The National Security Agency (NSA) joined the Federal Bureau of Investigation (FBI), the United States Cyber Command’s Cyber National Mission Force (CNMF), and the United Kingdom National Cyber Security Centre (NCSC) to warn network defenders about ongoing Russian Federation Foreign Intelligence Service (SVR) cyber threats and to recommend rapid countermeasures for security patching and mitigating systems.
In a press statement, Dave Luber, NSA director of cybersecurity, said, “This activity is a global threat to the government and private sectors and requires thorough review of security controls, including prioritizing patches and keeping software up to date. Our updated guidance will help network defenders detect these intrusions and ensure they are taking steps to secure their systems.”
The joint Cybersecurity Advisory (CSA), “Update on SVR Cyber Operations and Vulnerability Exploitation,” highlights how Russian SVR cyber actors are currently exploiting a set of software vulnerabilities and have intentions to exploit additional vulnerabilities. It provides a detailed list of publicly disclosed common vulnerabilities and exposures (CVEs) and a list of mitigations to improve cybersecurity posture based on the SVR cyber actors’ operations.
According to the CSA, SVR cyber actors are using a range of tactics, techniques, and procedures (TTPs) including, but not limited to, spearphishing, password spraying, abuse of supply chain and trusted relationships, custom and bespoke malware, cloud exploitation, and living off the land techniques. They gain initial access, escalate privileges, move laterally, maintain persistence in victim networks and cloud environments, and exfiltrate information. They often conceal their activity using Tor, leased and compromised infrastructure, and proxies.
To disrupt this activity, the report’s authors recommend baselining authorized devices and scrutinizing systems accessing their networks that do not adhere to the baseline, among other mitigations.
Since 2021, the SVR actors – also tracked as APT29, Midnight Blizzard (formerly Nobelium), the Dukes, and Cozy Bear – have consistently targeted U.S., European, and global entities in the defense, technology, and finance sectors. Their intent is to collect foreign intelligence and enable future cyber operations, including in support of Russia’s ongoing invasion of Ukraine.
Recommendations
The authoring agencies recommend organizations implement the mitigations below to improve your organization’s cybersecurity posture on the basis of the threat actor’s activity.
- Prioritize rapid deployment of patches and software updates as soon as they become available. Enable automatic updates where possible.
- Reduce attack surface by disabling Internet-accessible services that you do not need, or restrict access to trusted networks, and removing unused applications and utilities from workstations and development environments.
- Perform continuous threat hunting activities.
- Ensure proper configuration of systems – check for open ports and obsolete or unused protocols, especially on Internet-facing systems.
- Isolate Internet-facing services in a network Demilitarized Zone (DMZ) to reduce exposure of internal networks.
- Require and enforce multi-factor authentication whenever possible.
- Require additional identity challenges for enrollment of new devices when users are permitted to self-enroll multi-factor authentication mechanisms or register devices on the corporate network.
- Notify users across multiple platforms when devices have been successfully registered to help identify unexpected registrations. Train and encourage users to notice and report unexpected registrations.
- Enable robust logging for authentication services and Internet-facing functions.
- Regularly audit cloud-based accounts and applications with administrative access to email for unusual activity.
- Limit token access lifetimes and monitor for evidence of token reuse.
- Enforce least-privileged access and disable external management capabilities.
- Baseline authorized devices and apply additional scrutiny to systems accessing network resources that do not adhere to the baseline.
- Disable remote downloading of information to non-enrolled devices when possible.
The authoring agencies recommend testing your existing security controls to assess how they perform against the techniques described in this advisory.
