A public institutions attack campaign has been linked to the TA428 group, with industrial organizations, design bureaus, research institutes and ministries in Belarus, Russia, Ukraine and Afghanistan as targets. It begins with phishing emails carrying Word documents that exploit CVE-2017-11882 and ends with the attackers taking over the domain controller and copying documents.
What did the campaign against public institutions target?
A new attack campaign targeting defense industry organizations and public institutions in various countries have been detected. Due to the overlap of techniques, tactics, and procedures (TTPs) used, the attack attributed to the TA428 APT group targets industrial facilities, design bureaus, research institutes, government agencies, and ministries in various Eastern European countries (Belarus, Russia, and Ukraine) as well as Afghanistan.
How does the attack start?
The attack starts with the distribution of phishing emails created by threat actors using internal data of the targeted organization to the targets. Microsoft Word documents attached to phishing emails contain malicious code that exploits the CVE-2017-11882 vulnerability. The vulnerability allows threat actors to execute arbitrary code on the vulnerable system through the PortDoor Backdoor malware once the user opens the malicious document. A new variant of PortDoor Backdoor was detected in this campaign. The latest version PortDoor collects data from the infected system and sends it to command and control (CnC) servers controlled by threat actors. In addition, it was observed that backdoor malware such as nccTrojan, Logtu, Cotx, and DNSep was also used in the attack.
- Phishing emailBuilt with internal data of the targetTechnique T1566.001 (MITRE ATT&CK, opens in a new tab)
- Word documentExploits CVE-2017-11882Technique T1203 (MITRE ATT&CK, opens in a new tab)
- PortDoor backdoorCollects data and sends it to the CnC servers
- Lateral movementLadon helps spread through the network
- Domain controllerCaptured, then documents and files are taken
How do the attackers spread through the network?
Threat actors, who first gain access to the targeted system, try to distribute malware to other computers in the corporate network in later stages. For this purpose, Ladon malware, which Chinese-origin threat actors frequently use, helps TA428 threat actors to carry out Lateral Movement activities in the target network. The final stage of the attack includes capturing the target organization’s domain controller by threat actors and acquiring critical documents and files from all workstations and servers of the organization.
How can organizations protect themselves from this campaign?
This attack campaign demonstrates that spear phishing attacks remain one of the critical threats to industrial businesses and public institutions. Therefore, industrial organizations and public institutions must take a proactive cybersecurity stance to prevent such attacks successfully. In this context, it is recommended to consider the following security practices to avoid being the target of this and similar phishing or malware campaigns.
- Emails, attachments, and links from unknown, suspicious parties should not be respected.
- File/program or application downloads should be from legitimate and reliable sources.
- The installed system, program, or applications should be used in the current versions where the vulnerabilities are fixed.
- Comprehensive Anti-Virus/Anti-Malware security solutions should be used.
- Institution/organization personnel should be aware of potential phishing/social engineering attacks.
- IOC findings related to the campaign should be blocked from security solutions.