By Nataly Vovk | Threat Intelligence Analyst

 Published on February 28th, 2024

This post was updated on February 29th, 2024

APT29, associated with the Russian Foreign Intelligence Service (SVR), is shifting its focus to launch attacks on the cloud services of its targets.

Key Takeaways

• On February 26, 2024, CISA published an advisory regarding the cyber espionage activities of APT29, highlighting their evolving tactics in targeting cloud-based systems.
• APT29 has adapted its operational tactics from exploiting on-premises networks to targeting cloud services for initial access in response to the global move towards cloud infrastructure.
• The group employs brute force attacks, password spraying on service and dormant accounts, and exploiting cloud-based token authentication and device enrollment to bypass security measures such as MFA.
• APT29 uses residential proxies to camouflage their internet traffic, challenging detecting and attributing their cyber espionage activities, emphasizing the need for comprehensive security monitoring.

On February 26, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) released an advisory shedding light on the sophisticated strategies employed by APT29, also known by aliases such as Midnight Blizzard, the Dukes, or Cozy Bear.

Thank you for signing up, we'll be in contact soon.

Stay One Step Ahead of Cyber Threats

Want to Be the Smartest Guy in the Room? Get the Latest Cybersecurity News and Insights.

Subscribe

We respect your privacy and you can unsubscribe anytime.

This group, recognized for its cyber espionage activities, is likely an extension of the SVR, Russia’s foreign intelligence service. The advisory, backed by the UK’s National Cyber Security Centre (NCSC) and a consortium of international security agencies, outlines the evolving threat landscape and the group’s shift towards targeting cloud-based infrastructures.

Historically, APT29 has been implicated in high-profile cyber operations, including the notorious SolarWinds supply chain attack and efforts to infiltrate organizations involved in COVID-19 vaccine development. The NCSC’s documentation reveals an expansion of SVR’s targeting to include a broader spectrum of sectors such as aviation, education, law enforcement, and the military. This broadening of focus underscores the group’s intent to harvest sensitive intelligence across a more comprehensive array of fields.

As organizations globally have moved towards cloud-based solutions to modernize their operations, APT29 has adapted its tactics to penetrate these new environments. Unlike their previous focus on exploiting vulnerabilities within on-premises networks, the group now seeks initial access through cloud services.

This strategic shift requires successful authentication to the cloud provider, marking a significant evolution in their approach to cyber espionage. The advisory emphasizes the importance of denying such initial access to thwart the group’s efforts to compromise cloud-hosted networks.

APT29’s adaptation includes sophisticated methods for gaining access, such as employing brute force and password spraying against service accounts, which are often less protected due to the absence of multi-factor authentication (MFA). Moreover, they exploit dormant accounts that remain active after employees depart an organization. These tactics highlight the group’s persistence and the critical need for organizations to enforce stringent access controls and account management policies.

The advisory further notes SVR’s utilization of cloud-based token authentication and device enrollment tactics to bypass traditional security measures, including MFA. By exploiting these mechanisms, APT29 can gain unauthorized access to cloud environments, emphasizing the need for organizations to implement robust device management and authentication policies to mitigate such risks.

APT29 employs residential proxies to mask their internet traffic, making their malicious activities appear as if they originate from legitimate residential IP addresses. This method complicates efforts to detect and attribute cyber espionage activities, stressing the importance of comprehensive and multi-faceted monitoring strategies that go beyond simple IP address-based defenses.

The advisory concludes by underscoring that adherence to cybersecurity fundamentals remains a potent defense against the sophisticated tactics of actors like SVR. By implementing the recommended mitigation strategies, organizations can significantly enhance their resilience against initial access attempts by cyberespionage groups. Furthermore, CISA’s Secure Cloud Business Applications (SCuBA) Project is highlighted as an additional resource for securing assets in cloud environments, reinforcing the ongoing need for vigilance and proactive defense against evolving cyber threats.

The advisory serves as a critical reminder of the ever-evolving nature of cyber threats, particularly from state-sponsored actors like APT29. As these actors adapt to new technologies and environments, it is imperative for organizations to remain ahead by continuously updating their cybersecurity practices and defenses, especially in the increasingly prevalent cloud-based infrastructures.