Russian adversaries, known as Berserk Bear, Energetic Bear, TEMP.Isotope, TeamSpy, Dragonfly 2.0, Havex, Crouching Yeti, IRON LIBERTY, TG-4192, Castle, Dymallos, and Koala, that have been active since at least 2005, are playing 'Chekhov's Gun' with US infrastructure according to one of my favorite journalists, Andy Greenberg of WIRED. We have many customers in the energy sector and thought this would be an ideal threat actor to understand and emulate given the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) advisory on October 22, 2020. As usual for #ThreatThursday, we will understand Berserk Bear’s behavior, map to MITRE ATT&CK and share the ATT&CK Navigator JSON, create and share an adversary emulation plan in the largest, public adversary behavior repository, and discuss how to defend against this energy sector adversary. We hope you enjoy!
On October 22, 2020, the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) released Alert AA20-296A about Russian state-sponsored advanced persistent threat (APT) actor activity targeting various U.S. state, local, territorial, and tribal (SLTT) government networks, as well as aviation networks. It stated that since at least September 2020, a Russian state-sponsored APT actor—known variously as Berserk Bear, Energetic Bear, TeamSpy, Dragonfly, Havex, Crouching Yeti, and Koala in open-source reporting—has conducted a campaign against a wide variety of U.S. targets.
Given SCYTHE has many energy sector customers, we think this would be a great example of an adversary to analyze, consume Cyber Threat Intelligence, map to MITRE ATT&CK, and create an adversary emulation plan.
These are the first sources we consumed upon hearing about Berserk Bear:
According to Sean Lyngass, Berserk Bear is less conspicuous. They have used “waterholing,” or infecting websites and then picking off high-value login credentials, to compromise the IT networks of critical infrastructure companies in Europe and North America. The FBI and CSIS alert focused focuses on how Berserk Bear gains initial access with very well known vulnerabilities:
Valid Accounts [T1078]
While the focus so far has been on Berserk Bear obtaining user and administrator credentials to establish initial access. This is to enable lateral movement once inside the network and locate high value assets in order to exfiltrate data. However, the FBI and CISA have no information to indicate this APT actor has intentionally disrupted any aviation, education, elections, or government operations. However, the actor may be seeking access to obtain future disruption options, to influence U.S. policies and actions, or to delegitimize SLTT government entities.
From Andy Greenberg’s article "What makes them unique is the fact that they have been so focused on infrastructure throughout their existence, whether it's mining, oil, and natural gas in different countries or the grid," says Vikram Thakur, a researcher at security firm Symantec who has tracked the group over several distinct hacking campaigns since 2013.
Given the various threat actor names given to this adversary, there are multiple sources already mapped to MITRE ATT&CK:
After consuming the Cyber Threat Intelligence reports and mapping to MITRE ATT&CK, we organized the TTPs by Tactic and created a threat profile for Berserk Bear:
The FBI and CSIS recommendations focus on a number of areas that our users most likely already know such as keep all applications updated according to vendor recommendations, and especially prioritize updates for external facing applications and remote access services to address CVE-2019-19781, CVE-2020-0688, CVE 2019-10149, CVE-2018-13379, and CVE-2020-1472. However they do dive a little deeper into other areas to avoid initial access:
While Berserk Bear has yet to be seen doing something destructive, defenders can still leverage cyber threat intelligence to implement detections against its behaviors. As always, we ingested the Cyber Threat Intelligence, mapped it to MITRE ATT&CK, and created an adversary emulation plan based off of the threat’s behaviors. As more research is done on this threat, we’ll be able to further emulate its behaviors and look for key unique techniques it does. We hope you enjoyed this week’s Threat Thursday and we are extending a big thanks to the awesome team at Cyborg Security who provided their video on their side of detections!
Learn more about SCYTHE’s weekly Threat Thursday research reports by going to the #ThreatThursday page in our Unicorn Library, watching the videos on SCYTHE’s YouTube Channel, or follow #ThreatThursday and our CTO, Jorge Orchilles (@jorgeorchilles) on Twitter.
This Threat Thursday post discusses active research by SCYTHE and other cited third parties into an ongoing threat. The information in this post should be considered preliminary and may be updated as research continues. This information is provided “as-is” without any warranty or condition of any kind, either express or implied.
SCYTHE provides an advanced attack emulation platform for the enterprise and cybersecurity consulting market. The SCYTHE platform enables Red, Blue, and Purple teams to build and emulate real-world adversarial campaigns in a matter of minutes. Customers are in turn enabled to validate the risk posture and exposure of their business and employees and the performance of enterprise security teams and existing security solutions. Based in Arlington, VA, the company is privately held and is funded by Gula Tech Adventures, Paladin Capital, Evolution Equity, and private industry investors. For more information email info@scythe.io, visit https://scythe.io, or follow on Twitter @scythe_io.
Cyborg Security is a threat hunting pioneer. Reimagining threat hunting in a first-of-its-kind platform, Cyborg Security's HUNTER platform provides tailored threat hunt and detection packages, and a threat feed focused on operationalized threat data, to augment analysts into hunters and evolve traditional security operations into skilled hunt teams. To learn more, visit cyborgsecurity.com, or follow us on Twitter and LinkedIn.