Apt

Target cyberattack ( targeted cyberattack ^[1] ) - a type of cyberattack , the process of which is controlled manually in real time by a person who is the center of attack. The purpose of this attack is to steal protected information from the information system of a particular company, organization or public service. Important distinguishing features of targeted attacks include their duration, long and resource-intensive training period, as well as the use of not only technical and computer tools for its implementation ^{[8] [9]} . An integrated approach to building an attack can include an active impact on people using psychology and social engineering methods, together with zero-day exploits on equipment ^[5] .

The term APT can also be used to denote a complex of all kinds of hardware and software, utilities and software necessary to carry out a targeted attack. At the moment, there is a huge variety of all kinds of attack tools that potential attackers can gain access to online or in shadow markets. Most modern security systems do not require the creation of unique hacking tools and lend themselves to existing tools in the right combination and with the right strategy ^[10]

A targeted attack can pose a serious threat to the company's information security due to the complexity of detection and the severity of the consequences. On average, an attack is detected 200 days after its onset. And even after the fact of the presence of APT in their network is established, companies are not always able to get rid of the threat or at least minimize its impact ^[7] . This leads to a long downtime caused by attempts to regain control, as well as to investigate the incident. Material losses from large attacks on average around the world are $ 551,000 ^[11] .

APT attack can pursue a variety of goals ^[10] . Namely, theft of money or personal data ; manipulation of business processes, weakening in competition, blackmail and extortion; intellectual property theft; attempts to make a political statement or disrupt the operation of urban infrastructure ^{[12] [13]} .

There are 4 stages of the target attack ( preparation, penetration, distribution, goal achievement ), each of which is accompanied by activities aimed at hiding the traces of presence in the system ^[1] .

Preparation

Preparation includes determining the goal, finding the maximum amount of information about it, identifying weaknesses in the security system. Then a strategy is developed, penetration means are selected from previously created ones, or new, specialized ones are created, then they are tested on models.

The choice of an organization as a target, as well as the determination of the tasks of the upcoming attack, is more often carried out by order of interested parties, or, after monitoring the market, in private. As a monitoring tool, generally accessible methods are used, such as RSS feeds, official accounts of companies in social networks, various specialized forums where employees of target companies can be active ^[10] .

Further exploration is carried out to detect vulnerabilities . And, since the technical means used to protect the information network are non-disclosed information, they try to find out the structure of the information system and its weaknesses using any available method, including through social engineering ^[14] .

Some methods of reconnaissance ^{[15] [16]} .

• Insider . Criminals receive the necessary information from recently dismissed or current employees of the company. At the same time, it is not necessary through direct bribery or blackmail, the ex-employee may not even realize that he has become a source of private data. For example, a frequent meeting: a former employee of the company is invited to an interview for a new position that may interest him. During the interview, a fake HR specialist provokes an employee to show his qualities as a specialist, thereby giving out information about his previous job ^[10] .
• Open sources . The dishonesty of companies in relation to the destruction of paper media , laying out lists with the names of employees on official websites, state portals, etc. allow attackers to collect fairly complete information about the victim company. Namely, the names of employees, e-mails and telephones; work schedules of company divisions; various internal information, as well as information about business partners. All information obtained in this way is successfully used in social engineering methods to gain trust and / or deceive company employees ^{[1] [5]} .
• Social Engineering . Includes many methods. For example, communicating with a victim employee through social networks or using phone calls, criminals are represented by the names of internal employees in order to obtain the necessary information or to force them to take the necessary action ^[17] .

After carefully elaborating a strategy that takes into account all stages of penetration (including the actions of criminals in case of emergency situations), they create a so-called stand (a fully operational model of the attacked software and security system). This model allows you to work out implementation techniques, track possible channels of bypassing detection tools and make sure that you can hide all traces of penetration ^[10] .

It should be noted that this and subsequent stages can be very costly for criminals. In particular, it is sometimes more profitable for criminals to write the necessary set of attack tools on their own than to pay for an already prepared and not optimized one. As a rule, such a set (Toolset) consists of a command center (C&C) ^[18] , penetration tools and the main malicious module ^[19] .

Penetration

At this stage, zero-day vulnerabilities are used, as well as all possible social engineering techniques. After verifying that it has penetrated the required host , the attacker gives the command to install malicious code through the control center (C&C).

The main means of penetration and their purpose:

• Exploit is the main penetration tool. The most commonly used vulnerabilities in Adobe PDF,

Adobe Flash, Microsoft Office, and Internet Explorer ^[20] . This software can be delivered via email, web sites, or USB devices ^{[21] [22]} .

• Validator is a program for collecting and checking information from an infected host and transmitting it (in encrypted form) to the control center, where a person makes a decision on whether to continue the attack. They are given the appropriate command: load Dropper to start the attack, either self-destruct if the data on the host have no value, or enter the waiting process if the decision is delayed ^[10] . Software is delivered via email , through websites, and much less often through USB devices. An important feature of this software is its safety for criminals. Even in case of interception by the security service, the program does not carry information about the attack itself or about the attackers ^[21] .
• Downloader - a program for quickly infecting a host, delivered via phishing through email attachments, or through phishing sites. When launched, it loads the main malicious Payload or Dropper module.
• Dropper is a Trojan for delivering (via hidden autoloading ) a Payload module to a victim’s machine. Delivered via email, websites, exploit and validator. Usually, a program embeds its own code in the code of the most active process running on this computer, directly in RAM.
• The main malicious module in the target attack, loaded onto the infected host by Dropper, may consist of several additional functionalities. modules, each of which will fulfill its function ^[10] :
  • Keylogger
  • screen recording;
  • remote access ;
  • distribution module within the infrastructure;
  • interaction with C&C and updating;
  • encryption
  • cleaning traces of activity, self-destruction;
  • reading local mail;
  • information search on a disk.

The module itself is created with multi-level encryption to protect against attack detection and to conceal information about criminals.

Distribution

In this phase, the attacker tries to distribute his code as much as possible over the information network, focusing on key points - workstations and servers, necessary to achieve the objectives of the attack. It uses RDP remote access, and works under legitimate administrator rights and cannot be seen by the security system ^{[23] [24]} .

Goal achievement

At this stage, either theft (accompanied by compression and encryption) ^[25] , or a change in classified information, or other manipulations required by an attacker. This is followed by concealment of traces and, if necessary, leaving points of return to the system ^[26] .

The main way to counter targeted attacks is to prevent them from starting , since an active attack is extremely difficult to notice. Among the standard technical means of prevention, we can distinguish signature analysis , enforcing rules for network connections, black and white lists of applications, as well as the use of firewalls and intersegment control, IDS / IPS , SIEM , content filters , the joint use of file antiviruses and current anti-spam Policies to eliminate threats from mass mailings (for example, password-protected archives with malicious code). An important part of preventing APT attacks is the training of personnel in the correct information security policy. ^[7] . ^[27]

If the attack was nevertheless launched, or there is an assumption of its presence, the task of detection and localization is posed. Although there are a number of different measures aimed at detecting APT, they are often ineffective ^[28] . Among such measures, we can distinguish services that offer system checks, sufficiently competent security specialists, automated security event processing systems, as well as current data on existing threats ^[29] , for example, Threat Data Feeds - a service containing the following information ^[30] :

• A set of URLs corresponding to the most malicious links and Web sites.
• IP Reputation - A ranking of IP addresses by security level.
• A set of file hashes spanning malware.
• Botnet activity.

If the fact of the attack is confirmed, measures must be taken to stop it, and the damage inflicted is revealed.

However, even if a threat has been detected and corrective measures have been taken, APT may remain in the system for years ^[11]

Not all incidents with APT attacks become known to the general public, since public statements about one attack can provoke new ones, as well as give criminals the opportunity to take into account mistakes. However, some major attacks have been documented ^{[31] [32] [33]} .

1998-2000

• Moonlight Maze is a successful attack on the Pentagon , NASA , and the US Department of Energy .

2007

• The attack on the Oak Ridge National Laboratory is an example of the successful use of social engineering, criminals got legal access to the system via e-mails, after which they allegedly stole information from the laboratory’s databases.
• The attack on the Los Alamos National Laboratory is one of the incidents among the mass attack on American laboratories.

2008

• Attack on the US Department of Defense . Foreign influence agents managed to install the malware into the ministry’s system using a USB flash drive. The code has spread to a huge number of computers.
• Attack on Office of His Holiness the Dalai Lama - the criminals received a user password for the system, and then in a legitimate letter they replaced the contents in order to gain remote access to the OHHDL system.

2009

• GhostNet - the largest action of cyber espionage, infected more than 1000 computer networks, including government, in more than 100 countries.
• Stuxnet - an attack by some organization, presumably located in Iran, against a number of companies using the Stuxnet worm was carried out with the aim of reprogramming industrial gas pipeline control systems and power plants to gain access to the Iranian nuclear program.
• Night Dragon is an attack against global oil and gas companies. Attackers used social engineering and Windows system vulnerabilities to gain access to internal accounts and information.
• Operation Aurora is an attack on Google’s infrastructure to steal source code.

2010

• Stuxnet - continued.
• The Australian Resource Sector is an attack on three large Australian resource companies: BHP Billiton, Fortescue Metals Group and Rio Tinto.
• Attack on the French government - criminals were able to remotely control government computers and extract documents, remaining undetected for more than 3 months.

2011

• Attack on the French government - continued.
• Attack on the Canadian government - criminals managed to fake emails to employees, as if they were coming from the leadership. The letters themselves carried malware that gave criminals access to sensitive data.
• Attack on the Australian government - criminals gained access to senior government correspondence for at least a month.
• Comodo Affiliated Root Authority — атака на центр сертификации, в результате которой в сети появились поддельные SSL сертификаты известных доменов, например mail.google.com, www.google.com, login.yahoo.com, login.skype.com, и т. д.
• Oak Ridge National Laboratory — преступники воспользовались атакой нулевого дня для Internet Explorer , остается неизвестным, были ли похищены какие-либо данные, однако работа лаборатории была остановлена на двое суток.
• Атака на международный валютный фонд . Потребовала написания уникального ПО, в результате чего преступники получили доступ к важной политической и экономической информации.

Разработкой и планированием атак занимаются группы людей, обладающих достаточными знаниями. Чаще всего целью их нападения становятся банковские системы ^[34] .

• Carbanac — международная группировка, все ещё активна (2015г).
• METEL — русская группа, активна (2015г).
• GCMAN — русская группировка, частично нейтрилизована (2015г)
• Blue Termit — южно-корейская группа.