Historically, these APT actors have used common yet effective tactics to gain initial access to targeted networks including spear phishing, brute-force attacks, and exploits of common vulnerabilities. These APT actors utilize sophisticated tradecraft and advanced cyber capabilities to compromise third-party software and infrastructure and by developing and deploying custom malware. Typically, these actors maintain persistent, undetected, long-term access in a compromised network and cloud environments often using legitimate credentials.

Based on knowledge of historical TTPs utilized by these APT actors, organizations should take the following steps to increase organizational readiness:

• Enhance network monitoring and visibility
• Network Egress Points
• Monitor network perimeter egress points; examine outbound traffic for signs of anomalous activity (ports, locations, protocols).
• Restrict what ports/services can communicate to external resources.
• Network Ingress
• Geo-block where possible but understand limitations and downstream impacts.
• Ensure only assets serving specific business purposes are publicly exposed to the internet.
• Monitor egress and ingress communication from computer assets in the DMZ.

• Internal Network Hardening

• Network Segmentation
• Enforce strong segmentation between network zones to contain traffic.
• Restrict endpoint-to-endpoint communication.
• Monitor east – west traffic for anomalous activity.
• Restrict BYOD assets from access to production networks.
• Know your assets and what they access; Identify everything
• Update your inventory survey of hardware and software assets.
• Review your application control list.
• Hunt for unmanaged assets.
• Validate Security Controls
• Focus on updated controls for Endpoint, Server, Cloud security and Access Management.

• Harden Identity and Access Management practices

• Align and enforce password policies using an applicable framework/standard.
• Unprivileged users should not have privileged access, audit access and permissions.
• Implement Multi-Factor Authentication (MFA) across all networks, systems, applications, and resources.

• Ensure Vulnerabilities are identified and patched

• Scan for open vulnerabilities and patch/mitigate as directed.
• Update Vendor Solutions, Open-Source Software, and Operating Systems.
• Isolate vulnerable legacy systems.

• Ensure Proper Logging

• Increase levels of logging and ensure proper collection retention — especially on endpoints, servers, network devices and Cloud services.
• Review access logs for suspicious activity and impossible logons.
• Monitor for abused or malformed access tokens.
• Adopt best practices securing cloud services.

• Test and plan for improved resiliency

• Review / rehearse / test
• Continuity of Operations Planning (COOP) plans.
• Business Continuity / Disaster Recovery (BC/DR) plans.
• Incident Response (IR) plans.
• Ensure adequate staffing for longer duration workloads.
• Anticipate service disruptions and supply chain impacts.
• Establish alternate providers for mission critical services / providers.

• Reach out for assistance if needed

• Contact experienced security professionals for assistance in testing or implementing the above recommendations.
• If you believe you have been impacted already, contact your local FBI field office.

On the morning of February 25^th, 2022, the Conti ransomware team sent out a warning on their news page announcing the full support of the Russian government saying:  

“The Conti Team is officially announcing a full support of Russian government. If anybody will decide to organize a cyberattack or any war activities against Russia, we are going to use our all possible resources to strike back at the critical infrastructures of an enemy. [sic]”

Conti is Ransomware-as-a-Service that has been used against major corporations and government agencies in North America. In typical ransomware attacks, the actors exfiltrate files, encrypt servers and workstations, and demand a ransom payment. 

State-sponsored Russian APT actors are extremely proficient at their trade. Experienced security professionals are available to help. Additional resources are also available from CISA, the FBI, NSA, and others. Although this may seem overwhelming, you need to act now to protect your organization. If you need clarification or assistance in adopting any of the recommendations above, please contact us at info@packetwatch.com or visit PacketWatch at https://packetwatch.com. A member of our team will follow up with you.

Stay tuned.

——————/-