SolarWinds Hackers Targeting Government and Business Entities Worldwide

Nobelium, the threat actor attributed to the massive SolarWinds
supply chain compromise, has been once again linked to a series of
attacks targeting multiple cloud solution providers, services, and
reseller companies, as the hacking group continues to refine and
retool its tactics at an alarming pace in response to public
disclosures.

The intrusions, which are being tracked by Mandiant under two
different activity clusters UNC3004 and UNC2652, are both
associated with UNC2452, an uncategorized threat group^[1] that has since been tied
to the Russian intelligence service. UNC2652, in particular, has
been observed targeting diplomatic entities with phishing emails
containing HTML attachments with malicious JavaScript, ultimately
dropping a Cobalt Strike Beacon onto the infected devices.

“In most instances, post compromise activity included theft of
data relevant to Russian interests,” Mandiant researchers Luke
Jenkins, Sarah Hawley, Parnian Najafi, and Doug Bienstock said^[2]
in a new report. “In some instances, the data theft appears to be
obtained primarily to create new routes to access other victim
environments.”

The revelations come exactly a year after details^[3]
emerged^[4]
of a Kremlin-backed hacking campaign that breached the servers of
network management provider SolarWinds to distribute tainted
software binaries to a number of high-profile customers, including
nine U.S. federal agencies.

If anything, the development is yet another indication of the
threat actor’s capacity to continually “innovate and identify new
techniques and tradecraft to maintain persistent access to victim
environments, hinder detection, and confuse attribution efforts,”
while also highlighting the “effectiveness of leveraging third
parties and trusted vendor relationships to carry out nefarious
operations.”

Microsoft had previously dubbed^[5]
Nobelium as “skillful and methodic operators who follow operations
security (OpSec) best practices.”

Ever since the SolarWinds incident came to light, the APT group
has been connected^[6]
to a string^[7]
of attacks^[8]
aimed at think tanks, businesses, and government entities around
the globe, even as an ever-expanding malware toolbox has been put
to use with the goal of establishing a foothold in the attacked
system and downloading other malicious components.

In late October 2021, Microsoft took the wraps off an intrusion campaign^[9]
that compromised as many as 14 downstream customers of multiple
cloud service providers (CSP), managed service providers (MSP), and
other IT services organizations. The poisoning attacks worked by
breaking into the service providers, subsequently using the
privileged access and credentials belonging to these providers to
strike a wide range of organizations that relied on the CSPs.

Top-notch operational security and advanced tradecraft

Some of the other techniques incorporated by the group into its
playbook involve the use of credentials potentially obtained from
an info-stealer malware campaign staged by a third-party actor to
gain initial access to organizations, an infection chain that
resulted in the victims’ workstations infected with CryptBot
malware after browsing to low reputation websites offering cracked
software, corroborating a similar report from Red Canary^[10] published last
week.

Also employed by Nobelium is a new tool dubbed Ceeloader, a
bespoke downloader that’s designed to decrypt a shellcode payload
to execute in memory on the compromised system, as well as the
abuse of push notifications on smartphones to circumvent
multi-factor authentication (MFA) protections.

“In these cases, the threat actor had a valid username and
password combination,” the researcher said. “Many MFA providers
allow for users to accept a phone app push notification or to
receive a phone call and press a key as a second factor. The threat
actor took advantage of this and issued multiple MFA requests to
the end user’s legitimate device until the user accepted the
authentication, allowing the threat actor to eventually gain access
to the account.”

Other tactics of note include —

• Compromising multiple accounts within an environment and using
  each of those accounts for different functions to limit
  exposure,
• Using a combination of Tor, Virtual Private Servers (VPS) and
  public Virtual Private Networks (VPN) to access victim
  environments,
• Hosting second-stage payloads as encrypted blobs on legitimate
  websites running WordPress, and
• Using residential IP address ranges to authenticate to victim
  environments.

“This intrusion activity reflects a well-resourced threat actor
set operating with a high level of concern for operational
security,” the researchers said. “The abuse of a third party, in
this case a CSP, can facilitate access to a wide scope of potential
victims through a single compromise.”