PwC and BAE Systems have recently concluded an intensive investigation into an espionage network dubbed APT10. Our Advanced Cyber Defense team in Switzerland has been involved in the detection, response and remediation of the attack in multiple sectors where Swiss based clients have fallen victim to this campaign.
Over the last year we have seen sustained targeted attacks against major organisations in Switzerland. The attacks have specifically targeted managed IT service providers (MSPs) and used these networks to reach MSPs customers. This potentially gave unprecedented global access to the intellectual property and sensitive data of those MSPs and their clients.
As part of the investigations carried out by our Swiss, UK and global teams, we have linked these activities to similar attacks in more than 14 countries. PwC has gone public with this because although we have already seen several companies compromised, there may be many other organisations affected. We recommend performing a cybersecurity breach assessment to detect whether your organisation has been previously compromised, and to use tailored threat intelligence to manage risk effectively.
World-wide, the campaign has targeted many Japanese state entities, and in the US, defence-related as well as telecommunication companies. The construction, retail and consumer, energy and mining, technology, professional services, metals, industrial manufacturing, and public sector were also targeted.
What is APT10?
APT10 has targeted “managed IT service providers” and has used them as a springboard to crawl through networks. The group behind the campaign has been using a wide variety of malware which has evolved over time. This has included: RedLeaves, PlugX, Poison Ivy, EvilGrab, and mimikatz. These tools used as part of the campaign have been around for quite some while and passed around within criminal circles.
The campaign uses an impressive network of command-and-control servers. PwC assesses the energy and resources invested into the campaign as high and sustained.
PwC was successful in attributing the attack to the campaign by seeking analytical conclusions from a variety of disciplines and perspectives, all pointing to the same conclusion. Reverse engineering of the malware revealed a command-and-control infrastructure as well as recognisable characteristics. Additional folders and file conventions and paths further shed light on associated techniques, tools, and procedures (TTPs). Robust intelligence corroborated with similar indicators and activities across related victims. Lastly, the modus operandi, targeted information and temporal analysis of activities when compared to similar activities at the time and in the industry reinforced PwC’s conclusions.
Several indicators point to the instigators being located in East Asia. Most strikingly, the timestamps of registration of domains for the important network of command-and-control servers as well as the compilation time would appear to make sense for an actor based within this region. Many of these indicators could be faked to induce investigators to draw the wrong conclusions. However, to do so consistently across several types of evidence, and without hinting at another geographical location would be rather exceptional.
Further investigations are still being carried out to try to determine more exactly who could be behind the attacks. Attribution is a lengthy investigative process, but we believe that the report needed to come out quickly to help organisations protect their networks as much as possible.
What to do
The report includes a long list of Indicators-of-Compromise. It is advisable to upload these into your systems to protect against future possible attacks. Furthermore, for organisations in targeted sectors with high value intellectual property we recommend conducting a threat hunt into your network to identify whether you have been targeted by the attacks.
PwC also recommends at a minimum two factor authentication for jump posts where managed service providers (MSP) enter client networks. The compromise and data exfiltration is done via system and MSP administrator accounts so having stronger controls around these entry points are key. Additionally, increasing visibility across the enterprise through a holistic logging policy would further assist.
Should you need any help to conduct such assessment, PwC would gladly assist you in any way we can. Don’t hesitate to get in touch with us: PwC Swiss Breach Aid Team
The report and the technical indicators can be found here
Cyber Security Leader
+41 79 345 01 24