DHS Warns of Attack That Can Result in Complete Network Access

The Department of Homeland Security (DHS) is warning of a potentially serious attack aimed at several industries including IT and managed service providers (MSP), healthcare, energy, communications, public health, and critical manufacturing. While this attack has been around since May of last year, it has renewed steam, causing DHS to issue the most recent warning. This attack can cause a situation in which full access to networks and data can be gained if it is successful.

The National Cybersecurity and Communications Integration Center (NCCIC) also knows of several compromises “involving the exploitation of system administrators’ credentials to access trusted domains as well as the malicious use of certificates. Additionally, the adversary makes heavy use of PowerShell and the open source PowerSploit tool to enable assessment, reconnaissance and lateral movement.”

One tool being used is RedLeaves. Malware is placed on the network and can gather and send to the command and control center (C2):

• System name
• System architecture information
• Major and minor versions of the operating systems
• Processor specifications
• Language of the user
• Privileges and current processes
• Current user’s group permissions
• System uptime
• IP address
• Primary drive storage utilization
• File names, write times, and file sizes

The other malware being seen is PlugX Remote Administration Tool (RAT). It’s been around since 2012 and has the following characteristics:

1. A non-malicious executable that is used to start the installation process for the RAT.
2. A malicious DLL/installer that decodes and installs the PlugX RAT.
3. The encoded payload, PlugX RAT, that allows the attacker to capture screenshots and download files.

NCCIC is encouraging all targeted organizations to take a look at their infrastructures to determine if any activity can be seen that may be related to this attack. In addition, administrators should monitor network traffic for any other indicators of this and keep software updated with the latest patches.

It is recommended that all organizations, regardless of industry, size, or clientele have a layered security approach in addition to ensuring the basic security tools are employed. These basic tools included firewalls, IDS/IPS, antimalware and antivirus software on all network devices, VPNs on all remote machines and devices. In addition, networks should be segmented, data should be backed up regularly, and all users should be required to have complex passwords that get changed regularly. Other recommendations from NCCIC include, but are not limited to:

• A regular patch program
• Deploying multifactor authentication (MFA) for all users
• Reducing domain and administrator accounts
• Regular vulnerability scans and mitigation
• Directory whitelisting

This recent attack is being attributed to the Chinese cyber espionage group APT10, which is also known as CVNX, Stone Panda, MenuPass, and POTTASSIUM. According to DHS, the activity of this group “seems to have increased in mid-2016 and has focused on compromise of MSPs as a stepping stone into victim organizations.” APT10 has been tracked by the security firm FireEye since 2009.