hack

December 30, 2021

The World’s Top Hacking Groups – Part 2

In Part 1 of AXEL’s feature on the world’s top hacking groups, we featured some of the leading cultivators of chaos in the world. From state-sponsored groups like Bureau 121 to leaderless hacktivist organizations like Anonymous, no two hacking groups are the same. Each organization has different personnel, goals, and methods of achieving those goals, with some more successful than others. In a way, these criminal syndicates are extremely similar to traditional businesses: If you’re financially successful, your group will flourish. If you struggle to make steady income, you’ll lose employees and, eventually, your entire company.

However, just as it is in the business world, there are some hacking groups that are seemingly too big to fail. Typically, these groups are state-sponsored, and receive oodles of cash for security purposes. While these state-sponsored groups may rarely grab headlines, these are the syndicates that truly hold the most power. After all, an independent hacker group can be taken down with a thorough investigation. A hacker group supported by a powerful nation is extremely unlikely to ever face investigations or oversight from other nations.

These four groups represent some of the most powerful hacking organizations in the world:

Cozy Bear

Cozy Bear is yet another Russian state-sponsored hacking group that focuses on attacking Western governments and media [1]. This group, however, seemingly has an intense focus on the United States. In 2014, the group hacked the State Department and the White House’s email systems, and in 2020, breached the Commerce and Treasury departments [2]. As part of Russia’s foreign intelligence service, Cozy Bear, along with sibling hacking group Fancy Bear, hacked into the Democratic National Committee (DNC) in 2016. Oddly enough, Cozy Bear and Fancy Bear were unaware of each other’s activities, and both independently hacked the political committee [3].

Although Cozy Bear and Fancy Bear both breached the DNC’s servers in 2016, Cozy Bear’s latest actions show that these hacks aren’t done for partisan purposes. In July 2021, the group breached the servers of the Republican National Committee (RNC) [4]. Ultimately this highlights Russia’s main strategy regarding cyberwarfare. The goal isn’t to make sure a certain candidate wins; it’s to undermine faith in the electoral process, thus lowering confidence in the nation itself. While Russia may have a preferred candidate every four years, it’s cybersecurity actions show a clear, nonpartisan strategy to simply embarrass the United States and decrease faith in its political processes. And Cozy Bear is just one of many groups Russia uses to further this goal.

REvil

One of the newest hacking groups in the world is also one of the most notorious. REvil is a private Russian group that makes millions from its ransomware attacks on businesses. The group initially gained attention in May 2020, when it hacked an entertainment-focused law firm and stole a number of files from the firm. REvil threatened then-President Donald Trump to release compromising documents unless the group received a massive USD $42 million ransom [5]. However, cybersecurity researchers quickly believed that this was a bluff, and no compromising documents were ever released by REvil [6].

Unfortunately, REvil’s initial failure did not deter the group. In 2021, the group was responsible for two massive cyberattacks. First, in May 2021, REvil breached JBS Foods, the world’s largest beef producer. This attack forced the company to shut down some of its food processing plants, threatening a potential beef shortage. However, just one day after the initial attack, JBS paid a USD $11 million ransom to REvil to decrypt its servers [7]. While the quick payment ensured there would be no major shortages, it showed how desperate businesses can be if hit with a devastating ransomware attack. Just a month later, REvil attacked Kaseya, a networks, systems, and IT software company. This attack shut down Kaseya’s main software, ultimately affecting up to 1,500 businesses worldwide. The impacts of this attack were felt worldwide, with a Swedish grocery store chain closed because of inoperable cash registers, and New Zealand schools being taken offline [8].

Thankfully, in October 2021, REvil itself was forced offline by a multi-country operation led by the United States [9]. While this doesn’t mean REvil will never pop up again, the crackdown on ransomware shows that even the most notorious private hacking groups can be stopped.

Chinese Cyber Operations

While not much is known about China’s cyber operations, we do know that their attacks have been effective. In 2010, China was the culprit behind Operation Aurora, an advanced, highly-sophisticated attack on dozens of American companies, including Google and Adobe [10]. In the attack, China stole intellectual property, along with access to the Gmail accounts of two high-profile human rights activists.

Following this complex cyberattack, China was accused of executing one of the worst cyberattacks of all time: The Equifax data breach. In February 2020, the United States charged four members of China’s People’s Liberation Army with the 2017 hack that leaked personal information of over 150 million Americans [11]. While the United States has no way of extraditing the four soldiers for trial, this claim highlighted the sheer power of state cyber operations groups. The Equifax hack had a profound effect on everyday Americans, and caused concern that extremely effective and damaging cyberattacks could become commonplace in the future.

In the present, China’s cyber operations have expanded. This escalation is fueled by the desire for more intelligence, particularly from the United States amid rising tensions between the two global superpowers [12]. In fact, Western governments have accused China of hacking into Microsoft’s Exchange company server. This hack affected about 250,000 organizations worldwide, allowing Chinese hackers to pilfer through company emails for intelligence. While this hack was not nearly as impactful as the Equifax breach, it highlights China’s renewed focus on gathering massive amounts of intelligence on the United States and other Western nations.

NSA Tailored Access Operations

While many of the world’s top hacking groups operate far from North America, the world’s most powerful group is undoubtedly within American borders. The National Security Administration’s (NSA) Tailored Access Operations group gathers intelligence from foreign targets by hacking into devices, stealing data, and monitoring communications. Additionally, the group develops software that can destroy a foreign target’s computer and networks [13]. The group is responsible for developing malware that targeted Iran’s nuclear program, along with regularly breaching Chinese computer networks for gathering intelligence.

The United States’ targeted surveillance capabilities should come as no surprise. After all, the NSA is well-known for its mass surveillance techniques. Tailored Access Operations is relatively similar to other state cyber operations groups: It uses targeted surveillance to gather intelligence, and uses sophisticated malware to attack its targets. Of course, because it’s the NSA, there is the possibility that the group has even more publicly unknown high-tech resources for cyberattacks. While Tailored Access Operations works in the shadows, the strength of the NSA, and the United States in general, make this group the most powerful hackers in the world.

About AXEL

Some of these powerful hacking groups will, unfortunately, continue to wreak havoc in 2022. That’s why data security and user privacy remain as important as ever. At AXEL we believe that privacy is a human right, and that your information deserves the best protection. That’s why we created AXEL Go. AXEL Go uses 256-bit encryption, blockchain technology and decentralized servers to ensure it’s the best file transfer software on the market. Whether you need cloud video storage or cloud file management, AXEL Go is the secure file hosting solution. If you’re ready to try the best file sharing app for PC and mobile devices, try two free weeks of AXEL Go here.

[1] Meyer, Josh. “Cozy Bear Explained: What You Need to Know about the Russian Hacks.” NBCNews.com. NBCUniversal News Group, September 15, 2016. https://www.nbcnews.com/storyline/hacking-in-america/cozy-bear-explained-what-you-need-know-about-russian-hacks-n648541

[2] Nakashima, Ellen, and Craig Timberg. “Russian Government Hackers Are behind a Broad Espionage Campaign That Has Compromised U.S. Agencies, Including Treasury and Commerce.” The Washington Post. WP Company, December 14, 2020. https://www.washingtonpost.com/national-security/russian-government-spies-are-behind-a-broad-hacking-campaign-that-has-breached-us-agencies-and-a-top-cyber-firm/2020/12/13/d5a53b88-3d7d-11eb-9453-fc36ba051781_story.html

[3] “Bear on Bear.” The Economist. The Economist Newspaper, September 22, 2016. https://www.economist.com/united-states/2016/09/22/bear-on-bear

[4] Turton, William, and Jennifer Jacobs. “Russia ‘Cozy Bear’ Breached GOP as Ransomware Attack Hit.” Bloomberg.com. Bloomberg, July 6, 2021. https://www.bloomberg.com/news/articles/2021-07-06/russian-state-hackers-breached-republican-national-committee

[5] Collier, Kevin, and Diana Dasrath. “Criminal Group That Hacked Law Firm Threatens to Release Trump Documents.” NBCNews.com. NBCUniversal News Group, May 16, 2020. https://www.nbcnews.com/tech/security/criminal-group-hacked-law-firm-threatens-release-trump-documents-n1208366

[6] Vanian, Jonathan. “Everything to Know about Revil, the Group behind Several Devastating Ransomware Attacks.” Fortune. Fortune, July 8, 2021. https://fortune.com/2021/07/07/what-is-revil-ransomware-attack-kaseya/

[7] Abrams, Lawrence. “JBS Paid $11 Million to REvil Ransomware, $22.5m First Demanded.” BleepingComputer. BleepingComputer, June 10, 2021. https://www.bleepingcomputer.com/news/security/jbs-paid-11-million-to-revil-ransomware-225m-first-demanded/

[8] Satter, Raphael. “Up to 1,500 Businesses Affected by Ransomware Attack, U.S. Firm’s CEO Says.” Reuters. Thomson Reuters, July 6, 2021. https://www.reuters.com/technology/hackers-demand-70-million-liberate-data-held-by-companies-hit-mass-cyberattack-2021-07-05/

[9] Bing, Christopher, and Joseph Menn. “Exclusive Governments Turn Tables on Ransomware Gang Revil by Pushing It Offline.” Reuters. Thomson Reuters, October 21, 2021. https://www.reuters.com/technology/exclusive-governments-turn-tables-ransomware-gang-revil-by-pushing-it-offline-2021-10-21/

[10] Zetter, Kim. “Google Hack Attack Was Ultra Sophisticated, New Details Show.” Wired. Conde Nast, January 15, 2010. https://www.wired.com/2010/01/operation-aurora/

[11] Perez, Evan, and Zachary Cohen. “US Charges 4 Members of Chinese Military with Equifax Hack.” CNN. Cable News Network, February 11, 2020. https://www.cnn.com/2020/02/10/politics/equifax-chinese-military-justice-department/index.html

[12] Sabbagh, Dan. “Experts Say China’s Low-Level Cyberwar Is Becoming Severe Threat.” The Guardian. Guardian News and Media, September 23, 2021. https://www.theguardian.com/world/2021/sep/23/experts-china-low-level-cyber-war-severe-threat

[13] Peterson, Andrea. “The NSA Has Its Own Team of Elite Hackers.” The Washington Post. WP Company, August 29, 2013. https://www.washingtonpost.com/news/the-switch/wp/2013/08/29/the-nsa-has-its-own-team-of-elite-hackers/

December 23, 2021

The World’s Top Hacking Groups – Part 1

Click here to read Part 2 of AXEL’s blog on the world’s top hacking groups

Ever since the invention of computers, there have been hackers. However, in the early history of computers, “hackers” weren’t seen as shadowy, havoc-wreaking figures, but simply as enthusiasts. These early hackers tinkered with computers, and ended up creating some of the earliest computer programs. But as computers rapidly gained popularity in the 1980s, cybersecurity cracks were starting to show, and skilled individuals took advantage. In 1989, Joseph Popp created the first ransomware device: A floppy disk sent to world health professionals disguised as medical research. When inserted, the disk locked the user’s computer, and demanded the victim mail $189 to a PO Box in Panama [1].

While this early example of hacking is easy-to-understand, modern hacking and ransomware is far more complicated, not just from a technological standpoint, but from an organizational standpoint as well. Gone are the days of individual, hoodie-clad loners furiously typing on their computers in the dark. Today, the people who carry out the world’s worst hacks are part of hacking groups. After all, hackers are smart, and realize that they can do more damage working together, rather than alone. Most of the world’s worst hacks have occurred at the hands of a few hacking organizations, committed to causing chaos around the globe.

These groups have the money and manpower to cause digital devastation on a global scale:

Bureau 121 & Lazarus

North Korea has long been a mysterious, yet aggressive nation, and its state-sponsored hacking group is no exception. Although not much is known about Bureau 121, cybersecurity experts have tied the group to the North Korean government. However, because of the country’s poor infrastructure, experts believe that Bureau 121 plans and executes its operations in Shenyang, China, a city just 100 miles from the North Korean border [2]. The organization mostly targets South Korean businesses, unsurprisingly. One of its biggest attacks was a ransomware attack on South Korea’s Hydro & Nuclear Power Company, resulting in a massive data breach.

While North Korean hackers mostly focus on their South Korean neighbors, it gained worldwide notoriety when Lazarus Group, an affiliate of Bureau 121, attacked Sony Pictures. First, the group leaked thousands of emails between Sony Pictures executives, and leaked unannounced, upcoming films from the studio. More concerningly, the group threatened to commit acts of terrorism at movie theaters unless Sony’s film “The Interview,” a comedy whose plot includes the assassination of Kim Jong-Un, North Korea’s leader, was pulled from theaters [3]. The United States quickly tied the hack to North Korea, but because of the countries’ icy relationship, no arrests have been made.

Syrian Electronic Army

The Syrian Electronic Army (SEA) was formed during the Arab Spring, a series of anti-government protests and uprisings in the Middle East in the early 2010s. It was created to protect controversial Syrian President Bashar al-Assad from Syrian dissidents during the widespread protests [4]. Interestingly, cybersecurity experts are unsure if the group is sponsored by the Syrian government, or is simply a group of pro-Assad hackers [5]. In either case, the SEA is a vehemently pro-Assad organization that has two goals: Punish media organizations that are critical of Assad, and spread Syria’s state-sponsored narrative [4].

One of the SEA’s most famous hacks occurred in 2013, when the group hacked into the Associated Press’ Twitter account and falsely reported that then-President Obama was injured in an explosion at the White House [6]. This single Tweet caused stocks to plummet, highlighting just how much damage can be caused from hackers thousands of miles away. In addition to this notable AP hack, the SEA has hacked Western media organizations, including Facebook, Microsoft, and The New York Times.

Fancy Bear

Although this group may have a cuddly name, its actions are anything but soft. Cybersecurity experts widely believe Fancy Bear to be a Russian-sponsored hacking group responsible for a variety of hacks to advance Russian interests [7]. The group has committed attacks on Germany’s Parliament, French President Emmanuel Macron, and a variety of other Western governments [8]. The group typically uses well-disguised phishing emails to gain access to restricted information.

Fancy Bear used this strategy to pull off its most daring, consequential hack: an attack that leaked thousands of Democratic National Committee (DNC) emails in 2016 [9]. The cyberattack resulted in the public reveal of thousands of DNC emails, many of which were seen as controversial or simply embarrassing. While many countries spy on others during elections, this was one of the first times a foreign country was able to successfully meddle in a United States election. Although it’s impossible to determine if the 2016 Presidential election would have been different if Fancy Bear didn’t commit the attack, this hack showed how valuable, and devastating, cyberattacks can be before elections.

Anonymous

Perhaps the most famous hacking organization in the world, Anonymous is unlike any other group. Anonymous is decentralized, with no leader or physical hub. While this may sound like a disadvantage, this organization ensures that the group can continue its activities even if members drop out or are apprehended. Anonymous is a “hacktivist” group, and does not have specific goals or enemies. However, Anonymous certainly has a broad aspiration to promote freedom of speech and diminish government control [10].

Anonymous gained notoriety during its 2008 cyberattacks on the Church of Scientology, when the group managed to shut down the Church’s website. Following this attack, the organization gained popularity around the world, expanding the group’s hacking capabilities (and potential targets). The group targeted Tunisia’s government during the Arab Spring protests, Visa and MasterCard for declining to do business with WikiLeaks, and Bank of America for its shady mortgage practices [11].

Since 2008, Anonymous has continued to attack governments and organizations that break the group’s core beliefs. However, the long-term impact of these attacks are often negligible. Anonymous’s main strategy is a distributed denial of service (DDoS) attack. While DDoS attacks are successful in shutting down websites and gaining notoriety, once the website is back up, there are few long-term effects of Anonymous’s involvement. So although Anonymous is one of the most notorious hacking collectives in the world, more organized groups are able to cause greater long-term effects with their cyberattacks.

About AXEL

Hacking groups aren’t going away any time soon. That’s why data security and user privacy remain as important as ever. At AXEL we believe that privacy is a human right, and that your information deserves the best protection. That’s why we created AXEL Go. AXEL Go uses 256-bit encryption, blockchain technology and decentralized servers to ensure it’s the best file transfer software on the market. Whether you need cloud video storage or cloud file management, AXEL Go is the secure file hosting solution. If you’re ready to try the best file sharing app for PC and mobile devices, try two free weeks of AXEL Go here.

[1] Kelly, Samantha Murphy. “The Bizarre Story of the Inventor of Ransomware.” CNN. Cable News Network, May 16, 2021. https://www.cnn.com/2021/05/16/tech/ransomware-joseph-popp/index.html

[2] Lee, Dave. “Bureau 121: How Good Are Kim Jong-Un’s Elite Hackers?” BBC News. BBC, May 29, 2015. https://www.bbc.com/news/technology-32925503

[3] VanDerWerff, Emily, and Timothy Lee. “The 2014 Sony Hacks, Explained.” Vox. Vox, January 20, 2015. https://www.vox.com/2015/1/20/18089084/sony-hack-north-korea

[4] Harding, Luke, and Charles Arthur. “Syrian Electronic Army: Assad’s Cyber Warriors.” The Guardian. Guardian News and Media, April 30, 2013. https://www.theguardian.com/technology/2013/apr/29/hacking-guardian-syria-background

[5] Perlroth, Nicole. “Hunting for Syrian Hackers’ Chain of Command.” The New York Times. The New York Times, May 17, 2013. https://www.nytimes.com/2013/05/18/technology/financial-times-site-is-hacked.html?pagewanted=all&_r=0

[6] Moore, Heidi, and Dan Roberts. “AP Twitter Hack Causes Panic on Wall Street and Sends Dow Plunging.” The Guardian. Guardian News and Media, April 23, 2013. https://www.theguardian.com/business/2013/apr/23/ap-tweet-hack-wall-street-freefall

[7] O’Flaherty, Kate. “Midterm Election Hacking — Who Is Fancy Bear?” Forbes. Forbes Magazine, August 23, 2018. https://www.forbes.com/sites/kateoflahertyuk/2018/08/23/midterm-election-hacking-who-is-fancy-bear/?sh=5bccc7aa2325

[8] Hern, Alex. “Macron Hackers Linked to Russian-Affiliated Group behind US Attack.” The Guardian. Guardian News and Media, May 8, 2017. https://www.theguardian.com/world/2017/may/08/macron-hackers-linked-to-russian-affiliated-group-behind-us-attack

[9] Frenkel, Sheera. “Meet Fancy Bear, the Russian Group Hacking the US Election.” BuzzFeed News. BuzzFeed News, October 15, 2016. https://www.buzzfeednews.com/article/sheerafrenkel/meet-fancy-bear-the-russian-group-hacking-the-us-election

[10] Sands, Geneva. “What to Know About the Worldwide Hacker Group ‘Anonymous.’” ABC News. ABC News Network, March 19, 2016. https://abcnews.go.com/US/worldwide-hacker-group-anonymous/story?id=37761302

[11] “The 10 Craziest Hacks Done by Anonymous.” Complex. Complex, May 31, 2020. https://www.complex.com/pop-culture/2011/08/the-10-craziest-anonymous-hacks/

April 23, 2021

What Else We’ve Learned About the SolarWinds Data Breach

In January, we covered a massive supply-chain data breach known as the SolarWinds attack. To get a broad overview of the incident, how the malicious agents carried out the hack, and the known victims, please read our coverage. Over the past four months, there have been new developments in the story that warrant a follow-up. Here, we go over these updates and discuss the potential for lasting fallout.

A brief synopsis

In December 2020, cybersecurity firm FireEye reported a significant flaw in the SolarWinds Orion database management software suite. When the dust settled, experts found that over 18,000 organizations had inadvertently installed a backdoor for an Advanced Persistent Threat (APT) group, likely Russian in origin. These state-sponsored actors infiltrated major corporations and high-level United States governmental agencies alike. Officials believe it to be the most widespread digital espionage campaign ever carried out against the United States. So, what have we found out since then?

More sophisticated than initially thought

From the very beginning, cybersec professionals knew the culprits were sophisticated and that the program’s scope was enormous. As it turns out, however, initial estimates seemed to have underestimated it. According to a recent analysis by RiskIQ, the infrastructure used by the threat actors was at least 56% larger than originally thought[1].

This implies the state hackers had access to significantly more computing power and probably targeted even more organizations than the known 18,000 victims. The same report also concluded that the use of United States-based infrastructure during the initial attack stage prevented the National Security Agency (NSA) from noticing the situation due to stricter laws against domestic surveillance.

Russians officially blamed

United States intelligence agencies have always blamed Russia for the attack, but it turned into more than an accusation when President Joe Biden and the United States formally sanctioned the adversarial country on March 15[2]. Provisions of the sanctions include:

Forbidding U.S. banks from buying bonds from or lending money to Russia’s national financial institutions after June 14.
Expelling 10 Russian diplomats accused of being intelligence agents from the United States.
Sanctioning six technology companies in Russia accused of supporting intelligence agencies.

The sanctions significantly ratchet up tensions between the two nations and mark a major departure from standard espionage protocol. Previously, the United States and other countries assumed cyber espionage campaigns were always underway from their enemies, and their enemies were under similar assumptions. This meant that there was an implicit understanding that everyone is spying on everyone else, and nobody felt real consequences for it. The sanctions set a new precedent that could result in escalation rather than diplomacy. Although, Russia pulled back troops from the Ukrainian border after the sanctions[3], so perhaps the message landed as intended. Only time will tell what ramifications this act has, but hopefully, it doesn’t increase the divide between the two largest nuclear powers.

Concurrent Chinese involvement

Although analysts blame Russia for the initial breach, it appears like Chinese state hackers also took advantage of the situation[4]. According to a report by Secureworks, some malicious agents used tactics similar to those employed by the Chinese APT, SPIRAL[5]. Furthermore, during the intrusion, the group accidentally revealed its IP, which originated from China. So, while sanctions only targeted Russia, there is evidence that China played a role too.

Of course, as we talked about in the original SolarWinds blog, it’s exceedingly difficult to analyze blame with a hundred percent certainty. State-sponsored digital espionage groups are adept at covering their tracks and obfuscating origins. And, while the United States government seems positive the Russians were the main culprits, hard evidence of this assertion hasn’t been made public. Not to mention the United States government has been wrong about some pretty bold claims before. We may never know the full truth.

Congress grills Microsoft

Interestingly, the company in the hottest water over the whole snafu isn’t SolarWinds; it’s Microsoft. Probably due to its high-profile nature, the U.S. Congress set its sights on the tech behemoth[6]. This is because, after the breach’s first stage, the hackers exploited Microsoft products and stole sensitive emails and other data from thousands of organizations.

Microsoft itself had its source code exposed to the hackers. Since source code is the lifeblood of a tech company, it shows exactly how all-encompassing the breach was. It also proves a crucial point; no matter how secure a system is, nothing can be completely safe from ill-intentioned cyberspies with the backing of an entire country’s resources. So, although House members assuredly loved grandstanding about the holes in Microsoft’s security, the truth is more complex and nuanced.

White House ramps down recovery efforts

This brings us to the conclusion of the saga. On April 19, the White House announced that several national agencies such as the FBI, CISA, and NSA would soon begin ramping down their efforts regarding SolarWinds. Combined with the Russian sanctions, it signals that the U.S. Government considers the incident largely settled. China appears unlikely to receive any formal retaliation. Hopefully, the most significant data breach of our times serves as a lesson for the future of cybersecurity. Undoubtedly similar incidents will occur in the future, but perhaps mitigation policies will improve, and potential damages will be reduced.

Security is a personal responsibility

If there’s one takeaway everyone should have about SolarWinds, it’s that relying on Big Tech’s security policies is a mistake. People should do a bit of research to find redundant cybersecurity methods for their sensitive data.

You can protect your confidential files by ditching cloud drives like Dropbox, OneDrive, and Google Drive and switch to AXEL Go. AXEL Go utilizes our decentralized, distributed files sharing network backed by blockchain and the InterPlanetary File System. This ensures your documents aren’t stored in one place with a single point of failure.

Additionally, every file you transfer via the AXEL Network gets “digitally shredded” and distributed to scattered server nodes. This means even if a malicious agent compromised a server, they wouldn’t have access to the complete file. Documents are only reconfigured for the initial user and any recipients. This system, combined with military-grade encryption, provides multiple layers of security for AXEL Go users.

You can try AXEL Go Premium with all features unlocked free for 14-days. Sign up today and see how AXEL can improve your workflow and harden your organization’s cybersecurity.

[1] “SolarWinds: Advancing the Story”, RiskIq.com, April 22, 2021, https://community.riskiq.com/article/9a515637

[2] Morgan Chalfant, Maggie Miller, “Biden administration sanctions Russia for SolarWinds hack, election interference”, April 15, 2021, https://thehill.com/homenews/administration/548367-biden-administration-unveils-sweeping-sanctions-on-russia?rl=1

[3] “Russia to pull troops back from near Ukraine”, BBC, April 22, 2021, https://www.bbc.com/news/world-europe-56842763

[4] Dan Goodin, “Chinese hackers targeted SolarWinds customers in parallel with Russian op”, Ars Technica, March 8, 2021, https://arstechnica.com/gadgets/2021/03/chinese-hackers-targeted-solarwinds-customers-in-parallel-with-russian-op/

[5] Counter Threat Unit Research Team, “SUPERNOVA Web Shell Deployment Linked to SPIRAL Threat Group”, Secureworks.com, March 8, 2021, https://www.secureworks.com/blog/supernova-web-shell-deployment-linked-to-spiral-threat-group

[6] Frank Bajak, “SolarWinds hacking campaign puts Microsoft in the hot seat”, The Associated Press, April 17, 2021, https://apnews.com/article/business-technology-government-and-politics-f51e53523312b87121146de8fd7c0020

March 12, 2021

The Microsoft Exchange Hack is Unparalleled

Barely two months after the massive SolarWinds attack (that experts are still attempting to unravel) comes news of perhaps an even larger successful attack. In a patch release on March 2^nd, Microsoft announced they fixed four critical vulnerabilities to their Exchange Server email system. No big deal, right? Well, buckle up.

The scope

As it turns out, hackers exploited these zero-day (previously unknown) vulnerabilities for at least two months before Microsoft released the security patch. The security holes themselves were present for over ten years, so it may be an even more widespread issue. During the last two months, however, it seems as if over 30,000 organizations running Exchange Server were compromised in the United States alone[1]. Worldwide, the number grows to hundreds of thousands of likely victims. And that could be a lowball estimate! According to former CISA Director Chris Krebs, “The numbers I’ve heard dwarf what’s reported here,” referring to a report indicating the 30K number. That’s staggering!

The situation

In early January, the red team ethical hacking group, DEVCORE, led by the Orange Tsai, first reported two of the four zero-day vulnerabilities to Microsoft[2]. Soon after, the cybersecurity firm Volexity detected actual attacks from then-unknown entities using the exploits[3]. By late January, analysts mapped out the breaches and deciphered some details.

The threat actors were installing backend “web shells” on the Exchange servers. Web shells are malicious code injected into web applications that can give hackers administrator access to the infected servers. Then, the cybercriminals can run commands at-will. In this case, it appears that the hackers stole private emails and primed the networks for other malicious activity. Some analysts worry that the affected systems may be vulnerable to future ransomware attacks[4].

The victims

The unfortunate truth is that nearly any organization running non-cloud-based Microsoft Exchange email servers could be a victim. As awareness of the hack spreads, the tally of compromised organizations grows. The scope of the attack is unprecedented. In an official statement, Microsoft claimed that the group responsible for the attack typically targets “infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs,[5]” but this attack appears much less selective.

According to the cybersecurity firm Huntress, many of the clients they confirmed as having the web shell installed do not it into these categories[6]. As the Senior Security Researcher of the company says, “These companies do not perfectly align with Microsoft’s guidance as some personas are small hotels, an ice cream company, a kitchen appliance manufacture, multiple senior citizen communities and other ‘less than sexy’ mid-market businesses.”

There have been some high-profile organizations already disclosing breaches, though:

European Banking Authority. On March 7^th, the EBA, which has a supervisory role in the European Union’s banking industry, admitted hackers compromised their Exchange email servers[7]. Luckily, a security analysis turned up no evidence that the cybercriminals stole any data.
Norway’s parliament. The Norwegian parliament, the Storting, did not get off so easy. With the digital forensic investigation still underway, the governmental body admitted, “We know that data has been extracted, but we do not yet have a full overview of the situation.[8]” This is the second major breach the Storting experienced over the past three months.

Undoubtedly, the list of known organizations affected by the situation will increase significantly in the upcoming days.

The perpetrators

Microsoft has consistently assigned blame to a Chinese state-sponsored hacking group dubbed ‘HAFNIUM.[9]’ Details for this assessment are scarce. Evidently, the behavior and tactics are similar to known Advanced Persistent Threats (APTs) from China. The group also worked through leased VPN servers located in the United States, which may point toward a Chinese origin.

However, after the initial disclosure, cybersecurity firms reported that other APTs have joined in on the illicit fun. According to a report by the cybersecurity company ESET, at least ten other APTs are exploiting the Exchange flaws[10]. This includes Tick, LuckyMouse, Calypso,Websiic, Winnti Group, Tonto Team, Cobalt Group, Mikroceen, and three unknown groups. It’s unclear if there is any proper coordination between these factions. The majority -but not all- of them share connections to China, but the fact that multiple web shells were present on some of the affected servers indicates a lack of collaboration.

As was mentioned in our previous SolarWinds article, attribution of an attack is quite tricky. There are instances of APTs disguising their activity and successfully pinning it on a different country. And, as the Vault 7 Wikileaks dump proved, nations have sophisticated tools that obfuscate the attackers’ true origins[11]. However, with so many Chinese APTs linked to the situation, it becomes more challenging to deny involvement (unsurprisingly, the Chinese Communist Party has denied the allegations.)

Uncertainty

So, where do we go from here? As mentioned, Microsoft released a patch that fixed the vulnerabilities. If your organization runs an Exchange email server, install the patches immediately. Microsoft says that these fixes will not help systems already infiltrated with web shells. If you suspect an infection, have cybersecurity professionals analyze the network.

Other than that, there isn’t too much you can do. Experts are still evaluating the full extent of the attack, and nobody knows if/when further damage, such as ransomware, will occur. The situation’s historic magnitude makes it especially scary because it goes against the traditionally-cautious cyber strategy of China’s APTs. It’s brazen and impossible to ignore. What will the fallout be? Only time will tell.

Data security for all

Are you doing enough to protect your files from hackers and intruders? If you’re using a Big Tech solution for file-sharing and online storage, the answer is ‘no.’ Get serious about data security and use the private, safe file-sharing and storage platform AXEL Go. It utilizes blockchain technology, the InterPlanetary File System (IPFS), and robust password encryption to keep your documents out of reach from data mining corporations and hackers. Download it today for Windows, OSX, Android, or iOS and experience a better way to share.

[1] Brian Krebs, “At Least 30,000 U.S. Organizations Newly Hacked Via Holes in Microsoft’s Email Software”, Krebsonsecurity.com, March 5, 2021, https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/

[2] “What is ProxyLogon”, Proxylogon.com, March 2021, https://proxylogon.com/#timeline

[3] Josh Grunzweig, Mathew Meltzer, Sean Koessel, Steven Adair, Thomas Lancaster, “Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange vulnerabilities.

[4] Brian Krebs, “Warning the World of a Ticking Time Bomb”, Krebsonsecurity.com, March 9, 2021, https://krebsonsecurity.com/2021/03/warning-the-world-of-a-ticking-time-bomb/

[5] “HAFNIUM targeting Exchange Servers with 0-day exploits”, Microsoft.com, March 2, 2021, https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

[6] John Hammond, “Rapid Response: Mass Exploitation of On-Prem Exchange Servers”, March 3, 2021, https://www.huntress.com/blog/rapid-response-mass-exploitation-of-on-prem-exchange-servers

[7] Davey Winder, “EU Banking Authority Hacked As Microsoft Exchange Attacks Continue”, March 9, 2021, https://www.forbes.com/sites/daveywinder/2021/03/09/eu-banking-authority-hacked-as-microsoft-exchange-attacks-continue/?sh=29f2026d2fe0

[8] Richard Speed, “A nei! Noway’s Stortinget struck by Microsoft Exchange malware”, The Register, March 11, 2021, https://www.theregister.com/2021/03/11/stortinget_attack/

[9] “HAFNIUM targeting Exchange Servers with 0-day exploits”, Microsoft.com, March 2, 2021, https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

[10] Matthieu Faou, Mathieu Tartare, Thomas Dupuy, “Exchange servers under siege from at least 10 APT groups”, March 10, 2021, https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/

[11] “Vault 7: CIA Hacking Tools Revealed”, Wikileaks.org, March 7, 2017, https://wikileaks.org/ciav7p1/index.html