APT29 Exploited a Windows Feature to Compromise European Diplomatic Entity Network

The Russia-connected APT29 country-point out actor has been discovered leveraging a “lesser-acknowledged” Windows element referred to as Credential Roaming as portion of its attack in opposition to an unnamed European diplomatic entity.

“The diplomatic-centric concentrating on is constant with Russian strategic priorities as perfectly as historic APT29 targeting,” Mandiant researcher Thibault Van Geluwe de Berlaere said in a technological generate-up.

APT29, a Russian espionage group also known as Cozy Bear, Iron Hemlock, and The Dukes, is known for its intrusions aimed at collecting intelligence that align with the country’s strategic targets. It is considered to be sponsored by the International Intelligence Services (SVR).

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Some of the adversarial collective’s cyber routines are tracked publicly under the moniker Nobelium, a menace cluster responsible for the popular provide chain compromise by means of SolarWinds software package in December 2020.

The Google-owned danger intelligence and incident response agency claimed it recognized the use of Credential Roaming throughout the time APT29 was present inside the target network in early 2022, at which place “quite a few LDAP queries with atypical attributes” were being carried out against the Lively Listing procedure.

Released in Windows Server 2003 Support Pack 1 (SP1), Credential Roaming is a system that enables users to accessibility their credentials (i.e., non-public keys and certificates) in a protected fashion across diverse workstations in a Windows domain.

Investigating its interior workings even further, Mandiant highlighted the discovery of an arbitrary file write vulnerability that could be weaponized by a threat actor to attain remote code execution in the context of the logged-in victim.

The shortcoming, tracked as CVE-2022-30170, was addressed by Microsoft as element of Patch Tuesday updates transported on September 13, 2022, with the enterprise emphasizing that exploitation demands a consumer to log in to Windows.

“An attacker who efficiently exploited the vulnerability could obtain distant interactive logon legal rights to a device exactly where the victim’s account would not typically hold such privilege,” it famous.

Mandiant explained the research “offers insight into why APT29 is actively querying the similar LDAP attributes in Active Directory,” urging companies to utilize the September 2022 patches to protected against the flaw.

Discovered this report interesting? Adhere to THN on Facebook, Twitter  and LinkedIn to go through more distinctive articles we article.