,
4 tweets,
25 min read
Read on Twitter
@ItsReallyNick @cglyer @FireEye @r00tbsd @SecurityBeard @CyberAmyntas @sj94356 @bread08 @DHSgov @CISAKrebs @CISAgov @riskybusiness @shmoocon @mattifestation @_devonkerr_ @williballenthin @cteo13 @Mandiant @gentilkiwi @PyroTek3 @NotMedic @DerbyCon @TalBeerySec @byt3bl33d3r @FSecure @lehtior2 @salesforce Next we discussed email. #APT29 consistently stole email throughout the intrusion. In addition to stealing mail from VIPs, they targeted the IR team to monitor the investigation. This made for some interesting opportunities for counter-intel (e.g. OOO msg during remediation) 41/n
@ItsReallyNick @cglyer @FireEye @r00tbsd @SecurityBeard @CyberAmyntas @sj94356 @bread08 @DHSgov @CISAKrebs @CISAgov @riskybusiness @shmoocon @mattifestation @_devonkerr_ @williballenthin @cteo13 @Mandiant @gentilkiwi @PyroTek3 @NotMedic @DerbyCon @TalBeerySec @byt3bl33d3r @FSecure @lehtior2 @salesforce #APT29 used a PowerShell script to dump mail through Exchange Web Services (EWS). Their script provided options to select inbox/sent/trash and date range. We were able to reconstruct their activity, based on output captured in PowerShell logs (once PS logs were enabled). 42/n
@ItsReallyNick @cglyer @FireEye @r00tbsd @SecurityBeard @CyberAmyntas @sj94356 @bread08 @DHSgov @CISAKrebs @CISAgov @riskybusiness @shmoocon @mattifestation @_devonkerr_ @williballenthin @cteo13 @Mandiant @gentilkiwi @PyroTek3 @NotMedic @DerbyCon @TalBeerySec @byt3bl33d3r @FSecure @lehtior2 @salesforce The script used legit Microsoft.Exchange.WebServices.dll to interact with EWS. We documented this, along with various other email theft methodologies we've seen #APT29 use, in MTrends 2017: bit.ly/2n5YOP7
43/n
43/n
@ItsReallyNick @cglyer @FireEye @r00tbsd @SecurityBeard @CyberAmyntas @sj94356 @bread08 @DHSgov @CISAKrebs @CISAgov @riskybusiness @shmoocon @mattifestation @_devonkerr_ @williballenthin @cteo13 @Mandiant @gentilkiwi @PyroTek3 @NotMedic @DerbyCon @TalBeerySec @byt3bl33d3r @FSecure @lehtior2 @salesforce #APT29 email theft was consistent during the intrusion. Each time they:
1⃣Compromised a new host w/ SEADADDY
2⃣Downloaded tools to folder under %temp%
3⃣Downloaded email w/ EWS script
4⃣RAR'd the data
5⃣Uploaded the RAR archive
6⃣Sdeleted the evidence
7⃣Abandoned the host
44/n
1⃣Compromised a new host w/ SEADADDY
2⃣Downloaded tools to folder under %temp%
3⃣Downloaded email w/ EWS script
4⃣RAR'd the data
5⃣Uploaded the RAR archive
6⃣Sdeleted the evidence
7⃣Abandoned the host
44/n
