CASE STUDY

Actively Countering Advanced Persistent Threats with External Telemetry

by | Apr 7, 2020 | Adversary Research, Case Study, Outside Intel

The Challenge

A technology company (the Client) with thousands of employees across the globe was under attack by a nation-state level adversary. They requested Nisos’ assistance to provide critical intelligence to detect indicators and respond to the attack. Given the nature of the Client’s platforms and sensitive data, the Client has been and continues to be a target of nation-state actors.

Why Nisos

The Client requested our access and expertise to analyze edge network telemetry beyond the reach of their SOC to ensure the adversary no longer maintained access following the Client’s incident response effort. While the Client responds to security incidents on a daily basis, they called in our expertise when it was clear an advanced attacker had gained access to their environment. They required a high level expertise and an adversarial mindset to bear against this problem set. More specifically, the Client needed to confirm whether the attacker was truly out of their network and whether or not Nisos could identify any additional details that would provide the SOC with actionable threat intelligence to counter future attacks.

Preparation

We did not require network access to the Client’s environment. We used our access to discreet, external telemetry and proprietary datasets to support the engagement. We established an out-of-band communications channel using an encrypted chat application in the event the Client’s email was compromised.

Execution

The Client SOC displayed well above average ability to detect and respond to sophisticated attacks for a mid-market technology company. The Client’s SOC was able to detect and correlate the following adversary actions:

  • Scanning activity on the edge of their network
  • Initial access via client-side exploitation
  • Credential harvesting via in-memory mimikatz
  • Lateral movement using remote service creation and WMI
  • Process trees associated with malicious activity
  • Persisted keystroke logger and screenshot capture tools (on-disk)
  • Command and control (C2) traffic

Using a variety of both commercially available and proprietary technical datasets, we assisted the Client’s SOC in identifying:

  • The actor’s C2 server
  • The use of the commercial attack platform with an https profile
  • The source range from where the C2 server was managed
  • Additional C2 servers, using the same management port, in use with other active targets
  • Management activity associated with the C2 server
  • The Digital Ocean VPS used for port and web application scanning

Above and Beyond Traditional EDR
Shortly after the attack, the Client’s Endpoint Detection and Response (EDR) vendor alerted the Client of a sophisticated attack occurring on the Client’s network. While the vendor had significant EDR telemetry at its disposal, their analysis was insufficient to identify the C2 server and only provided confirmation of what the SOC had already observed.

The EDR vendor’s analysis mistakenly identified an intermediate Certificate Authority IP address as the IP address for the C2 server and failed to identify the installation and persistence of a keystroke logger and screenshot capture tool. The EDR vendor correctly identified this as a sophisticated attack, but this conclusion was reached solely based on the attacker’s lack of typos in executing native commands and powershell.

Using a list of IPs the vendor sent the Client’s SOC, we assisted the Client in determining they were related to the attacker. However, the IP information alone failed to identify the attacker’s C2 server until Nisos provided additional telemetry. It was clear the EDR vendor had a limited window into the attack and experienced difficulties in differentiating benevolent host traffic from actual malicious traffic.

Impact

With Nisos’ assistance, the Client was able to identify and mitigate an advanced attack within hours of the initial compromise and the Client’s detection of the attack. This prevented the attackers from gaining a foothold on the network and armed the Client with actionable intelligence to have equal defensive success should this attacker attempt to return in the future. Based on a team effort, combining analysis from the Client, the EDR vendor, and Nisos, the Client was confident the attackers were no longer active in the network and did not compromise any critical internal resources.

Whether it is supporting a Client’s internal security team or working alongside other security service providers, Nisos can bring capabilities to bear that go beyond the Client network and cursory analysis. Nisos’ wealth of experience and data analytics can augment the team and make everyone a more effective network defender.

About Nisos

Nisos is the Managed Intelligence™ company. Our services enable security, intelligence, and trust and safety teams to leverage a world-class intelligence capability tailored to their needs. We fuse robust data collection with a deep understanding of the adversarial mindset delivering smarter defense and more effective response against advanced cyber attacks, disinformation, and abuse of digital platforms.

For additional information, contact info@nisos.com

Adversary Research
Discovering the methods, motives and identity of threat actors to disrupt attacks 
Reputation Defense
Technical guidance for countering disinformation and slanderous attacks 
Trust & Safety
Intelligence to secure business operations and defend against fraud, abuse and e-crime 
TPRM Exposure
Adversary-centric intelligence to address supplier, M&A and investment risks 
Outside Intel
Research for defending outside the firewall that leverages tier 3 intelligence programs 
Executive Shield
Assessment of threats to key personnel with attribution and PII takedown  
Adversary Insights℠ Retainer
Annual retainers for client-driven inquiries and rapid-response research 
Intelligence Team as a Service
Collaborative engagement providing robust intelligence and tier 3 cyber analysts  
Event-Driven Intel Investigations
Multidimensional security fact-finding that delivers insights into adversary behavior 
On Demand Threat Research
Proactive and preventative investigations that reveal threat actor context and risk correlations 
Investment Zero Touch Diligence℠
Project-based discovery to assess risk for investments, IPO, Mergers and Acquisitions 
TPRM Zero Touch Diligence℠
Subscription assessment of external network hygiene, key personnel, and non-traditional business risks