- [MC] Please join me in welcoming Robert Lipovsky.
(hands clapping)
- Thanks.
Great, hello everyone.
Thanks for that introduction.
It's a pleasure to be here.
So, the talk is going to be about
the most interesting techniques
of two infamous APT groups
that I think need no introduction.
Over the twelve years that I've working in ESET
doing malware research
I had the privilege of working
with some of the most skilled reverse engineers
and threat researchers,
so credit goes to them for some of the discoveries
that I'll be talking about in the presentation.
So, before we get to the main scope of ATT&CK,
as Katie said, just a really quick introduction
about how we use it.
So we started augmenting our threat reports,
not only with IOC's, but also attack mappings,
for example our wheel of security block posts.
This is what it looks like,
and this is just a snippet for this particular example
so the list is much longer,
but you can get an idea.
So there's the tactic, the technique and also an inscription
how that particular malware uses that technique.
Also for similar reasons and in a similar way
we are mapping attack in our EDR solutioning,
set enterprise inspector
whenever that was feasible and possible
because there's a varying level of granularity for that.
Okay, so those were the external uses
for improving the communication with our audiences,
whether it's our readers or our users,
leveraging the common taxonomy aspect of attack,
but we also use it internally
as one of the guides for enhancing enterprise inspector
and improving our analytics,
but I won't go into the details about that
because you've been hearing all about those things
at this conference or you might have read
the ATT&CK's great blog post on the subject
so they covered that really well.
Okay, so let's get to those APT's
and those interesting techniques.
Of course this is not going to be
a comprehensive listing at all.
That would make for a much, much longer presentation.
Just some highlights
which I thought were really interesting and noteworthy.
So the first group, and because of the lack of time
I just selected one particular software
that they were using.
That was APT28 or Fancy Bear or Sednit
and last year we found out
that they used the first UEFI rootkit found in the wild.
So this was a pretty significant deal.
Running code from the SPI flash memory
the first thing that runs when you start up your computer,
before Windows is loaded,
before any security software has a chance to load too,
that's a really powerful persistence mechanism
and gives the attackers an ability to withstand
not only complete wipe of the system
but even a hard drive replacement.
So they use this against attacks against,
in attacks against diplomatic targets in Europe.
You can read all of the details in the paper.
I'm not going to go into them.
I'll just mention that they drew their inspiration
from LoJack which was a legitimate piece
of antitheft solution for laptops,
and in an antitheft solution
this powerful persistence mechanism makes sense.
I mean if a thief was able to easily get rid of the solution
it wouldn't be a very good antitheft tool, would it?
Okay, so it's featured in ATT&CK
and listed under the system firmware technique.
There are some other examples over there,
but basically before LoJacks
UEFI rootkits were mostly in the realm
of theoretical proof of concepts,
or reported according to leaks,
reported functionality of government agencies
or the hacking team software.
Okay, lets move onto the second group
where we'll spend a little bit more time
looking at their techniques
and they're know under the umbrella term as Sandworm.
In our naming we go into a little bit
lower level of granularity
which stems from the way we were tracking them.
So the first threat cluster and activities
related to that was BlackEnergy,
I think needs no introduction here,
which facilitated their most infamous campaign
was that it facilitated the first ever power grid attacks,
black-outs caused by a cyber attack.
Then there was Industroyer,
also referred to some folks as Crash Override.
This was, I would say,
one of the most cunning pieces of malware we ever revealed
and the reason is that, not just it's modular,
but it's able to communicate
with industrial control systems hardware
using their very own language.
It had an implementation
of four different industrial protocols
so effectively this malware was bridging the gap
between IT and OT attacks.
We also saw a shift from BlackEnergy
to what we call TeleBots at some time.
So there were lot of things in common,
like shared infrastructure,
but the malware was different.
The reason why we called it that
was because they were using the telegram API
for command and control communication.
And not only the tools changed
but also the focus,
so it's really hard to conclusively say
that they are exactly the same people,
the same group behind it,
and the focus shifted from critical infrastructure
and the energy sector
towards the financial sector,
and their most famous attack
which spread beyond the borders of Ukraine,
worldwide was of course NotPetja,
and in parallel to the TeleBot activity
there was also GrayEnergy
which we consider the successor of BlackEnergy.
Staying with that original focus
of critical infrastructure and energy companies
and still active until today.
So that was just a quick overview of that group
and lets take a look at the techniques that they were using.
So for initial access they were mostly using Spearphising,
that's unsurprising,
with various methods of gaining execution,
whether it was pure social engineering
or they were also using exploits, even zero days.
But let's get to the more interesting
and not that common stuff.
So they did supply chain compromises.
The NotPetja, starting off from the infection of Medoc
so from Medoc actor as we call it,
that's the most widely known example,
but there are also other cases.
Another interesting technique was used by GreyEnergy
and that was exploiting a public facing application,
specifically it was trying to gain entry
inside a network via a vulnerable web server.
And a couple of other interesting notable techniques
by this group.
There were BlackEnergy plugins that were abusing TeamViewer.
So targeting specific versions of TeamViewer,
changing the settings to enable a backdoor
and remote, unattended access to that infected machine,
even, so basically the ability to gain,
regain entry even after all their other tools
were detected and cleaned off the system.
Another BlackEnergy plugin,
which acted as a parasitic infector.
This was really interesting,
because we don't see a lot of these virus like malware
a lot nowadays.
So we saw some Juniper installers circulating in the wild
that were infected by this plugin.
And the third example I wanna mention,
I guess the ICS people in the room will recognize this.
That was execution via HMI,
so in this particular example it was targeting SIMATIC,
the SIMATIC, sorry, Simplicity HMI,
but there were also others that were targeted
such as WinCC.
So that script that you saw over there,
that would be launched by Simplicity in this case
and it would run the first stage of BlackEnergy.
So the details about this are described in this ICS advisery
so you can go there and check out the details if you want.
This is interesting because this was one of the first
indicators that this group had an interest
in critical infrastructure in ICS.
This was of course before the blackouts actually happened.
Speaking of, let's talk about impact.
'Cause if I were to describe this group
with just one word I would call them impactful
for the havoc they caused in Ukraine,
whether it was with the blackouts
which left hundreds of thousands
of people without electricity
or with a pseudo ransomware, NotPetja,
going beyond the borders
and affecting some of the worlds largest corporations.
Let's take a look at the Industroyer impact.
So the primary one of course
was the ability to de-energize that sub-station
and it was doing that, as I already mentioned,
by sending commands to these types of devices,
protection relays, effectively opening circuit breakers
and speaking the language of these devices.
So that's an important thing to say.
So there were no exploits,
there were no software vulnerabilities involved in this.
Vulnerabilities, however,
were involved in the second type of functionality
that affected the operations at that workstation,
and that was carried out by the denial of service component.
This also went after the protection relays
and it was abusing a fault that was,
abusing a vulnerability, not a zero day,
because it was patched already at the time,
but not in those particular cases
and it would render the protection relays unresponsive.
And the third impact,
although if we were to consider the upcoming ICS attack,
it would probably be classified a little bit differently,
in a different level of granularity,
but basically the third way
that Industroyer affected the operation
of an electrical sub-station
was through the data wiper component.
So that one did not go after the protection relays
but after the HMI's used to control and monitor them.
And the purpose of that was to amplify the impact.
To make recovery from the attack more difficult.
So wipers, these destructive components
are kindof a signature thing of this group.
We observed an evolution of this
through the years that we were tracking them,
from the BlackEnergy plugins
through stand-alone Kill Disc components
to file encryptors,
desruptive file encryptors masquerading as ransomware,
most notably NotPetja,
but there were also others before that,
that had the same basic idea.
And they even in some cases, in some variants,
they even through a little bit of a prank
intended to intimidate the victims,
so any Mr. Robot fans here?
You'll probably recognize this.
Okay, so to finish off the talk
it's great that ATT&CK is evolving.
When we first started using it and contributing
the one impact, the one tactic
that was directly missing was impact
so we're really happy that that was added.
If I were to predict future expansion
I would say that we can probably expect
even more criminal types of impacts being added
as we are already seeing
the boundaries between threat types
and motivations already becoming very blurred,
so with that, I thank you for listening.
Use ATT&CK and contribute.
Thank you.