{"id":79132,"date":"2024-06-16T17:54:20","date_gmt":"2024-06-16T09:54:20","guid":{"rendered":"https:\/\/version-2.com\/?p=79132"},"modified":"2024-06-12T17:57:14","modified_gmt":"2024-06-12T09:57:14","slug":"valuable-targets-attract-advanced-threat-actors-how-to-defend-against-quiet-and-persistent-attacks","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2024\/06\/valuable-targets-attract-advanced-threat-actors-how-to-defend-against-quiet-and-persistent-attacks\/","title":{"rendered":"Valuable targets attract advanced threat actors. How to defend against quiet and persistent attacks"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

C-level executives, diplomats, and high-ranking IT managers usually have access to sensitive information, huge amounts of data, finances, or a combination of all these things. And adversaries know it.<\/em><\/p>

Anticipating all the precious data and access rights, cybercriminals and state-sponsored advanced persistent threat groups (APTs) are willing to invest a lot of time and money to orchestrate attacks that could compromise VIP devices and accounts. In this case, backdoors are particularly dangerous, because typically they have the capability to send files to the host computer, execute files and commands there, and exfiltrate (send) files and documents back to the attacker.<\/p>

One of the latest examples of such an attack features several sophisticated and previously unknown backdoors called LunarWeb and LunarMail, which were recently described by ESET researchers<\/a> and presented at the ESET World 2024<\/a> conference. Using advanced obfuscation techniques, they were deployed to spy on an undisclosed European ministry of foreign affairs. The attack is attributed with medium confidence to the Russia-aligned APT group Turla.<\/p>

To protect against such attacks, organizations need to be proactive. This means not only training staff and deploying a reliable cybersecurity solution, but also having comprehensive cyberthreat intelligence helping them stay ahead of adversaries.\u00a0\u00a0<\/p>

\u00a0<\/p><\/div>

\u00a0<\/p><\/div>

\u00a0<\/p>

\u00a0<\/p><\/div><\/div><\/div><\/div><\/div><\/div>

VIPs are also threatened at home<\/h3><\/header>

According to a 2023 study<\/a> conducted by BlackCloak and Ponemon Institute, senior-level corporate executives are increasingly being targeted by sophisticated cyberattacks. These include email compromise, ransomware, malware infection, doxing<\/a>, extortion, online impersonation and even physical attacks, such as swatting<\/a>.<\/p>

Around 42% of surveyed organizations stated that their senior executive or an executive\u2019s family member was attacked over the past two years. Attackers often went for sensitive company data, including financial information and intellectual property.<\/p>

Cybercriminals did not hesitate to strike when their targets were the most vulnerable \u2013 at home with their loved ones. In one-third of reported cases, hackers reached executives through insecure home-office networks used during remote work.<\/p>

Business email compromise<\/a> (BEC) is one of the most used tactics against VIPs. It usually comprises a sophisticated scam targeting individuals performing transfers of funds and seeks to compromise legitimate business email accounts through social engineering and\/or computer intrusion techniques.<\/p>

According to the FBI\u2019s Internet Crime Complaint Center (IC3) annual reports<\/a>, BEC is among the costliest types of crime. In 2023, IC3 received 21,489 BEC complaints with adjusted losses of over $2.9 billion. Only investment crimes (such as pyramid schemes, real estate investment scams, or cryptocurrency investment scams) accumulated more losses than BEC in that year, with $4.7 billion reported stolen.<\/p><\/div>

The Lunar toolset<\/h3><\/header>

ESET research on the Lunar toolset demonstrates how such carefully crafted spying can look.<\/p>

The initial attack vector is not known, but recovered installation-related components and attacker activity suggest possible spearphishing with a malicious Word document and abuse of both a misconfigured network and the application monitoring software Zabbix.<\/p>

Once access is gained, the backdoor installation process follows. It consists of dropping both a loader and a blob<\/a> containing either LunarWeb or LunarMail, as well as setting up persistence.<\/p>

From that point forward, data exfiltration can start. For example, the LunarWeb backdoor gathers data such as the OS serial name, environment variables, network adapters, a list of running processes, a list of services, or a list of installed security products, and sends them to a C&C server.<\/p>

LunarWeb communicates with a C&C server using HTTP(S) underneath which is a custom binary protocol with encrypted content. ESET researchers only found LunarWeb deployed on servers, not user workstations.<\/p>

LunarMail is similar, but instead of HTTP(S) it uses email messages for communication with its C&C server. This backdoor is designed to be deployed on user workstations, not servers \u2013 because it is persistent and intended to run as an Outlook add-in.<\/p><\/div>

Staying under the radar<\/h3><\/header>

The APT group also has several tricks up its sleeve to conceal the malicious activities of deployed backdoors. \u00a0<\/p>