Adapted from SentinelOne

In my previous blog, I discussed the modern state of Advanced Persistent Threat (APT) groups, and in this one I will discuss the APT groups as they move forward.

As we saw this year, the present COVID-19 pandemic has created powerful opportunities for nations to hack and spy on one another. Quite aside from the power of phishing lures related to Coronavirus themes, the race to be first to obtain a vaccine has led to a number of incidents of espionage related to stealing IP from research laboratories. Based on recent evidence, it is likely that we will see further APT campaigns trying to take advantage of the security vulnerabilities brought about by workplace disruption – from office to home and back again – that at present do not seem to have any end in sight, and will certainly extend into 2021 at least.

Aside from pandemic-related matters, 2020 is a year that has seen widespread political, social, economic and climate disruption in the U.S., and to a certain extent in the U.K. and Europe, as well. All these are grist to the mill for cyber threat actors, who will seize on any opportunity to leverage current events to further their campaigns.

Defending the Enterprise in an Era of Cyber Uncertainty

It sounds like a grim picture, but enterprises are far from helpless or alone. Recent sanctions imposed on Iranian hackers by the U.S., proposed EU sanctions against Russian hacking, and joint announcements by officials in countries like U.S. and U.K. (such as a recent statement blaming China, Iran and Russia in attempts to steal COVID-19 vaccine research) signal greater international cooperation that will hopefully help in reducing such destructive activities.

There are a number of initiatives to protect the healthcare industry from cyber threats during COVID-19, as well as partnerships between nations, law enforcement agencies and public-private collaboration efforts that are also being developed to improve enterprise cybersecurity against advanced persistent threat actors.

At an organizational level, the time when it was possible to believe your organization may not be “interesting” to advanced attackers is well and truly behind us. Nation-state actors are hoovering up masses of data related to organizations and individuals simply because they can, and because they never know when it might be useful.

These nation-state actors rely heavily on social engineering to obtain credentials, deliver their payloads via emails (usually hidden within documents or images), and infect endpoints in order to obtain access to data and then exfiltrate it.

Given the diverse and increasing number of threats, companies need to ensure that they conduct full risk assessment, develop a security plan that includes incident response and business continuity contingencies, and deploy trusted technological solutions to ease the burden on staff.

How to Defend Against Them

Despite a mostly remote workforce due to shelter-in-place orders, it is still vital to build a layered defense that starts at the network and moves down the endpoint and then back up to the cloud. This is the part where I issue you a friendly warning that I will talk about SonicWall solutions.

When I talk about preventative measures, I usually start with the perimeter as traffic is passing into the network. If you’ve listened to my presentations before, I like to first talk about known threats and how SonicWall is identifying and creating definitions for around 140K new threats each business day. These are pushed to SonicWall devices and services to stop known threats, which usually solves around 99% of threats today. But when it comes to APTs and targeted attacks, these definitions may not help. Despite the fact that network firewalls and the storied Next-Generation Firewall have been on the market for some time, these work horses of security are still doing the lion’s share of protecting networks — first by scrubbing for known threats, and then by utilizing a variety of resources to stop attacks while managing traffic.

This is where additional technology is required to find unknown threats. This is usually a mix of heuristics on endpoints and sandboxes on the network. At SonicWall, we deploy a technology on nearly every service and product we sell called Capture Advanced Threat Prevention (Capture ATP) with Real-Time Deep Memory Inspection (RTDMI). In order for it to work, a file would have to hit a static check for presence on an allow or block list. If it is not on either, it is sent to either a Capture ATP point of presence (PoP) for examination by the cloud-based sandboxing technology, or to your on-premise Capture Security appliance (CSa) for examination. Capture ATP will examine files in parallel in multiple sandbox engines to look for malicious behavior and report back the results. In February 2018, we added RTDMI to Capture ATP at no additional charge. This technology tests files and code in memory to find results quicker and with more accuracy. Besides our private industry customers, it is this technology that our state, local and federal government customers rely on for safety, particularly against newly minted ransomware attacks.

With phishing the number-one vector in most compromises, phishing awareness training backed by advanced email security that can recognize known and unknown threats is a priority. How we handle classifying the known threats and unknown threats is listed above. It is the work of our Capture Labs team to create static definitions, and the work of Capture ATP to scout for the unknown.

With our work-from-home state of things, endpoint security may be your first and last line of defense. Unless you force your employees to route through the firewall via VPN or a cloud-based SASE solution, such as SonicWall Cloud Access Secure Access, to access the internet on their devices, odds are you will have to rely on endpoint security to keep them safe. SonicWall Capture Client is a lightweight, advanced heuristics-based endpoint security that looks at the system constantly (with around .1-.4% system usage) to check for malicious behavior with the intent of stopping attacks before they can execute. If something does cause damage, you can easily rollback the endpoint to its last-known clean slate.

Outside of the ability to block attacks whether or not they’ve been previously identified or not, a large focus recently has been adding the ability to catalog all the applications and vulnerabilities on all protected endpoints. APT attackers tend to focus on the latest exploits, since these should provide them with the largest and softest target to hit. This feature, called Application Vulnerability Intelligence, is vital for our customer base, particularly our enterprise and government customers, to mitigate the effects of a landed attack. Additionally, with its onboard content filtering technology, you can enforce your Web Content policies on the endpoint away from the perimeter, or just at least block access to all known malicious sites.

Beyond just listing a few SonicWall solutions in play here in the fight against APT groups, there are more solutions — from secure wireless to advanced reporting and analytics — that are great tools to discover and mitigate potential issues. For more information on these options, either view our website or contact our sales team, who will work with your existing networking and security technology partner or introduce to you one with the experience to meet your needs.

Conclusion

It wasn’t all that long ago that the very existence of APTs was something shrouded in myth and secrecy, but with public disclosures and leaks of APT toolkits now in the public domain, it seems nation-state actors are not nearly so shy or retiring as they once were. Discussion of APT activity is now part of mainstream cyber discourse, with all sides seemingly content to openly acknowledge that cyber warfare between nations is part of the “new normal” that will be with us for some time to come.

Businesses need to understand that in our interconnected world, there is no such thing as being either “invisible” or “uninteresting” to advanced cyber attackers. Know it or not, like it or not, if you’re online storing and processing data, and engaged in any kind of commercial relationships, there’s an APT cyber threat actor out there interested in you, your data, your product, your clients and/or your providers.

While that might sound scary, fortunately APTs and their tactics, techniques and procedures are also no longer shrouded in mystery. APTs are just another threat actor we all have to deal with. We are not alone in this fight, and we are not defenseless, so long as we first recognize the threat and then take appropriate measures.

I invite you to continue reading one of SonicWall’s many solution briefs on a variety of subjects. Let me leave you with a few options that might direct you to something more specialized.

• EXECUTIVE BRIEF: HEALTHCARE CYBERSECURITY IN THE PANDEMIC
• SOLUTION BRIEF: SECURING SMART CITIES OVER DISTRIBUTED NETWORKS
• EXECUTIVE BRIEF: HOLDING FEDERAL GOVERNMENT AGENCIES FOR RANSOM
• HOW TO INCREASE ACCESS AND SECURITY FOR TODAY’S SCHOOLS
• WHAT’S THE BEST NGFW FOR STATE AND LOCAL GOVERNMENTS?
• SOLUTION BRIEF: BEST PRACTICES FOR GLOBAL ENDPOINT SECURITY OPERATIONS FOR MSSPS AND DISTRIBUTED ENTERPRISES
• SOLUTION BRIEF: SECURING IT ECOSYSTEMS FOR HIGHER EDUCATION

Healthcare Cybersecurity in the Pandemic

Keeping healthcare systems operational is a matter of life and death. See how Capture Client can help.

READ THE BRIEF

Securing Smart Cities Over Distributed Networks

Re-envisioning distributed community networks using smart end-to-end security and centralized management.

READ THE BRIEF

Holding Federal Government Agencies for Ransom

Recent ransomware attacks on government have become all the more pertinent in light of geopolitical tensions. This brief explores known steps you can take to help prevent being a victim.

READ THE BRIEF

How to Increase Access and Security for Today's Schools

Mobility, cloud apps and emerging threats demand more from today’s next-gen firewall. This brief examines critical network security needs for today’s school networks and explores best practices for selecting an effective next-generation firewall platform.

READ THE BRIEF

What’s the Best NGFW for State and Local Governments?

State and local governments are increasingly dependent on cloud-based apps and mobile connectivity. This brief examines critical network security needs for today’s agencies and explores best practices for selecting an effective next-generation firewall platform.

READ THE BRIEF

Best Practices for Global Endpoint Security Operations for MSSPs and Distributed Enterprises

Concerns, considerations and guidelines for a multi-tenant environment.

READ THE BRIEF

Securing IT Ecosystems for Higher Education

Higher education and information technology are inseparable. Today's complex higher education IT ecosystem requires unified network security.

READ THE BRIEF

Adapted from SentinelOne

In recent months, there has been a marked uptick in nation-state cyber activity. Recently, we’ve learned that Chinese hackers stole information from Spanish centers working on COVID-19 vaccines. The U.S. Justice Department has indicted five Chinese nationals and two Malaysians who targeted over 100 companies, organizations and individuals in 14 countries. Three Iranian nationals have been indicted on charges of hacking U.S. aerospace and satellite companies, and APT39 has been spying on Iranian dissidents. Two additional Iranian hackers were also indicted for defacing multiple websites with pro-Iranian propaganda.

This surge in nation-state hacking activity is not a blip but a discernible trend. Attacks attributed to nation-state backed Advanced Persistent Threat (APT) groups have increased not only in terms of volume but also in scope and sophistication. The problem has been exacerbated because of COVID-19 and its impact on the global economy and international relations.

Concerns about APT groups used to be a niche topic discussed primarily by government security experts and the cybersecurity industry, but now it has reached mainstream awareness, as can be seen by statements from U.S., U.K. and other Western government officials. Most recently, Australian Defense Minister Linda Reynolds made a public statement expressing concerns that malicious cyberattacks against Australian businesses and government agencies from a state-based actor, believed to be China, had increased over the past two months.

In my personal experience with Russian ransomware authors, attacks on German, English and American private, corporate and government targets from the former Soviet Union have and will continue to be a consistent threat. Additionally, the biannual SonicWall Cyber Threat Report always shows clear evidence of these findings, since it gathers real threat data from over 1.1 million sensors located in over 215 countries and territories. What would be interesting to know is if these APT groups also fund themselves with ransomware to supplement their budgets from their government. We’ve seen this with North Korea, but the picture is unclear with Russian, Iranian and Chinese APT groups.

Making Sense of a Chaotic World

Reading all these headlines can be confusing. Who is attacking who, why and how? Let’s try to break down the different nation-state activities in cyberspace.

Sabotage – The virtual can break out into the physical when nations use cyber means to cause damage to computer systems or physical systems of other nations. Attacks on critical infrastructure have increased sharply in the last two years. Among them, a tit-for-tat between Israel and Iran: an Iranian attack on Israel’s water infrastructure led to Israeli retaliation against the port of Shahid Rajaee, a reminder — should anyone have forgotten Stuxnet — that nations are not averse to launching cyberattacks with destructive force on those they perceive as enemies.

Classic Espionage – Good old-fashioned spying is a much more common activity than sabotage. Nations have been spying on each other since forever, but today much of the old ‘spy-craft’ activities are conducted in cyberspace. Data theft is easier, cheaper and relatively risk-free when you’re behind a keyboard hacking into a server in a different country and protected by the laws and security services of your own government.

Global Political Influence – Nations have long used psyops to gain an advantage over other countries, but cyberspace has given them the means to do so on a scale that was never dreamt of before. Nations can interfere with political processes in other countries with little regard and great reward. For example, nation-state actors meddling in the Scottish independence referendum, U.K. Brexit referendum, and the U.S. 2016 and 2020 elections are well-documented.

Regional Politics – Nations also want to exert strength in cyberspace to resolve (or escalate) regional conflicts. Chinese cyberattacks on Indian entities followed a skirmish between the two nations in the mountainous border region of Ladakh that resulted in dozens of casualties. Ukrainian security services reported in 2019 that Russian-backed Gamaredon APT had repeatedly targeted Ukrainian military and law enforcement agencies and individuals. Gamaredon reportedly launched at least 482 cyberattacks against Ukrainian critical infrastructure targets in a Russian-backed campaign to pursue a proxy war in cyberspace without incurring the political fallout of an actual, boots-on-the-ground military campaign.

Industrial Espionage – Unlike “classic” espionage, this activity is specifically aimed at closing the economic gap between nations by stealing intellectual property, then using it to either copy and reproduce technology or gain other unfair commercial advantages. China has been widely accused of engaging in spying on Western businesses, government agencies and technology companies for just this purpose. For example, desiring to build its own stealth jet, the Asian superpower is believed to have stolen the proven design of the US F-35 to shorten development and “time to market.” It’s been estimated that theft of American trade secrets by China costs the U.S. somewhere in the region of $300 billion to $600 billon every year.

Crime – Some nations are under extreme financial burden, made worse by international sanctions, so they resort to cybercrime to fill their coffers. North Korea is notorious for utilizing cybercrime for such purposes, and recently launched yet another campaign aimed at stealing money from U.S. banks and ATMs. Other APT Lazarus campaigns have focused on stealing cryptocurrencies and impersonating cryptocurrency exchanges. Unlike many other APTs, Lazarus writes malware that targets macOS users, too, as Apple’s platform is increasingly used by C-suite executives and others wary of the plethora of Windows malware.

The future

Stay tuned for part two of this blog, where I discuss the future of APT groups and how we defend against them, then and now. For more information on the use of endpoint security in the defense of advanced threats, read our solution brief Fitting Endpoint Security to Your Organization.