Hello and welcome to
another application of the minor
attack framework discussion today
in the initial access phase of
the framework, we are looking at
spear fishing links.
So what are the objectives
of today's discussion?
Well, we're going to define what
a spear fishing link is.
We're going to look at Turlough,
which is a threat group.
We're going to review mitigation
techniques and we're going to review
some detection techniques.
So with that, let's
go ahead and jump right in to our
definition.
So spearfishing link, it is an
attempt by an attacker to
have a victim use
a link to download malware instead
of using attachments
or to send them
to a malicious site to attempt to
steal credential access.
And so the goal here is to
circumvent filters
and not send a
payload directly to the user via
an attachment.
And so, again, techniques
here are similar to social
engineering, if not exactly
the same, requires the user
to interact with the content
and execute the payload.
So an example would be you have a
link that's provided
for your bank, but it's actually
taking advantage of a redirect
vulnerability.
In that particular bank
or that may have been discovered,
and so you initially log in
and then it redirects you to an evil
account, which then
allows the attacker to get
credentials or have access
to those systems.
And so if you
ever receive a link or something of
that nature that you don't trust,
it's always best to go straight to
the site to review information and
not use links, even if you think
it's a trusted source.
Now, let's talk about a particular
threat actor.
So in this case, TALLA, or Water
Bug is a Russian based
group that has impacted
organizations in over forty five
countries known for watering
hole and spear fishing campaigns.
And so some of their targets include
government embassies,
military education
and research and pharmaceutical
companies. Now,
before we move on, I'm just going to
pull up a Web browser real quick and
we're going to go over to the attack
framework site.
And we want to look at this group
known as Mutola,
so let's go back here.
All right.
So the great thing
again about the framework is that
we're able to easily come and see
this group.
Now, what we didn't have
in the slides was that
they had heightened activities that
were seen in the mid 20 fifteens.
This waterhole and spearfishing
campaign is used through
in-house tools,
mainly attacking windows machines,
but they've been known to target
other O.S.S..
Now, some of the techniques used
here by the group go beyond just
initial fishing.
They seem to use encrypted data.
They modify registry information.
They use power shell.
So they've got a number of different
ways.
Once they gain access to a system
that they'll move through systems
and establish persistence
and things of that nature.
Now, some of the software is used
Mimecast Empire, so it's just
a full list here of different
areas. But the great thing, again,
about this
particular framework and what we can
do with it is that if we go to one
of the references in this case
provided by Kaspersky, it
look like
we can get some further examples
about the operation and
some technical appendices and IOCs
as far as things that they do
when they compromise systems.
And so in this case,
they show some CBD for Adobe
PDF exploits using spear
fishing.
There's some of the social
engineering information as far as
some of the extensions and
installers,
water holing as far as using
this particular Java exploit.
And so if you're in the particular
vertical, that would make you
vulnerable to or a target
for Thiola, then these are
some areas that you can focus on
taking advantage of.
The other thing that is nice to
see here is some examples
of where they've injected
websites with that particular
Java vulnerability.
And so these are just some examples
of sites that have been hit and
some of the
sites where they had
injected their
particular malware.
Now you can see it's not huge
as far as this particular statistic
or this bit of information, but that
still can be impactful.
It also goes into
where you can see this particular
remote JavaScript in the victim
browser.
And so they give an example here
toward the bottom in this particular
panel.
So great to come
through again and just look at some
of the methodologies of these
individuals and some of the ways
that they attack systems.
So let's go ahead and get back to
our slides.
So what are some mitigation
techniques that we can take
advantage of when dealing with
spearfishing links and threat actors
where we saw a lot of different
things like the JavaScript injection
there, the Adobe issues?
Really, what we want to try to do
overall in our mitigation efforts
is to restrict
the sites that users can visit
to those that are necessary to
content to conduct business
operations. Now,
depending on who you ask,
depending on the type
of organization that you run,
this may be seen as
restrictive or as, you know,
nonproductive or is non beneficial
to the workforce. It may make people
feel like you're oppressive,
but really, when you implement
these types of controls, it's best
to pair that within user
awareness, training and education.
You want to explain to
folks why it is that you're blocking
sites that aren't necessary for
business operations or limiting
those sites to maybe US
based or regional based
organizations.
And if you pair that within user
training and you educate them on the
type of threats that are out there
and what it is that they
are looking for and how
they should be protecting the
organization, it can make
these types of controls less
impactful to morale and things of
that nature.
Now, some detection techniques that
we can use email.
You are all inspection.
And so if you've got a particular
platform that will inspect
the URL to maybe execute
it in a sandbox
type environment and see if it goes
to something malicious or attempts
to download a malicious payload
that can be beneficial, block and
alert on known malicious sites,
access attempts.
Of course, this is not helpful for
new sites, meaning that
in most cases where
social engineering campaigns are
spearfishing campaigns or phishing
campaigns in general come into play.
When actors are pretty good at
spinning up news
sites to avoid blocking and
blacklisting and things of that
nature, they'll run that site for a
day or two and then they'll pull
up another site and do something of
that nature. So this may be
beneficial to a degree, but maybe
not for more.
Current attacks were thrown.
Actors are actively changing
sites and things of that nature
and then have a system
in place for users to report
suspicious emails.
And I can hear
the administrators out there, the
network administrators, rolling
their eyes real hard and gasping
at the thought of end users
being able to report anything
as potential phishing emails
or spam or whatever the case may be,
which is what we see a lot of times
is that end users report more spam
than they do legitimate,
you know, emails that could be
threatening. But because
they get in the habit of reporting
so many different things, we do
oftentimes see a pattern
where three or four users
will report the same email that is
in fact malicious in
nature, or they'll report
suspicious emails that don't seem to
be the normal communication
patterns of executives
and things of that nature.
So it can be cumbersome initially,
but again, with proper training,
it's really beneficial and can
help to limit the ability of these
superefficient links from being
successful.
Now let's do a quick check on
learning, spearfishing
links, use a link to download
malware instead of using
attachments, or to send a victim
to a malicious site to attempt to
steal credentials or access,
true or false.
So please, if you need additional
time to evaluate the statement
or look into anything, please pass
the video.
So this is in fact a
true statement.
Spearfishing links are
used or are links.
Use a link to download malware
instead of using attachments to send
a victim email or
to send the victim to a malicious
site to attempt to steal credentials
or access.
So this is a true
statement. Congratulations if you
got that correct. If not, that's OK.
Reread some of the information and
try again.
Now, in summary,
we define what a spear fishing link
is. And looked at some examples,
we went to the miners site and
looked at some information on CHIRLA
and reviewed some examples of
their Java injection attacks,
again, if they send you a link,
it can redirected to one of those
sites that could then
maliciously download something or
download something that is
malicious.
And, you know, that's
kind of how they could gain initial
access or get information
from a system.
We reviewed some mitigation
techniques talking about blocking
sites that are not necessary for
business functions and
pairing that with education and
ensuring that we talk to end users.
And then we did a review of some
detection techniques, so
all of this is beneficial
with respect to initial
access and understanding this
particular attack vector and how
you can apply controls and
techniques to mitigating risks
using the minor attack framework.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.