{"id":7439,"date":"2021-07-19T17:36:34","date_gmt":"2021-07-20T00:36:34","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7439"},"modified":"2023-04-20T02:31:16","modified_gmt":"2023-04-20T09:31:16","slug":"solarwinds-attackers-at-it-again-in-back-to-back-campaigns","status":"publish","type":"post","link":"https:\/\/webdev.securin.xyz\/articles\/solarwinds-attackers-at-it-again-in-back-to-back-campaigns\/","title":{"rendered":"SolarWinds\u2014Attackers at It Again in Back-to-Back Campaigns"},"content":{"rendered":"
Nobelium, the APT group behind the infamous attack on SolarWinds, has resurfaced in two recent campaigns against US-based IT companies and government organizations. Check out Securin\u2019s analysis of 18 vulnerabilities used by the group to exploit and infiltrate their targets.\u00a0<\/strong><\/p>\n In the last week of June 2021<\/a>, the attackers behind the infamous SolarWinds supply chain incident were back again, targeting Microsoft’s corporate network. The group is said to have stolen credentials from one of its customer service agents and used the information to launch attacks against other Microsoft clients, compromising at least three customer accounts.<\/p>\n Earlier, in May 2021<\/a>, the same group was identified impersonating a US government agency. The cyberattack piggybacked on a marketing email account of the US Agency for International Development (USAID) and managed to reach 3,000 email accounts across 150 different organizations. However, the White House claims that the intruding attempts were curbed, by and large, and the “noisy” campaign did not cause much damage.<\/p>\n Dubbed the Nobelium campaign, the attacks have been attributed to the Russian state-sponsored threat group Nobelium, which has been operational since 2008. The group is also known as APT29, Cozy Bear, The Dukes, and UNC2452 and has 11 other aliases.<\/p>\n<\/blockquote>\n More recently, in early July, the APT29 group was deemed responsible<\/a> for an attack on the American Grand Old Party or the Republican Party.<\/p>\n Securin\u2019s dynamic threat database has mapped 18 CVEs to APT29, popularly called the Nobelium group. Here is our analysis of these vulnerabilities:<\/p>\n <\/p>\n Fourteen CVEs are capable of remote code execution, while eight CVEs have associated WebApp exploits, with a few having both capabilities.<\/p>\n<\/li>\n Twelve of the associated vulnerabilities are recently trending CVEs, according to Google Trends.<\/p>\n<\/li>\n The oldest vulnerability exploited by Nobelium is from 2009, and three CVEs were newly discovered this year.<\/p>\n<\/li>\n<\/ul>\n A severity analysis of the CVEs brings out 11 vulnerabilities that have been deemed critical by CVSS V3 scoring and three high-ranked ones.<\/p>\n<\/li>\n Three CVEs have CVSS V3 scores lesser than eight, illustrating that low-scoring vulnerabilities are also ripe targets for exploitation.<\/p>\n<\/li>\n Twelve weaknesses power these vulnerabilities, seven of which feature in MITRE\u2019s Top 25 CWEs of 2020.<\/p>\n<\/li>\n<\/ul>\n There are five vulnerabilities, including CVE-2020-0674 and CVE-2021-26855, across 35 different products from Microsoft that have been recently trending.<\/p>\n<\/li>\n Other than Microsoft, the vulnerabilities are present across products of vendors, including Pulse Secure, Citrix, Fortinet, Cisco, Mozilla, Elastic, Redhat, Sycamore, Oracle, VMware, Apple, and F5.<\/p>\n<\/li>\n Fourteen F5\u00a0 products that provide multi-cloud security and application services are vulnerable to CVE-2020-5902, which can be exploited remotely.<\/p>\n<\/li>\n<\/ul>\n All vulnerabilities have patches available. Considering the fact that these vulnerabilities led to the biggest cyberattack of recent times, organizations should prioritize them for patching immediately.<\/p>\n<\/li>\n Interestingly, Securin called out CVE-2021-26855 in the Ransomware Spotlight report Q1 update<\/a> for how rapidly it was weaponized and started trending in the wild.<\/p>\n<\/li>\n<\/ul>\n <\/p>\n Securin warned about seven (7) vulnerabilities in APT29\u2019s collection in our Ransomware Reports published in February and May 2021.<\/strong><\/p>\n\n
Vulnerabilities in APT 29\u2019s Radar<\/h2>\n
Exploits and Trends<\/h3>\n
\n
Severity and Weaknesses<\/h3>\n
\n
Products and Vendors<\/h3>\n
\n
Patches and Weaponization<\/h3>\n
\n