View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Technology
  2. Cybersecurity
January 17, 2020

FBI Warns that Nation State Actor Hit Two US Cities Last Year

“Organized cybercrime entities are joining forces, and their likelihood of detection and prosecution is estimated to be as low as 0.05 percent in the United States.”

By CBR Staff Writer

The FBI has issued a flash alert to private industry partners, warning that nation-state hackers have breached two unnamed US municipalities within the last year, using a Microsoft SharePoint vulnerability, CVE-2019-0604.

“Malicious activities included exfiltration of user information, escalation of administrative privileges, and the dropping of webshells for remote/backdoor persistent access” an FBI alert said, adding that the compromised servers were used to steal Active Directive database compromise administrative credentials, and drop webshells for remote/backdoor access to the compromised servers.

“Four aspx webshells, all of which appeared to be variants of commonly available or open-source webshells, were uploaded to the compromised SharePoint server and used to facilitate additional access. The cyber actors uploaded a variety of publicly-available and open-source credential harvesting tools, such as Mimikatz, PowerSploit framework and PSEXEC to the C:\ProgramData\ directory,” it said.

“The actors named most of the tools with single-letter filenames (e.g., k.exe and h.bat) before deploying them to other systems on the network.”

The warning follows nearly 1,000 ransomware attacks in 2019 on public sector US bodies, including federal and state entities.

In a threat report published this week, security firm Radware found that attacks attributed to state-actors rose 42 percent last year.

Anna Convery-Pelletier, Radware’s CMO noted: “Nation-state intrusions are among the most difficult to thwart… as they have significant resources, knowledge of potential zero-day exploits, and the patience to plan and execute operations.”

Content from our partners
Why the tech sector must embrace faster, smarter talent recruitment
Sherif Tawfik: The Middle East and Africa are ready to lead on the climate
What to look for in a modern ERP system

FBI Nation State Cyber Warning

Both of the attacks outlined by the FBI used a vulnerability in Microsoft SharePoint servers. CVE-2019-0604 is a remote code execution vulnerability that occurred within Microsoft SharePoint when the application failed to check the source markup of application package.

In their security alert Microsoft noted that “an attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application pool and the SharePoint server farm account.”

The exploit has since been patched.

Hackers used this SharePoint vulnerability to breach the two municipalities and were able to exfiltrate user information and escalate privileges. The attack also included the dropping of webshells for remote/backdoor persistent access.

In its alert sent out to firms and institutions, such as UCLA, the FBI states that: “Due to the sophistication of the compromise and Tactics, Techniques, and Procedures (TTPs) utilized, it is believed that unidentified nation-state actors are involved in the compromise; however, it remains unknown whether these are isolated incidents or if they were conducted by the same cyber actors.”

Security Professionals

The work undertaken by cybersecurity professionals  is getting more difficult as firms adapt to new methods and infrastructure practices that involve an influx of previously unused technology, such as multi-cloud environments and microservices.

Radware’s Convery-Pelletier notes that: “Security professionals feel as though the battlefield is shifting under their feet. Companies are increasingly adding and relying upon new paradigms, like microservices, public and hybrid clouds, and IoT, which means the infrastructure is harder to monitor for attacks.”

In a recent survey commissioned by Radware 22 percent of responders didn’t know if they were attacked and 38 percent were unable to tell if a botnet had hit their network.

The World Economic Forum’s fifteenth Global Risks Report out this week, meanwhile, found that 76.1 of the people it surveyed said they expected the risk of attack against critical national infrastructure to rise in 2020.

Unfortunately the rate of detection and prosecution appears to be practically non-existent in the US as the report notes that: “Organized cybercrime entities are joining forces, and their likelihood of detection and prosecution is estimated to be as low as 0.05 percent in the United States.”

See Also: Fix England’s “Fragmented, Centralised” Skills System Urgently or Face a 2.5 Million Worker Deficit: LGA

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how New Statesman Media Group may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.
THANK YOU