Cybersecurity Advisory SVR TTP May 2021

For the SolarWinds Compromise, APT29 wrote malware such as Sibot in Visual Basic.

Sliver has the ability to support C2 communications over HTTP and HTTPS.

Sliver can support C2 communications over DNS.

During the SolarWinds Compromise, APT29 used different compromised credentials for remote access and to move laterally.

During the SolarWinds Compromise, APT29 collected emails from specific individuals, such as executives and IT staff, using `New-MailboxExportRequest` followed by `Get-MailboxExportRequest`.

During the SolarWinds Compromise, APT29 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.

APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.

During the SolarWinds Compromise, APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.

During the SolarWinds Compromise, APT29 gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.

APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.

APT29 has installed web shells on exploited Microsoft Exchange servers.

During the SolarWinds Compromise, APT29 obtained PKI keys, certificate files, and the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.

Sliver can use mutual TLS and RSA cryptography to exchange a session key.

APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.