Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Вход Регистрация
MITRE ATT&CK - Преступная группа UNC2452
Каталоги
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
Риски
Каталоги
MITRE ATT&CK
Преступная группа
UNC2452
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

UNC2452

UNC2452 is a suspected Russian state-sponsored threat group responsible for the 2020 SolarWinds software supply chain intrusion.(Citation: FireEye SUNBURST Backdoor December 2020) Victims of this campaign include government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East.(Citation: FireEye SUNBURST Backdoor December 2020) The group also compromised at least one think tank by late 2019.(Citation: Volexity SolarWinds)
ID: G0118
Associated Groups: NOBELIUM, StellarParticle, Dark Halo
Version: 1.1
Created: 05 Jan 2021
Last Modified: 04 May 2021

Associated Group Descriptions
Name Description
NOBELIUM (Citation: MSTIC NOBELIUM Mar 2021)
StellarParticle (Citation: CrowdStrike SUNSPOT Implant January 2021)
Dark Halo (Citation: Volexity SolarWinds)

Techniques Used
Domain ID Name Use
Enterprise T1098 .001 Account Manipulation: Additional Cloud Credentials

UNC2452 added credentials to OAuth Applications and Service Principals.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)

.002 Account Manipulation: Additional Email Delegate Permissions

UNC2452 added their own devices as allowed IDs for active sync using Set-CASMailbox, allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.(Citation: Volexity SolarWinds)(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)

Enterprise T1583 .001 Acquire Infrastructure: Domains

UNC2452 has acquired C2 domains through resellers.(Citation: MSTIC NOBELIUM Mar 2021)(Citation: FireEye SUNSHUTTLE Mar 2021)
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

UNC2452 used HTTP for C2 and data exfiltration.(Citation: Volexity SolarWinds)
Enterprise T1560 .001 Archive Collected Data: Archive via Utility

UNC2452 used 7-Zip to compress stolen emails into password-protected archives prior to exfiltration.(Citation: Volexity SolarWinds)(Citation: Microsoft Deep Dive Solorigate January 2021)
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

UNC2452 used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and to execute other commands.(Citation: Volexity SolarWinds)(Citation: Microsoft Analyzing Solorigate Dec 2020)
.003 Command and Scripting Interpreter: Windows Command Shell

UNC2452 used cmd.exe to execute commands on remote machines.(Citation: Volexity SolarWinds)(Citation: Microsoft Analyzing Solorigate Dec 2020)

Enterprise T1584 .001 Compromise Infrastructure: Domains

UNC2452 has compromised domains to use for C2.(Citation: MSTIC NOBELIUM Mar 2021)
Enterprise T1074 .002 Data Staged: Remote Data Staging

UNC2452 staged data and files in password-protected archives on a victim's OWA server.(Citation: Volexity SolarWinds)
Enterprise T1587 .001 Develop Capabilities: Malware

UNC2452 developed SUNSPOT, SUNBURST, TEARDROP, and Raindrop; SUNSPOT and SUNBURST were tailored to be incorporated into SolarWind's Orion software library.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)
Enterprise T1484 .002 Domain Policy Modification: Domain Trust Modification

UNC2452 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.(Citation: Microsoft 365 Defender Solorigate)
Enterprise T1114 .002 Email Collection: Remote Email Collection

UNC2452 collected emails from specific individuals, such as executives and IT staff, using New-MailboxExportRequest followed by Get-MailboxExportRequest.(Citation: Volexity SolarWinds)
Enterprise T1546 .003 Event Triggered Execution: Windows Management Instrumentation Event Subscription

UNC2452 used WMI event subscriptions for persistence.(Citation: Microsoft 365 Defender Solorigate)(Citation: Microsoft Deep Dive Solorigate January 2021)
Enterprise T1048 .002 Exfiltration Over Alternative Protocol: Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

UNC2452 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.(Citation: Volexity SolarWinds)
Enterprise T1606 .001 Forge Web Credentials: Web Cookies

UNC2452 bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.(Citation: Volexity SolarWinds)
.002 Forge Web Credentials: SAML Tokens

UNC2452 created tokens using compromised SAML signing certificates.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)

Enterprise T1562 .001 Impair Defenses: Disable or Modify Tools

UNC2452 used the service control manager on a remote system to disable services associated with security monitoring products.(Citation: Microsoft Deep Dive Solorigate January 2021)
.002 Impair Defenses: Disable Windows Event Logging

UNC2452 used AUDITPOL to prevent the collection of audit logs.(Citation: Microsoft Deep Dive Solorigate January 2021)

.004 Impair Defenses: Disable or Modify System Firewall

UNC2452 used netsh to configure firewall rules that limited certain UDP outbound packets.(Citation: Microsoft Deep Dive Solorigate January 2021)

Enterprise T1070 .004 Indicator Removal: File Deletion

UNC2452 routinely removed their tools, including custom backdoors, once remote access was achieved.(Citation: FireEye SUNBURST Backdoor December 2020)
.006 Indicator Removal: Timestomp

UNC2452 modified timestamps of backdoors to match legitimate Windows files.(Citation: Microsoft Deep Dive Solorigate January 2021)

Enterprise T1036 .004 Masquerading: Masquerade Task or Service

UNC2452 named tasks \Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager in order to appear legitimate.(Citation: Volexity SolarWinds)
.005 Masquerading: Match Legitimate Name or Location

UNC2452 renamed a version of AdFind to sqlceip.exe or csrss.exe in an attempt to appear as the SQL Server Telemetry Client or Client Service Runtime Process, respectively.(Citation: Volexity SolarWinds)(Citation: Microsoft Analyzing Solorigate Dec 2020)

Enterprise T1003 .006 OS Credential Dumping: DCSync

UNC2452 leveraged privileged accounts to replicate directory service data with domain controllers.(Citation: Microsoft 365 Defender Solorigate)(Citation: Microsoft Deep Dive Solorigate January 2021)
Enterprise T1090 .001 Proxy: Internal Proxy

UNC2452 configured at least one instance of Cobalt Strike to use a network pipe over SMB during the 2020 SolarWinds intrusion.(Citation: Symantec RAINDROP January 2021)
Enterprise T1021 .006 Remote Services: Windows Remote Management

UNC2452 has used WinRM via PowerShell to execute command and payloads on remote hosts.(Citation: Symantec RAINDROP January 2021)
Enterprise T1053 .005 Scheduled Task/Job: Scheduled Task

UNC2452 used scheduler and schtasks to create new tasks on remote hosts as part of lateral movement.(Citation: Volexity SolarWinds) They also manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.(Citation: FireEye SUNBURST Backdoor December 2020) UNC2452 also created a scheduled task to maintain SUNSPOT persistence when the host booted.(Citation: CrowdStrike SUNSPOT Implant January 2021)

Enterprise T1558 .003 Steal or Forge Kerberos Tickets: Kerberoasting

UNC2452 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline.(Citation: Microsoft Deep Dive Solorigate January 2021)
Enterprise T1553 .002 Subvert Trust Controls: Code Signing

UNC2452 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.(Citation: FireEye SUNBURST Backdoor December 2020)
Enterprise T1195 .002 Supply Chain Compromise: Compromise Software Supply Chain

UNC2452 gained initial network access via a trojanized update of SolarWinds Orion software.(Citation: FireEye SUNBURST Backdoor December 2020)
Enterprise T1218 .011 System Binary Proxy Execution: Rundll32

UNC2452 used Rundll32 to execute payloads.(Citation: Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks)(Citation: Microsoft Deep Dive Solorigate January 2021)
Enterprise T1016 .001 System Network Configuration Discovery: Internet Connection Discovery

UNC2452 has used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.(Citation: MSTIC NOBELIUM Mar 2021)
Enterprise T1552 .004 Unsecured Credentials: Private Keys

UNC2452 obtained the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.(Citation: Microsoft 365 Defender Solorigate)
Enterprise T1550 .004 Use Alternate Authentication Material: Web Session Cookie

UNC2452 used a forged duo-sid cookie to bypass MFA set on an email account.(Citation: Volexity SolarWinds)

Software
ID Name References Techniques
S0560 TEARDROP (Citation: FireEye SUNBURST Backdoor December 2020) (Citation: Microsoft Deep Dive Solorigate January 2021) Query Registry, Obfuscated Files or Information, Modify Registry, Windows Service, Match Legitimate Name or Location, Deobfuscate/Decode Files or Information
S0565 Raindrop (Citation: Microsoft Deep Dive Solorigate January 2021) (Citation: Symantec RAINDROP January 2021) Time Based Evasion, Obfuscated Files or Information, Software Packing, Masquerading, Match Legitimate Name or Location, Steganography, Deobfuscate/Decode Files or Information
S0588 GoldMax (Citation: CrowdStrike StellarParticle January 2022) (Citation: FireEye SUNSHUTTLE Mar 2021) (Citation: MSTIC NOBELIUM Mar 2021) (Citation: SUNSHUTTLE) Scheduled Task, Software Packing, System Time Discovery, System Network Configuration Discovery, Cron, Asymmetric Cryptography, Windows Command Shell, Deobfuscate/Decode Files or Information, Junk Data, Obfuscated Files or Information, Web Protocols, Ingress Tool Transfer, Match Legitimate Name or Location, Time Based Evasion, System Checks, Exfiltration Over C2 Channel, Masquerade Task or Service
S0589 Sibot (Citation: MSTIC NOBELIUM Mar 2021) Query Registry, Scheduled Task, Match Legitimate Name or Location, System Network Configuration Discovery, Obfuscated Files or Information, Windows Management Instrumentation, Indicator Removal, Ingress Tool Transfer, File Deletion, Web Service, Visual Basic, Deobfuscate/Decode Files or Information, Mshta, Rundll32, System Network Connections Discovery, Indicator Removal, Modify Registry, Web Protocols
S0154 Cobalt Strike (Citation: cobaltstrike manual) (Citation: FireEye SUNBURST Backdoor December 2020) Domain Fronting, Sudo and Sudo Caching, Code Signing, Scheduled Transfer, JavaScript, Remote Desktop Protocol, Native API, Pass the Hash, Domain Accounts, Indicator Removal from Tools, Bypass User Account Control, System Network Configuration Discovery, Service Execution, PowerShell, Web Protocols, Application Layer Protocol, Data from Local System, Disable or Modify Tools, Dynamic-link Library Injection, Local Accounts, Multiband Communication, Keylogging, Distributed Component Object Model, Process Discovery, BITS Jobs, Process Hollowing, Software Discovery, Local Accounts, BITS Jobs, Remote Desktop Protocol, Internal Proxy, Exploitation for Privilege Escalation, Screen Capture, Process Argument Spoofing, Modify Registry, Domain Groups, System Network Connections Discovery, Protocol Impersonation, Parent PID Spoofing, Token Impersonation/Theft, Protocol Tunneling, Windows Service, Visual Basic, Native API, Parent PID Spoofing, Process Injection, System Service Discovery, Timestomp, System Network Configuration Discovery, SSH, File and Directory Discovery, DNS, Token Impersonation/Theft, DNS, Bypass User Account Control, Process Hollowing, Scheduled Transfer, Security Account Manager, Local Groups, PowerShell, SSH, Python, Reflective Code Loading, Remote System Discovery, LSASS Memory, Screen Capture, Commonly Used Port, Query Registry, Domain Account, Data Transfer Size Limits, Network Service Discovery, Pass the Hash, Domain Accounts, Network Share Discovery, Web Protocols, Asymmetric Cryptography, Windows Command Shell, Process Injection, Browser Session Hijacking, Deobfuscate/Decode Files or Information, Remote System Discovery, Visual Basic, Protocol Tunneling, Exploitation for Privilege Escalation, Windows Management Instrumentation, Keylogging, Browser Session Hijacking, Windows Remote Management, Symmetric Cryptography, Non-Application Layer Protocol, Standard Encoding, Ingress Tool Transfer, Indicator Removal from Tools, Domain Account, Internal Proxy, Service Execution, Windows Remote Management, SMB/Windows Admin Shares, Rundll32, Windows Service, Application Layer Protocol, Python, SMB/Windows Admin Shares, Windows Management Instrumentation, Security Account Manager, Make and Impersonate Token, Exploitation for Client Execution, Network Service Discovery, Timestomp, Distributed Component Object Model, Multiband Communication, Commonly Used Port, Network Share Discovery, Custom Command and Control Protocol, Process Discovery, Make and Impersonate Token, Data from Local System, Office Template Macros, Windows Command Shell, Obfuscated Files or Information
S0559 SUNBURST (Citation: FireEye SUNBURST Backdoor December 2020) (Citation: Microsoft Deep Dive Solorigate January 2021) (Citation: SolarWinds Sunburst Sunspot Update January 2021) (Citation: Solorigate) Time Based Evasion, Disable or Modify Tools, Windows Management Instrumentation, System Information Discovery, Modify Registry, Symmetric Cryptography, Standard Encoding, Clear Persistence, Data from Local System, File and Directory Discovery, System Network Configuration Discovery, Obfuscated Files or Information, Image File Execution Options Injection, Rundll32, System Service Discovery, Match Legitimate Name or Location, Code Signing, Process Discovery, Protocol Impersonation, Junk Data, Visual Basic, DNS, File Deletion, Clear Network Connection History and Configurations, System Checks, Query Registry, Security Software Discovery, System Owner/User Discovery, Ingress Tool Transfer, Indicator Removal from Tools, Web Protocols, Steganography, Dynamic Resolution, Indicator Removal
S0002 Mimikatz (Citation: Adsecurity Mimikatz Guide) (Citation: Deply Mimikatz) (Citation: Microsoft 365 Defender Solorigate) DCSync, Credentials from Password Stores, Rogue Domain Controller, Private Keys, SID-History Injection, Security Support Provider, Pass the Hash, Account Manipulation, Pass the Ticket, Credentials from Web Browsers, Golden Ticket, Security Account Manager, LSASS Memory, Silver Ticket, Windows Credential Manager, Steal or Forge Authentication Certificates, LSA Secrets
S0562 SUNSPOT (Citation: CrowdStrike SUNSPOT Implant January 2021) Process Discovery, Access Token Manipulation, File Deletion, Obfuscated Files or Information, Stored Data Manipulation, File and Directory Discovery, Execution Guardrails, Compromise Software Supply Chain, Native API, Deobfuscate/Decode Files or Information, Match Legitimate Name or Location
S0552 AdFind (Citation: FireEye FIN6 Apr 2019) (Citation: FireEye Ryuk and Trickbot January 2019) (Citation: Microsoft Analyzing Solorigate Dec 2020) (Citation: Red Canary Hospital Thwarted Ryuk October 2020) Domain Trust Discovery, Domain Groups, System Network Configuration Discovery, Remote System Discovery, Domain Account

References

  1. MSRC. (2020, December 13). Customer Guidance on Recent Nation-State Cyber Attacks. Retrieved December 30, 2020.
  2. MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.
  3. Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020.
  4. MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.
  5. Microsoft 365 Defender Team. (2020, December 28). Using Microsoft 365 Defender to protect against Solorigate. Retrieved January 7, 2021.
  6. FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.
  7. Symantec Threat Hunter Team. (2021, January 18). Raindrop: New Malware Discovered in SolarWinds Investigation. Retrieved January 19, 2021.
  8. CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.
  9. Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.
  10. Smith, L., Leathery, J., Read, B. (2021, March 4). New SUNSHUTTLE Second-Stage Backdoor Uncovered Targeting U.S.-Based Entity; Possible Connection to UNC2452. Retrieved March 12, 2021.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.