As events continue to deteriorate in Ukraine, the full geopolitical impact remains unclear, especially in the cyber realm. CISA (Cybersecurity and Infrastructure Security Agency) reports that while there are no specific or credible threats to the US at this time, Russia may consider taking retaliatory action in response to sanctions that may impact business and critical infrastructure in the US. Therefore, CISA and the global intelligence community recommend organizations adopt a heightened, vigilant posture and immediately take additional steps to harden defenses and improve resiliency. PacketWatch is providing actionable steps organizations can take to safeguard themselves during this time.
The Russian government has a proven history of escalating and taking actions to destabilize its perceived adversaries outside of their initially targeted country. The Russian government has demonstrated ability to conduct hybrid warfare combining kinetic and cyber elements for maximum disruption. The Russian government may conduct these cyber activities by its military units, through its intelligence organizations or more commonly through sponsored advanced persistent threat (APT) actors.
Historically, these APT actors have used common yet effective tactics to gain initial access to targeted networks including spear phishing, brute-force attacks, and exploits of common vulnerabilities. These APT actors utilize sophisticated tradecraft and advanced cyber capabilities to compromise third-party software and infrastructure and by developing and deploying custom malware. Typically, these actors maintain persistent, undetected, long-term access in a compromised network and cloud environments often using legitimate credentials.
Based on knowledge of historical TTPs utilized by these APT actors, organizations should take the following steps to increase organizational readiness:
Enhance network monitoring and visibilityOn the morning of February 25th, 2022, the Conti ransomware team sent out a warning on their news page announcing the full support of the Russian government saying:
“The Conti Team is officially announcing a full support of Russian government. If anybody will decide to organize a cyberattack or any war activities against Russia, we are going to use our all possible resources to strike back at the critical infrastructures of an enemy. [sic]”
Conti is Ransomware-as-a-Service that has been used against major corporations and government agencies in North America. In typical ransomware attacks, the actors exfiltrate files, encrypt servers and workstations, and demand a ransom payment.
State-sponsored Russian APT actors are extremely proficient at their trade. Experienced security professionals are available to help. Additional resources are also available from CISA, the FBI, NSA, and others. Although this may seem overwhelming, you need to act now to protect your organization. If you need clarification or assistance in adopting any of the recommendations above, please contact us at info@packetwatch.com or visit PacketWatch at https://packetwatch.com. A member of our team will follow up with you.
Stay tuned.
INFORMATION PRODUCT CAVEAT: The information in this product is provided “as-is.” It is not yet finally evaluated intelligence and should be considered raw information that is provided strictly for situational awareness, give what is known at this time.