The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and the National Security Agency (NSA) released anadvisorythis week detailing how multiple nation-state hacking groups potentially targeted a Defense Industrial Base (DIB) sector organizations enterprise network as part of a cyber espionage campaign.

The joint advisory explains that the hacking groups used the open-source toolkit, Impacket, to gain a foothold within the environment, and the data exfiltration tool, CovalentStealer, to steal the victims sensitive data.

CISA observed the attacks between November 2021 and January 2022. They did not identify the victim organization.

During incident response activities, CISA uncovered that likely multiple [advanced persistent threat (APT)] groups compromised the organizations network, and some APT actors had longterm access to the environment, the advisory reads.

Some APT actors reportedly gained initial access to the organizations Microsoft Exchange Server as early as midJanuary 2021. Later, they returned and used Command Shell to learn about the organizations environment and to collect sensitive data before implanting two Impacket tools.

In April 2021, APT actors used Impacket for network exploitation activities, the advisory reads. From late July through midOctober 2021, APT actors employed a custom exfiltration tool, CovalentStealer, to exfiltrate the remaining sensitive files.

The security agencies recommended that organizations monitor logs for connections from unusual virtual private networks, suspicious account use, anomalous and known malicious command-line usage, and unauthorized changes to user accounts.

Continue reading here:
Anatomy of a DIB Hack: Feds Share Methods, Mitigations - MeriTalk