With long-term threat intelligence research and analysis, the TeamT5 IR team has experience in investigating large-scale incidents. The industry covers the technology industry, finance industry, telecommunications industry, government agencies, etc., and can quickly identify hackers' techniques, provide containment suggestions, and reduce damage. In-depth incident root cause analysis can help organizations avoiding being attacked again by the similar attacks and strengthen security posture.
Advanced persistent threat attack incident
Attack techniques
Use zero-day or N-day vulnerabilities, network penetration tools (Cobalt Strike), customized backdoor attacks (NT 5.x NDIS driver backdoor, Webshell, etc.) and network VPN agents (softether, etc.).
Summary of incidents
By reconnaissance of target, the attacker discovered the server vulnerability and carried out the attack. This backdoor, a severe threat, enable attackers to penetrate computers, perform various communications and steal confidential information, such as government operations, technology research and development, and commercial operations.
Protection recommendations
- (1) Patch server vulnerabilities and pay attention to whether there are accounts breaches or phishing emails on the dark web to prevent from attackers' accesses.
- (2) Endpoint protection measures can timely detect lateral movements within Intranet.
Website hacking
Attack techniques
Use SQL injection, SSRF, file upload bypass, vulnerabilities of third-party package, network scanning tools (Serverscan, Xray), web backdoors (WebShell) and agents (Neo-reGeorg).
Summary of incidents
Attackers exploit the vulnerabilities of webpage or third-party package to upload backdoor and gain control over the website host. They then install agents and upload scanning tools for reconnaissance of intranet hosts and brute force password cracking.
Protection recommendations
- (1) Have vulnerability information and promptly patch and update vulnerabilities in website systems, web programs and third-party packages.
- (2) Regularly check management package access and website service logs.
- (3) Monitor the field system and network status through endpoint protection software and network management equipment to detect malicious programs in real time.
Ransomware
Attack techniques
Use dark web intelligence or brute force password cracking techniques through network scanning to gain access to the network or system in the field (RDP, SSH, VPN, etc.).
Summary of incidents
After entering the intranet, the attacker can move laterally, expand the scope and level of control, and finally select valuable targets for encryption and blackmail. Usually the ransom targets are ESXi hosts, NAS devices, AD, and database hosts.
Protection recommendations
- (1) Equipment vulnerabilities and insufficient network access verification mechanisms need to be avoided.
- (2) Through the terminal protection monitoring mechanism, detect suspicious programs or mobile status, detect threats early and block the source of hacking.
- (3) Strengthen the data backup mechanism.
Personal information leaked
Attack techniques
Attackers use network scanning (Port scan) and Web attack techniques (SQL injection, XSS, SSRF, etc.) to gain access to websites and databases in the field.
Summary of incidents
Attackers access and download customer order information, design fraud scenarios, and send them to victims via phone calls, emails, or text messages to defraud customers of money. From the fraud contents, the root cause of incident could be the breaches of order data. Therefore, we immediately clarified the breaches of data flow and the investigation target, and conducted evidence collection analysis.
Protection recommendations
- (1) It is necessary to confirm whether the web page upload verification mechanism is complete to avoid being controlled by the attacker's web shell upload.
- (2) Pay attention to whether the service interface is in the risks to avoid being violently cracked by attackers.
- (3) Strengthen the data flow encryption management and audit mechanism.
