Picking Up the Pieces: How Campaigns Can Help Us Better Track Groups

Picking Up the Pieces: How Campaigns
Can Help Us Better Track Groups
Adam Pennington (@_whatshisface)
MITRE ATT&CK Lead
©2022 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 22-00744-9.

Problems with long duration groups
What about ransomware?
A bit about threat groups
What adversary change looks like
(Re) Introducing campaigns
Today’s Journey

Building a Threat Group
Incident
Incident
Incident
Incident
Incident
Incident Incident
Incident Incident
Incident Incident
Threat Group
Mauve Ostrich
APT1337
Angry
Gecko
G0256

Adversaries often reuse behaviors from incident to incident
One of the main ideas behind ATT&CK
Our Adversaries Change
Over time, small changes can add up to complete transformation
However

G0016/Cozy Bear/APT29 in ATT&CK
§ 48 References – Oldest published in 2015 with intel back to at least 2008
§ 12 Associated Groups
§ 142 ATT&CK Techniques – Every tactic but Impact
§ 46 Software Entries
©2022 The MITRE Corporation. All rights reserved. Approved for public release. Distribution unlimited 22-00744-9. https://attack.mitre.org/groups/G0016/

G0016/Cozy Bear/APT29 Over Time
Early Years
(~2008-2013)
§ Spearphishing attachments
§ Operation within enterprise network
§ Custom malware
§ Windows command shell use
§ Trusting of victim environment
§ Artifacts left behind/files on disk
§ Some cleartext C2

If you know, you know.
Middle Age
(~2014-2016)
§ Custom malware + commodity tools
§ E.g., Microsoft SysInternals
§ Extensive PowerShell use
§ Immediate deletion of files
§ Overwritten with SDelete
§ Paranoid hunting for honeypots
§ TLS with Ephemeral Diffie-Hellman
== Changed from early years

Modern Era
(~2017-now)
§ Supply chain attacks
§ Extensive use of cloud resources
§ Commercial malware
§ E.g., Cobalt Strike
§ Extensive WMI use
§ Fileless techniques

G0016/Cozy Bear/APT29 Combined Group
✓ Focus on a broad set of
behaviors to defend against
✓ More complete picture of a
group over time
✓ Helps fill in intelligence gaps
✗ Adversary represented never
existed at any given time
✗ Can’t use to emulate current
or past adversary
✗ Loss of fidelity
✗ Misguided prioritization
§ Supply chain attacks
§ Extensive use of cloud resources
§ Custom + commercial malware +
commodity tools
§ Windows command shell use
§ Extensive WMI use
§ Artifacts left behind/files on disk
§ Fileless techniques
§ Trusting of victim environment
§ Some cleartext C2

Similar but Different Issues with Ransomware
§ Ransomware affiliates are being combined based on software
§ Sloppy CTI practice
§ Affiliates have unique styles even starting from the same playbook
§ Similar losses of fidelity as combining years
Ransomware-as-a-
Service Operator
RaaS Affiliate RaaS Affiliate
🛠Tools 📖Playbook
💰Payment 💧Leak site
Processing
🛠Tools 📖Playbook
💰Payment 💧Leak site
Processing
Inspired by: https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/

On a Sunday in December

Extensive Tracking of UNC2452
https://medium.com/mitre-attack/identifying-unc2452-related-techniques-9f7b6c7f3714
https://github.com/center-for-threat-informed-defense/public-resources/blob/master/solorigate/README.md

UNC2452 Widely Agreed to be APT29
§ 50 techniques from UNC2452 merged into G0016/APT29 in ATT&CK v9
§ Multiple researchers have asked us how to separate out UNC2452 in ATT&CK
§ …You can’t

Campaign
A grouping of intrusion activity
conducted over a specific period of time
with common targets and objectives; this
activity may or may not be linked to a
specific threat actor.
https://medium.com/mitre-attack/attack-2022-roadmap-cd5a1a3387c7

Campaigns
§ Familiar CTI concept, but often not used in threat group tracking
§ Break groups back out into clusters of activity that share
§ A relatively short time period (generally days or months not years)
§ A common objective
§ Individual intrusions in a campaign might not share:
§ Specific software or behaviors
§ Victim country/industry/role

A Threat Group into Campaigns
Incident
Incident
Incident
Incident
Incident
Incident Incident
Incident Incident
Incident Incident
C0154/Solorigate
C0194
C0199/GRIZZLY STEPPE
C0155/PowerDuke
G0016
APT29

Campaigns in ATT&CK
§ Introducing in ATT&CK v12 (October 2022)
§ May or may not be connected to a Group
§ May or may not have a name
§ ATT&CK currently only tracks named threat groups
§ Will be tied to a period of time
§ Existing content will be converted as resources/contributions allow

What Does Structuring with Campaigns Get You?
✓ More accurately represents how an adversary looked at a given time
✓ Sets up for emulation of multiple periods of an adversary
✓ Keeps the fidelity of clusters of incidents
✓ Allows prioritization of current adversary (if there’s a campaign)
Can still look at a group’s campaigns combined, enabling:
✓ Focus on a broad set of behaviors to defend against
✓ A complete picture of a group over time

Takeaways
Adversaries change behavior slowly, but even
with slow change can completely transform
Building long term threat groups can be useful,
but can make our intel less actionable
Introducing a bit of structure can restore some of
the context we’ve lost

Adam Pennington
@_whatshisface
https://attack.mitre.org
@mitreattack

Reports Shown in Slides
§ https://cyber.dhs.gov/ed/21-01/#supplemental-guidance
§ https://blogs.microsoft.com/on-the-issues/2020/12/13/customers-protect-nation-state-
cyberattacks/
§ https://www.solarwinds.com/sa-overview/securityadvisory
§ https://www.mandiant.com/resources/blog/unc2452-merged-into-apt29
§ https://blog-assets.f-secure.com/wp-content/uploads/2020/03/18122307/F-
Secure_Dukes_Whitepaper.pdf
§ https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-report-april-2017.pdf
§ https://www.mandiant.com/sites/default/files/2021-09/rpt-poison-ivy.pdf
§ https://www.fbi.gov/wanted/cyber/apt-10-group

Picking Up the Pieces: How Campaigns Can Help Us Better Track Groups

Recommended

Recommended

More Related Content

Similar to Picking Up the Pieces: How Campaigns Can Help Us Better Track Groups

Similar to Picking Up the Pieces: How Campaigns Can Help Us Better Track Groups (20)

More from Adam Pennington

More from Adam Pennington (10)

Recently uploaded

Recently uploaded (20)

Picking Up the Pieces: How Campaigns Can Help Us Better Track Groups