Feds Alert on Russian Cyber Activity Targeting ICS

Thursday, March 15, 2018 @ 03:03 PM gHale

By Gregory Hale
Russian government cyber activity targeting the energy and other critical infrastructure sectors is increasing to the degree where the U.S. government issued a joint alert warning Thursday for the manufacturing automation sector of the ongoing threat.

The joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) where it provides information on Russian government actions targeting U.S. Government entities as well as organizations in the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors.

RELATED STORIES
Hacking Robots with Ease
ARC: Holistic Plan to Secure Safety
Siemens, Partners Ink Cybersecurity Charter
Safety System Attack: Plan to Wake Up Industry

It also contains indicators of compromise (IoCs) and technical details on the tactics, techniques, and procedures (TTPs) used by Russian government cyber actors on compromised victim networks. DHS and FBI created the alert to educate network defenders to enhance their ability to identify and reduce exposure to malicious activity.

DHS and FBI characterize this activity as a multi-stage intrusion campaign by Russian government cyber actors who targeted small commercial facilities’ networks where they staged malware, conducted spear phishing, and gained remote access into energy sector networks. After obtaining access, the Russian government cyber actors conducted network reconnaissance, moved laterally, and collected information pertaining to Industrial Control Systems (ICS), according to the alert.

“This news is not surprising,” said Emily Miller, director of national security and critical infrastructure programs at ‎Mocana Corporation. “We’ve known about Russian meddling since 2015. Based on the preponderance of publicly identified campaigns in the last year such as DragonFly, NotPetya, WannaCry, Crash Override and Black Energy 2.0, we know that threat actors, including Russia, are attempting to target U.S. critical infrastructure. 

“DHS and FBI released an alert that points to the DragonFly 2.0 campaign that targeted the Western energy sector since last year. The alert confirms that vulnerabilities have been identified in domain controllers, file servers, and email servers that have been targeted for reconnaissance purposes, but it doesn’t specifically point to a confirmed impact on the availability of the electric grid.”

“It’s significant that US-CERT has specifically named the Russian government as being behind these attacks,” said Ray DeMeo, co-founder and chief operating officer a security provider, Virsec. “It’s also startling to hear Secretary Perry say he is ‘not confident’ that the US government has an adequate defensive strategy in place.

“But these types of attacks are hardly new or surprising to security experts. There has been a huge increase in targeted reconnaissance, pivoting and stealthy attacks aimed at industrial control systems. We should expect nation-state hackers from multiple countries to be exploiting gaps in security, and our critical infrastructure is definitely vulnerable. We can’t wait for governments to act – every business touching sensitive or dangerous infrastructure needs to up their game in detecting advanced attacks and shutting them down as quickly as possible,” DeMeo said.

Since at least March 2016, Russian government threat actors targeted government entities and multiple U.S. critical infrastructure sectors, including the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors, according to the report.

Analysis by DHS and FBI, resulted in the identification of distinct indicators and behaviors related to this activity.

The edited graphic shows threat actors accessed workstations and servers on a corporate network that contained data output from control systems within energy generation facilities. The actors accessed files pertaining to ICS or supervisory control and data acquisition (SCADA) systems.
Graphic by DHS

The campaign comprises two distinct categories of victims: Staging and intended targets. The initial victims are peripheral organizations such as trusted third-party suppliers with less secure networks, referred to as “staging targets.” The threat actors used the staging targets’ networks as pivot points and malware repositories when targeting their final intended victims. NCCIC and FBI judge the ultimate objective of the actors is to compromise organizational networks, also referred to as the “intended target.”

The threat actors in this campaign employed a variety of TTPs, including:
• Spear-phishing emails (from compromised legitimate account)
• Watering-hole domains
• Credential gathering
• Open-source and network reconnaissance
• Host-based exploitation
• Targeting industrial control system (ICS) infrastructure

Cyber Kill Chain Model
DHS used the Lockheed-Martin Cyber Kill Chain model to analyze, discuss, and dissect malicious cyber activity. Phases of the model include reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on the objective. This section will provide a high-level overview of threat actors’ activities within this framework.

Stage 1: Reconnaissance
The threat actors appear to have deliberately chosen the organizations they targeted, rather than pursuing them as targets of opportunity. Staging targets held preexisting relationships with many of the intended targets. DHS analysis identified the threat actors accessing publicly available information hosted by organization-monitored networks during the reconnaissance phase. Based on forensic analysis, DHS assessed the threat actors sought information on network and organizational design and control system capabilities within organizations. These tactics are commonly used to collect the information needed for targeted spear-phishing attempts. In some cases, information posted to company websites, especially information that may appear to be innocuous, may contain operationally sensitive information. As an example, the threat actors downloaded a small photo from a publicly accessible human resources page. The image, when expanded, was a high-resolution photo that displayed control systems equipment models and status information in the background.

Analysis also revealed the threat actors used compromised staging targets to download the source code for several intended targets’ websites. Additionally, the threat actors attempted to remotely access infrastructure such as corporate web-based email and virtual private network (VPN) connections.

Stage 2: Weaponization
Spear-Phishing Email TTPs: Throughout the spear-phishing campaign, the threat actors used email attachments to leverage legitimate Microsoft Office functions for retrieving a document from a remote server using the Server Message Block (SMB) protocol. As a part of the standard processes executed by Microsoft Word, this request authenticates the client with the server, sending the user’s credential hash to the remote server before retrieving the requested file. After obtaining a credential hash, the threat actors can use password-cracking techniques to obtain the plaintext password. With valid credentials, the threat actors are able to masquerade as authorized users in environments that use single-factor authentication.

Use of Watering Hole Domains: One of the threat actors’ primary uses for staging targets was to develop watering holes. Threat actors compromised the infrastructure of trusted organizations to reach intended targets. Approximately half of the known watering holes are trade publications and informational websites related to process control, ICS, or critical infrastructure. Although these watering holes may host legitimate content developed by reputable organizations, the threat actors altered websites to contain and reference malicious content. The threat actors used legitimate credentials to access and directly modify the website content. The threat actors modified these websites by altering JavaScript and PHP files to request a file icon using SMB from an IP address controlled by the threat actors. This request accomplishes a similar technique observed in the spear-phishing documents for credential harvesting. In one instance, the threat actors added a line of code into the file “header.php,” a legitimate PHP file that carried out the redirected traffic.

Stage 3: Delivery
When compromising staging target networks, the threat actors used spear-phishing emails that differed from previously reported TTPs. The spear-phishing emails used a generic contract agreement theme (with the subject line “AGREEMENT & Confidential”) and contained a generic PDF document titled “document.pdf. (Note the inclusion of two single back ticks at the beginning of the attachment name.) The PDF was not malicious and did not contain any active code. The document contained a shortened URL that, when clicked, led users to a website that prompted the user for email address and password.

In previous reporting, DHS and FBI noted all these spear-phishing emails referred to control systems or process control systems. The threat actors continued using these themes specifically against intended target organizations. Email messages included references to common industrial control equipment and protocols. The emails used malicious Microsoft Word attachments that appeared to be legitimate résumés or curricula vitae (CVs) for industrial control systems personnel, and invitations and policy documents to entice the user to open the attachment.

Stage 4: Exploitation 
The threat actors used distinct and unusual TTPs in the phishing campaign directed at staging targets. Emails contained successive redirects to http://bit[.]ly/2m0x8IH link, which redirected to http://tinyurl[.]com/h3sdqck link, which redirected to the ultimate destination of http://imageliners[.]com/nitel. The imageliner[.]com website contained input fields for an email address and password mimicking a login page for a website.

When exploiting the intended targets, the threat actors used malicious .docx files to capture user credentials. The documents retrieved a file through a “file://” connection over SMB using Transmission Control Protocol (TCP) ports 445 or 139. This connection is made to a command and control (C2) server — either a server owned by the threat actors or that of a victim. When a user attempted to authenticate to the domain, the C2 server was provided with the hash of the password. Local users received a graphical user interface (GUI) prompt to enter a username and password, and the C2 received this information over TCP ports 445 or 139.

Stage 5: Installation 
The threat actors leveraged compromised credentials to access victims’ networks where multi-factor authentication was not used. To maintain persistence, the threat actors created local administrator accounts within staging targets and placed malicious files within intended targets.

Stage 6: Command and Control
The threat actors commonly created web shells on the intended targets’ publicly accessible email and web servers. The threat actors used three different filenames (“global.aspx, autodiscover.aspx and index.aspx) for two different webshells. The difference between the two groups was the “public string Password” field.

Stage 7: Actions on Objectives 
DHS and FBI identified the threat actors leveraging remote access services and infrastructure such as VPN, RDP, and Outlook Web Access (OWA). The threat actors used the infrastructure of staging targets to connect to several intended targets.

DHS and the FBI said the campaign has affected multiple organizations in the energy, nuclear, water, aviation, construction, and critical manufacturing sectors.



Leave a Reply

You must be logged in to post a comment.