Russian APT28 Hackers Targeting High-Value Orgs with NTLM Relay Attacks

Russian point out-sponsored actors have staged NT LAN Supervisor (NTLM) v2 hash relay attacks through a variety of methods from April 2022 to November 2023, focusing on significant-benefit targets throughout the world.

The attacks, attributed to an “intense” hacking crew named APT28, have set their eyes on corporations working with international affairs, electricity, protection, and transportation, as effectively as those associated with labor, social welfare, finance, parenthood, and neighborhood town councils.

Cybersecurity agency Trend Micro assessed these intrusions as a “price-effective method of automating tries to brute-power its way into the networks” of its targets, noting the adversary may perhaps have compromised thousands of email accounts above time.

APT28 is also tracked by the broader cybersecurity local community beneath the names Blue Athena, BlueDelta, Extravagant Bear, Fighting Ursa, Forest Blizzard (previously Strontium), FROZENLAKE, Iron Twilight, ITG05, Pawn Storm, Sednit, Sofacy, and TA422.

The team, thought to be energetic considering the fact that at the very least 2009, is operated by Russia’s GRU military services intelligence services and has a track report of orchestrating spear-phishing containing malicious attachments or strategic web compromises to activate the infection chains.

In April 2023, APT28 was implicated in attacks leveraging now-patched flaws in networking tools from Cisco to conduct reconnaissance and deploy malware from pick targets.

The nation-condition actor, in December, arrived below the highlight for exploiting a privilege escalation flaw in Microsoft Outlook (CVE-2023-23397, CVSS score: 9.8) and WinRAR (CVE-2023-38831, CVSS score: 7.8) to obtain a user’s Net-NTLMv2 hash and use it to phase an NTLM Relay attack in opposition to a further assistance to authenticate as the consumer.

An exploit for CVE-2023-23397 is said to have been employed to goal Ukrainian entities as early as April 2022, according to a March 2023 advisory from CERT-EU.

It has also been noticed leveraging lures similar to the ongoing Israel-Hamas war to aid the delivery of a tailor made backdoor identified as HeadLace, together with putting Ukrainian authorities entities and Polish companies with phishing messages designed to deploy backdoors and facts stealers like OCEANMAP, MASEPIE, and STEELHOOK.

A single of the significant areas of the threat actor’s attacks is the continuous try to strengthen its operational playbook, fine-tuning and tinkering with its ways to evade detection.

This contains the addition of anonymization layers these types of as VPN expert services, Tor, facts middle IP addresses, and compromised EdgeOS routers to carry out scanning and probing functions. Another tactic entails sending spear-phishing messages from compromised email accounts about Tor or VPN.

“Pawn Storm has also been using EdgeOS routers to ship spear-phishing emails, carry out callbacks of CVE-2023-23397 exploits in Outlook, and proxy credential theft on credential phishing sites,” security researchers Feike Hacquebord and Fernando Merces mentioned.

“Aspect of the group’s article-exploitation actions require the modification of folder permissions within the victim’s mailbox, primary to improved persistence,” the scientists said. “Using the victim’s email accounts, lateral motion is doable by sending extra malicious email messages from inside of the target group.”

It is really now not recognized if the menace actor them selves breached these routers, or if it is working with routers that had been currently compromised by a 3rd-party actor. That mentioned, no considerably less than 100 EdgeOS routers are approximated to have been contaminated.

Moreover, latest credential harvesting campaigns against European governments have utilised bogus login internet pages mimicking Microsoft Outlook that are hosted on webhook[.]web site URLs, a sample beforehand attributed to the group.

An Oct 2022 phishing marketing campaign, nonetheless, singled out embassies and other large-profile entities to provide a “simple” details stealer via emails that captured documents matching specific extensions and exfiltrated them to a cost-free file-sharing support named Maintain.sh.

“The loudness of the repetitive, frequently crude and aggressive strategies, drown out the silence, subtlety, and complexity of the initial intrusion, as effectively as the publish-exploitation actions that may possibly manifest as soon as Pawn Storm receives an first foothold in victim corporations,” the scientists reported.

The enhancement comes as Recorded Foreseeable future Information exposed an ongoing hacking marketing campaign undertaken by the Russian threat actor COLDRIVER (aka Calisto, Iron Frontier, or Star Blizzard) that impersonates researchers and lecturers to redirect potential victims to credential harvesting web pages.

Discovered this short article attention-grabbing? Stick to us on Twitter  and LinkedIn to browse extra distinctive material we put up.

Some areas of this report are sourced from:
thehackernews.com