SoylentNews

Arthur T Knackerbracket has processed the following story:

One year after the disruptive supply-chain attacks, researchers have observed two new clusters of activity from the Russia-based actors that signal a significant threat may be brewing.

One year after the notorious and far-reaching SolarWinds supply-chain attacks, its orchestrators are on the offensive again. Researchers said they’ve seen the threat group – which Microsoft refers to as “Nobelium” and which is linked to Russia’s spy agency – compromising global business and government targets with novel tactics and custom malware, stealing data and moving laterally across networks.

Researchers from Mandiant have identified two distinct clusters of activity that can be “plausibly” attributed to the threat group, which they track as UNC2452, they said in a report published Monday.

Mandiant has tracked the latest activity as UNC3004 and UNC2652 since last year and throughout 2021, observing the compromise of a range of companies that provide technology solutions, cloud and other services as well as resellers, they said.

Indeed, resellers were the target of a campaign by Nobelium that Microsoft revealed in October, in which the group was seen using credential-stuffing and phishing, as well as API abuse and token theft, to gather legitimate account credentials and privileged access to reseller networks. The ultimate goal of this campaign seemed to be to reach downstream customer networks, researchers said at the time.

Nobelium also engaged in credential theft in April using a backdoor called FoggyWeb to attack ActiveDirectory servers, Microsoft revealed in September.

In the latest clusters observed by Mandiant, stolen credentials also facilitated initial access to the targeted organizations. However, researchers believe the threat actors acquired the credentials from an info-stealer malware campaign of a third party rather than one of their own, they said.

Attackers have added a number of novel tactics, techniques and procedures (TTPs) to bypass security restrictions within environments, including the extraction of virtual machines to determine internal routing configurations, researchers wrote.

They also have new malware in their arsenal: a new, bespoke downloader that researchers have called Ceeloader. The malware, which is heavily obfuscated, is written in C and can execute shellcode payloads directly in memory, they wrote.

Original Submission