ransomware– an atypical activity for an APT group – using a multi-
platform framework called MATA to distribute the malware. Previously,
Lazarus has been associated with the infamous WannaCry attack.
• CactusPete, a Chinese-speaking threat actor, now commonly uses
ShadowPad – a complex, modular attack platform that features pluginsand
modules for diverse functionalities. ShadowPad has been previously deployed
in a number of major cyber-attacks, with a different subset of plugins used in different attack cases.
• The MuddyWater APT was discovered in 2017 and has been active in the
Middle East ever since. In 2019, Kaspersky researchers reported activity against telecommunication companies and governmental organizations in the
Middle East. Kaspersky recently discovered MuddyWater using a new C++ toolchain in a new wave of attacks in which the actor leveraged an open-
source utility called Secure Socket Funneling for lateral movement.
• The HoneyMyte APT carried out a watering hole attack on the website of a
Southeast Asian government. This watering hole, set up in March, seemed to
leverage whitelisting and social engineering techniques to infect its targets.
The final payload was a simple ZIP archive containing a “readme” file inciting
the victim to execute a CobaltStrike implant. The mechanism used to execute
Cobalt Strike was DLL side-loading, which decrypted and executed a
CobaltStrike stager shellcode.
• OceanLotus, the theat actor behind the advanced PhantomLance mobile
campaign, has been using new variants of its multi-stage loader since the second half of 2019. The new variants use target-specific information
(username, hostname, etc.) of the targeted host that they obtained beforehand in order to ensure their final implant is deployed on the right
victim. The group continues to deploy its backdoor implant, as well as Cobalt Strike Beacon, configuring them with an updated infrastructure.
“The threat landscape isn’t always full of “groundbreaking” events, yet cybercriminal activity definitely has not been put on hold over the past few months. We see that the actors continue to invest in improvementsto their toolsets, diversify attack vectors and even shift to new types of targets. For instance, the use of mobile implants is no longer a novelty. Another trend we see is the move towards financial gain by some APT groups, such as BlueNoroff and Lazarus. Yet, geo-politics remain an important motive for many threat actors too,” comments Vicente Diaz, security researcher, Global Research and Analysis Team, Kaspersky. “All these developments only highlight the importance of investing in threat landscape intelligence. Cybercriminals do not stop at what they have achieved already but continually develop new TTPs – and so should those who want to protect themselves and their organizations from attack”.
The Q2 APT trends report summarizes the findings of Kaspersky’s subscriber-only threat intelligence reports, which also include Indicators of Compromise (IoC) data and YARA rules to assist in forensics and malware hunting. For more information, please contact: [email protected]
In order to avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky researchers recommend implementing the following measures:
• Provide your SOC team with access to the latest threat intelligence (TI). Kaspersky Threat Intelligence Portal is a single point of access for the company’s TI, providing cyber-attack data and insights gathered by Kaspersky over more than 20 years. Free access to its curated features that allow users to check files, URLs, and IP addresses is available here.
• For endpoint level detection, investigation and timely remediation of incidents, implement EDR solutions such as Kaspersky Endpoint Detection and Response.
• In addition to adopting essential endpoint protection, implement a corporate-grade security solution that detects advanced threats on the network level at an early stage, such as Kaspersky Anti Targeted Attack Platform.
• As many targeted attacks start with phishing or other social engineering techniques, introduce security awareness training and teach practical skills – for example through theKaspersky Automated Security Awareness Platform

شاهد أيضاً

Ericsson

Ericsson accelerates 5G for Enterprise with acquisition of Cradlepoint

Ericsson has agreed to acquire Cradlepoint, the US-based market leader in Wireless Edge WAN 4G …

اترك تعليقاً

لن يتم نشر عنوان بريدك الإلكتروني. الحقول الإلزامية مشار إليها بـ *