The (Nation) State of APTs in 2021

Even though it seems like every year has been the year of ransomware since probably 2017, this year is in the running to be THE year of ransomware, in terms of scale and drama, as we just wrote about in our Q2 report. Despite the events unfolding throughout the criminal world in 2021, it might’ve become easy to forget that nation-states are out there, still doing the things they do best: breaching targets and exfiltrating data. In some cases, they’re also dabbling in ransomware, as we’ll see. Bearing that in mind, let’s switch gears on cybersecurity threats facing all of us (and to maybe take a quick break from ransomware). 

So far, we’ve seen some pretty significant attacks that either bear the mark or were directly attributable to a nation-state actor. These attacks also saw some departures from usual tactics or a return to familiar ones. Since we’re in the mood to reminisce a bit lately, especially after looking back at supply chains, ransomware, and various criminal actors, let’s talk APTs this time around.

Iran: The Kittens Make Moves

I started with Iran here because while they have been busy in 2021, most people might not realize it since much of the APT news typically focuses on China and Russia. To give a bit of history on their capabilities, they’re a relatively new player on the global stage compared to their Chinese and Russian peers. Still, they have shown expertise around application compromise, social engineering, system tool use, and outright data destruction.

Coming into the scene most notably after destructive attacks on Saudi Arabia, Iran’s had some threat actors at their disposal with specialties ranging from targeting the oil and energy sector and dissident circles to journalists, consultants, and other functionaries within the government and defense sectors. They also don’t shy away from targeting academia. Their usual targets are in the Middle East, notably Israel, Saudi Arabia, and UAE, to support regional aims and disrupt Sunni and Gulf state hegemony in recent years. Moreover, they have also dabbled in Europe and North America. Cyber-espionage and cyber warfare play very well with Iran’s proxy strategy, always staying a step removed from direct action because it keeps things distant and deniable for the Iranian government. Also, this type of asymmetric warfare conveniently provides a low-cost method to wage cold wars with Iran’s political and ideological adversaries.

The most recent developments saw an Iranian actor thought to be APT35, or Imperial Kitten, using a fake profile on Facebook to target a defense contractor over several months with various lures via social media and email. In July, both Proofpoint and Facebook released information about the campaign that used macro-enabled Office files configured to drop a trojan that would allow further covert access. This hasn’t been the first time Iran’s had its hands caught in the proverbial social media cookie jar. This activity has been a hallmark of Iranian actors dating back to at least 2017, when other groups were using applications such as LinkedIn and WhatsApp to target users in various industries with Iranian interest.

In addition to becoming friends and influencers on social media, Iranian actors have been linked to attacks on Israel, Saudi Arabia, Lebanon, and the UAE this year, along with other targets in the US and Europe ranging from March through at least May 2021. Researchers saw the arrival of a new Iranian-linked threat actor, as well as an expansion of targets, as one campaign from a familiar actor known as Charming Kitten targeted scholars and various government officials in what looked to attempt to harvest credentials according to research from Trend Micro and Anomali. 

Based on technical analysis, Iran’s proficiency with bespoke malware continues to grow. There was plenty of evidence that malware is actively being developed to evade detection in all of these attacks. In addition, Iranian actors continue to show expertise with using operating system tools and processes to establish persistence and stay undetected. The same can be said about some of the observed campaign indicators that use legitimate-seeming domains to look as benign as possible or that call out legitimate domains to stay hidden in regular DNS traffic.

One interesting callout by IronNet researchers focuses on potential future geopolitical motives for Iran. That is in the guise of Iran’s various cooperation frameworks with both Russia and China, which are continuing to make big moves on the world stage in 2021. Much of the cooperation is centered on defense (naturally) and touches on areas like technology and other material cooperation. China’s due to make some investments in the country, and Russia’s looking to increase cybersecurity ties, among other goals, could pose a problem on the diplomatic stage for the US and its allies. How the cooperation shakes out will only become more apparent as time goes on, but these developments are worth keeping an eye on. 

Russia: The Bear Never Sleeps

Outside of the SolarWinds hack of 2021, Russian-aligned threat actors have continued to ply their trade as Russia’s espionage aims grow globally. We’re calling out the usual suspects, APT28 and APT29, because some of the incidents served as exciting case studies, primarily due to the use of new tactics. 

Evidence is growing that the venerable APT29, AKA Cozy Bear, is back in business, as RiskIQ research found with the July discovery of command-and-control infrastructure going active. Also, as a nice nod to the security community, they reportedly use the same malware seen in previous attacks last year against COVID research. Most of the infrastructure seen in these attacks leveraged IP address space from legitimate hosting providers throughout Europe and the US to make things even more interesting.

Continuing on the theme of a busy July in Russia (see also: disappearances and reappearances of ransomware actors), Google researchers were able to link a host of zero-days not only to a mysterious security company but also to actors thought to be tied to the Nobelium threat actor–a name that should be familiar from early 2021’s SolarWinds revelations. However, instead of focusing on Windows vulnerabilities, this campaign centered on specific LinkedIn users and leveraged an iOS vulnerability to drop Cobalt Strike beacons on targeted systems.

Finally, a recent joint alert from US and UK intelligence and law enforcement brought to light a series of brute force attacks that leveraged multiple VPN providers and Tor services attributed to APT28, AKA Fancy Bear. Staying on trend with the cloud, APT28 used a Kubernetes cluster to perform the attacks between 2019 and early 2021. Once on target, they used several public exploits and various tradecraft to dump and harvest credentials, access email and other sensitive information, and exfiltrated data via Outlook in small chunks to avoid detection of large-scale file exfiltration.

China: The Panda Gets Crafty

With so many threat groups at their disposal, given recently announced geopolitical and strategic goals, it would be folly to assume that Chinese-aligned actors are not expanding and evolving their operations. As we’ve seen in attacks this year, Chinese activity pointed to novel use of ransomware, along with a possible false flag operation and new/old techniques to manually spread malware through hardware. As China continues to find its way on the global stage, we’ll likely continue to see some of the usual espionage and data exfiltration, along with  regional policy influencing.

Just last month, Bleeping Computer wrote about a new campaign touching countries far and wide across Southeast Asia that used innovative new methods to deliver malware, namely through infected USB drives and malware hidden in plain sight. Updates posing as benign files and Zoom executables instead turned out to be malicious, and they appeared to self-propagate across hardware.

In another more recent twist, FireEye researchers noted that current campaigns targeting Israel that were thought to be tied to Iran instead bear some of the markings of a Chinese actor. Despite some false flags planted with directory naming, use of leaked Iranian backdoors, and other system notifications, the infrastructure and techniques had all the makings of a known Chinese actor, UNC215. This actor actively used and modified tactics to evade detection by deleting artifacts of attack while also hiding in plain sight with system tools. 

Finally, early 2021 saw the arrival of a major hack on gaming companies with activity linked to APT27, AKA Emissary Panda, also showing a departure from previous methods by employing ransomware. Interestingly enough, this wasn’t the first time activity associated with this actor had a financial motive. Another firm published findings around the same time that cryptomining activity had been spotted previously and associated with APT27, based on analysis of techniques and toolsets in use.

The Attacks Never Stop

This has been another banner year for everyone with any skin in the cybersecurity game. A big kudos needs to go out to the overworked and stressed blue teams out there who are preventing these attacks every day, multiple times a day. The fact there aren’t more successful attacks speaks volumes to the combination of skills and tooling that are stopping attempts cold out there. 

Attackers, criminal and otherwise, are constantly refining their tactics to find that one gap in the armor to land their attacks. Even though we discussed Iran, Russia, and China here, plenty of other threat actors are up to the same kinds of trickery globally, but sometimes at a more focused, regional scale with different stakes. While we’ve seen more widespread evidence of attackers keeping up with the times and using tools like Cobalt Strike, at the same time, they’re also still using tried-and-true methods, sometimes using exploits on vulnerabilities that should’ve been patched months or even years before. 

Organizations don’t have to go it alone, but they have to do something, even though it’s just a crazy array of threats and a stack of odds against the defenses. There is already so much written about best practices and sound policies that we won’t go into those here, but we can help with keeping you informed about the daily risks you face. Whether it’s a need for threat intelligence, understanding risk to your assets, or finding technical leakage, we can be a part of your defenses.

We have profiles on various threat actors and other useful intelligence to keep you informed, as we scour the web to provide updates to our clients. If you’re interested to see howSearchLight (now ReliaQuest’s GreyMatter Digital Risk Protection)can work for you, you can take a test drive for seven days, where you can access our library of more than 500 threat actor profiles.