Russian state hackers APT28 (Fancy Bear/Forest Blizzard/Sofacy) breached a U.S. firm by means of its enterprise WiFi community whereas being 1000’s of miles away, by leveraging a novel method known as “nearest neighbor attack.”
The menace actor pivoted to the goal after first compromising a corporation in a close-by constructing throughout the WiFi vary.
The assault was found on February 4, 2022, when cybersecurity firm Volexity detected a server compromise at a buyer web site in Washington, DC that was doing Ukrainian-related work.
APT28 is a part of Russia’s navy unit 26165 within the Basic Employees Most important Intelligence Directorate (GRU) and has been conducting cyber operations since at the least 2004.
The hackers, which Volexity tracks as GruesomeLarch, first obtained the credentials to the goal’s enterprise WiFi community by means of password-spraying assaults focusing on a sufferer’s public-facing service.
Nevertheless, the presence of multi-factor authentication (MFA) safety prevented the usage of the credentials over the general public net. Though connecting by means of the enterprise WiFi didn’t require MFA, being “thousands of miles away and an ocean apart from the victim” was an issue.
So the hackers turned artistic and began organizations in buildings close by that would function a pivot to the goal wi-fi community.
The thought was to compromise one other group and look on its community for dual-home gadgets, which have each a wired and a wi-fi connection. Such a tool (e.g. laptop computer, router) would permit the hackers to make use of its wi-fi adapter and hook up with the goal’s enterprise WiFi.
Volexity discovered that APT28 compromised a number of group as a part of this assault, daisy-chaining their connection utilizing legitimate entry credentials. Finally, they discovered a machine throughout the correct vary that would hook up with three wi-fi entry factors close to the home windows of a sufferer’s convention room.
Utilizing a distant desktop connection (RDP) from an unprivileged account, the menace actor was capable of transfer laterally on the goal community looking for methods of curiosity and to exfiltrate knowledge.
The hackers ran servtask.bat to dump Home windows registry hives (SAM, Safety, and System), compressing them right into a ZIP archive for exfiltration.
The attackers usually relied on native Home windows instruments to maintain their footprint to a minimal whereas amassing the info.
“Volexity further determined that GruesomeLarch was actively targeting Organization A in order to collect data from individuals with expertise on and projects actively involving Ukraine” – Volexity
A number of complexities within the investigation prevented Volexity from attributing this assault to any recognized menace actors. However a Microsoft report in April this yr made it clear because it included indicators of compromise (IoCs) that overlapped with Volexity’s observations and pointed to the Russian menace group.
Primarily based on particulars in Microsoft’s report, it’s totally probably that APT28 was capable of escalate privileges earlier than runing essential payloads by exploiting as a zero day the CVE-2022-38028 vulnerability within the Home windows Print Spooler service throughout the sufferer’s community.
APT28’s “nearby neighbor attack” reveals {that a} close-access operation, which usually requires proximity to the goal (e.g. parking zone), may also be carried out from afar and eliminates the danger of being bodily recognized or caught.
Whereas internet-facing gadgets have benefited from improved safety over the previous years, by including MFA and different forms of protections, WiFi company networks have to be handled with the identical care as every other distant entry service.
