APT29 Exploited a Windows Feature to Compromise European Diplomatic Entity Network

The Russia-linked APT29 nation-state actor has been found
leveraging a “lesser-known” Windows feature called Credential
Roaming as part of its attack against an unnamed European
diplomatic entity.

“The diplomatic-centric targeting is consistent with Russian
strategic priorities as well as historic APT29 targeting,” Mandiant
researcher Thibault Van Geluwe de Berlaere said^[1]
in a technical write-up.

APT29, a Russian espionage group also called Cozy Bear, Iron
Hemlock, and The Dukes, is known^[2]
for its intrusions aimed at collecting intelligence that align with
the country’s strategic objectives. It’s believed to be sponsored
by the Foreign Intelligence Service (SVR).

Some of the adversarial collective’s cyber activities are
tracked publicly under the moniker Nobelium^[3], a threat cluster
responsible for the widespread supply chain compromise through
SolarWinds software in December 2020.

The Google-owned threat intelligence and incident response firm
said it identified the use of Credential Roaming during the time
APT29 was present inside the victim network in early 2022, at which
point “numerous LDAP^[4]
queries with atypical properties” were performed against the Active
Directory system.

Introduced in Windows Server 2003 Service Pack 1 (SP1),
Credential Roaming is a mechanism^[5]
that allows users to access their credentials^[6] (i.e., private keys and
certificates) in a secure manner across different workstations in a
Windows domain.

Investigating its inner workings further, Mandiant highlighted
the discovery of an arbitrary file write vulnerability that could
be weaponized by a threat actor to achieve remote code execution in
the context of the logged-in victim.

The shortcoming, tracked as CVE-2022-30170^[7], was addressed by
Microsoft as part of Patch Tuesday updates^[8]
shipped on September 13, 2022, with the company emphasizing that
exploitation requires a user to log in to Windows.

“An attacker who successfully exploited the vulnerability could
gain remote interactive logon rights to a machine where the
victim’s account would not normally hold such privilege,” it
noted.

Mandiant said the research “offers insight into why APT29 is
actively querying the related LDAP attributes in Active Directory,”
urging organizations to apply the September 2022 patches to secure
against the flaw.