Cell division Flashcards
Current or former employee, contractor, or other business partner who has or had authorized access to an organization’s network, system, or data and intentionally misused the access to negatively affect the CIA of the organization’s data or information systems.
Insider threat
4 insider threat methods
Steal sensitive data via storage devices
Open backdoors
Logic bombs
Attack internal resources
Insider threat detection and prevention techniques
Data/File encryption DLP Data access monitoring Data redaction Data access control
Discretional access control
Only users specified by the owner may have some combination of read, write, and execute rights to file
Mandatory access control
Access control policy decisions are made by a central authority, not by the individual owner of an object, and the owner cannot change access rights
Direct remote attacks
Attack delivered via wifi, ethernet, rf or bluetooth
Drive by attack
Malware automatically downloads to user’s system after visiting legitimate, but compromised website
Attacks on south korea
DarkSeoul Gang
North Korea state sponsored threats
TTPs include weaponized email attachments
Human intelligence usage
Russian state sponsored threats
Russian attributed malware
Zeus Gozi SpyEye SpyZeus Ligats Trojans
Vietnamese govt suspected
Poses threat to companies doing business, manufacturing or preparing to invest in the country
APT32
APTs associated with China
30, 18, 17, 12, 3, 1
APTs associated with Russia
29, 28
Attributes of an APT
Loads malicious software directly into a computer’s memory in a way that bypasses HD
Uses blackcoffee malware as part of the first stage of its attacks
APT 17 - China
Attributes of an APT -
Major data breach at community health systems
Exploited “Heartbleed” bug in VPN server within CHS network
Gh0st remote access trojan (RAT)
APT 18 - China
Attributes of an APT -
Components designed to infect removable drives in order to cross air-gapped networks and steal data
Steal sensitive political, economic and military info about region for gov espionage
Associated malware: Backspace Neteagle Shipshape Spaceship Flashfood
APT 30 - China
Attributes of an APT -
Only compromised servers for C2 communication
Associated malware:
Hammertoss
Uploader
tDiscover
APT 29 - Russia
Associated malware - Chopstick, Sourface
Targets former Soviet state and NATO
Gain insider info related to govts, militaries and security organizations
APT 28 - Russia
Maintain surveillance on media outlets that could impact reputation of Chinese leaders
Targets: Western journalists, US military contractors, Taiwanese and Japanese govts, Japanese tech companies
Associated malware- Riptide, hightide, threebyte and waterspout
Most clandestine, discriminating, skilled Chinese group
Adapts tools/techniques based on news reports about itself
APT 12 - China
Associated malware - Leouncia
Tends to focus on sat telecoms and tech companies based primarily in SE Asia
APT 5 - Undisclosed
Main actor behind a major attack campaign: Op Clandestine Fox
Associated malware: Shotput, cookiecutter, and Plugx/sogu
APT 3 - China
Systematically stole hundreds of TB of data from at least 141 organizations spanning 20 major industries
Specifically targets industries that China identifies as strategic in its 5 year plan
Associated malware:
Backdoor.(random names)
Steals broad categories of intellectual property
APT 1 - China
Agents that make use of cyberspace resources for intel collection
Cyberspace espionage agent
1 of the critical infrastructure protocols in internet traffic flow
Can be manipulated to route traffic from 1 country to another
Border gateway protocol threat
Exploits affect info and communication technology devices, which are manufactured, assembled, and distributed from a multitude of individual component and through numerous distributors
Operations affect hardware, software, and firmware components
Supply chain threat
High performing computing (Russia has 6 HPC systems capable of trillion computations per second)
Quantum computing: Are aggressively pursuing implementations for secure quantum communication protocols
Advanced computing technologies
Generated bi-weekly by the 624th Ops Center
Designed to keep AF members up to date on current threats
Strengthens SA of threats that could affect AF personnel/systems
Cyber threat bulletin
Annual report which uses insights, statistics, and case studies to show how tools and tactics of APT actors evolved since 2014
Mandiant’s annual cyber threat report
Worldwide team of security engineers, threat analysts, and researchers who develop a variety of content on the latest threats that impact organizations and end users
(Annual threat report, monthly threat report, white papers)
Symantec security response publications
Report that resulted in analytic efforts between DHS and FBI
USG confirmed 2 RIS actors (APT 29 and APT 28) participated in intrusion against US political party
Referred to GRIZZLY STEPPE
JAR-16-20296A
Joint Analysis Report
Adversaries transition through 5 phases starting with 0 - 4
Administer - Intent and resource development
Prepare - Recon and staging
Engage - Delivery and Exploitation
Propagate - Internal recon, lateral movement, and network persistence
Effect - Exfil and attack
Phase 0
Administer
resource development and tasking
Phase 1
Prepare
recon and staging
Phase 2
Engage
delivery and Exploitation
Phase 3
Propagate
internal recon, lateral movement, and network persistence
Phase 4
Effect
exfil and attack
