Suspected Russian Attackers Steal FireEye Red Team Tools

Security giant FireEye has been on the acquiring end of a refined, novel attack from nation state actors looking for facts on government shoppers, the business has unveiled.

CEO Kevin Mandia described in a blog write-up yesterday that the attackers have been in a position to accessibility some internal techniques but that there’s no proof so far they managed to exfiltrate consumer details or metadata collected by the firm’s threat intelligence techniques.

On the other hand, they did control to steal some of FireEye’s purple workforce applications, which it works by using to exam customers’ security.

“We are not confident if the attacker intends to use our crimson workforce instruments or to publicly disclose them. Yet, out of an abundance of caution, we have produced far more than 300 countermeasures for our consumers, and the local community at substantial, to use in order to lessen the likely impression of the theft of these resources,” Mandia explained.

“We have viewed no evidence to day that any attacker has used the stolen crimson crew instruments. We, as well as many others in the security community, will carry on to monitor for any these types of exercise.”

In accordance to a further site from the firm, these applications selection from straightforward scripts used for automating reconnaissance to complete frameworks that are similar to publicly out there choices like CobaltStrike and Metasploit.

Despite the fact that Mandia released handful of details of how attackers received a foothold in the networks of 1 of the world’s most large profile cybersecurity organizations, he did disclose that it was very likely to be a nation with “top-tier offensive abilities.

“This attack is diverse from the tens of countless numbers of incidents we have responded to all through the decades. The attackers tailored their environment-class capabilities precisely to focus on and attack FireEye,” he explained.

“They are remarkably trained in operational security and executed with discipline and focus. They operated clandestinely, utilizing approaches that counter security tools and forensic assessment. They applied a novel mixture of strategies not witnessed by us or our partners in the past.”

Stories have recommended with in close proximity to certainty that the attackers were being backed by the Russian point out. If which is the situation, it would phone to brain the Shadow Brokers attacks of 2016 which led to the capture of some strong NSA hacking equipment.

Rick Holland, CISO at Electronic Shadows, argued that the stolen red group tools, which are intended to mimic the behavior of menace actors, will supply the attackers with a further strategy to compromise federal government targets.

“They can reserve their top rated-tier instruments for ‘hard targets’ like the Division of Protection and possibly leverage these new equipment versus ‘soft targets’ like civilian authorities companies,” he included.

“The unknown burglars could use the stolen applications to imitate other countries’ tactics, incorporating a new layer to guard their real identities and intentions. Stealing these equipment also lowers operational costs as the nation state actors don’t have to build new program exploits and management applications for their intrusions.”

Some components of this report are sourced from:
www.infosecurity-journal.com