Based on log analysis, the actors gathered information about the exchange environment and performed mailbox searches within a four-hour period after gaining access. Some APT actors gained initial access to the organization’s Microsoft Exchange Server as early as mid-January 2021.

During incident response activities, CISA and the trusted –third-party identified APT activity on the victim’s network. The victim organization also engaged a third-party incident response organization for assistance. See the MITRE ATT&CK Tactics and Techniques section for a table of the APT cyber activity mapped to MITRE ATT&CK for Enterprise framework.įrom November 2021 through January 2022, CISA conducted an incident response engagement on a DIB Sector organization’s enterprise network. Note: This advisory uses the MITRE ATT&CK® for Enterprise framework, version 11.

CISA, the Federal Bureau of Investigation (FBI), and the National Security Agency (NSA) recommend DIB sector and other critical infrastructure organizations implement the mitigations in this CSA to ensure they are managing and reducing the impact of cyber threats to their networks.ĭownload the PDF version of this report: pdf, 692 KBįor a downloadable copy of IOCs, see the following files: The CSA includes detection and mitigation actions to help organizations detect and prevent related APT activity. This joint Cybersecurity Advisory (CSA) provides APT actors tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) identified during the incident response activities by CISA and a third-party incident response organization. APT actors used an open-source toolkit called Impacket to gain their foothold within the environment and further compromise the network, and also used a custom data exfiltration tool, CovalentStealer, to steal the victim’s sensitive data. During incident response activities, CISA uncovered that likely multiple APT groups compromised the organization’s network, and some APT actors had long-term access to the environment. Update software, including operating systems, applications, and firmware, on network assets.įrom November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to advanced persistent threat (APT) activity on a Defense Industrial Base (DIB) Sector organization’s enterprise network.Implement network segmentation to separate network segments based on role and functionality.Enforce multifactor authentication (MFA) on all user accounts.Actions to Help Protect Against APT Cyber Activity:

Iis cannot verify access to path