State-Sponsored Advanced Persistent Threat (APT) Breach
CASE STUDY
Incident Response Case Study - State-Sponsored APT Breach
Tags
State-Sponsored, Advanced Persistent Threat (APT), Large-scale breach, Threat Intelligence, Web Shells
Background
Scope
The Maryman team were ultimately tasked with conducting a complete, entirely independent investigation to determine how the attackers got in, what data they accessed, and how was the data exfiltrated from the corporate environment.
Preservation
All one hundred and twenty (120) virtual servers and network logs had already been preserved by the previous incident response company. All were provided to the Maryman team for analysis.
The PI firm was able to add one crucial element to the analysis. Working with the United States Attorney’s Office, they were able to get one of the hacker’s servers out of Southeast Asia. In a rare event, the US Attorney’s Office provided Maryman with a forensic image of the hacker’s server.
Analysis and Findings
The Maryman team quickly determined only 16 of the servers were impacted by the attackers. Using deep Linux filesystem analysis, we uncovered the output from the port scanning tool used by the attackers, showing the discovery of a second subnetwork. Even though the servers appeared in two separate subnetworks, the Maryman team was able to show that the attack group was the same. This was significant for the client, because it provided evidence to show the entire attack was from a single group.
Utilizing the hacker’s server, a very large and comprehensive timeline was established to show the initial discovery of the vulnerability by an attack group in Europe, and the suspected sale of the vulnerability to another attack group in Asia about 12 months later. The timeline was able to show a consistent attack against the infrastructure for about seven weeks in which the attackers were able to infiltrate the network, access the database and ultimately exfiltrate gigabytes of client data.