Russian SVR Exploiting Unpatched Vulnerabilities

Russian Foreign Intelligence Service (SVR) cyber actors are once again in the spotlight, exploiting widespread vulnerabilities in a global campaign aimed at government, technology, and finance sectors.

In a new joint advisory, the UK’s National Cyber Security Centre (NCSC) and U.S. agencies warned that SVR cyber operations, known for the SolarWinds attack and targeting COVID-19 vaccine research, have shifted their focus to unpatched software vulnerabilities across a range of sectors.

“Russian cyber actors are interested in and highly capable of accessing unpatched systems across a range of sectors, and once they are in, they can exploit this access to meet their objectives.” – Paul Chichester, NCSC Director of Operations

SVR’s Tactics: A Persistent Global Threat

The SVR, also referred to as APT29 or Cozy Bear, has demonstrated an alarming ability to exploit known vulnerabilities, particularly those left unpatched by organizations. The group is infamous for its persistent and stealthy cyber operations, often targeting government entities, think tanks, and private corporations to collect foreign intelligence.

One key aspect of their approach is the two types of targets they pursue. The first includes entities of strategic interest such as governments, financial institutions, and technology companies. These “targets of intent” are carefully selected for their intelligence value. The second group, known as “targets of opportunity,” consists of any organization with unpatched systems that can be exploited for malicious purposes.

SVR Exploiting Unpatched Vulnerabilities at Scale

The advisory includes over 20 publicly disclosed vulnerabilities that SVR actors are actively targeting. Organizations across the globe, including those in the UK, are being urged to rapidly deploy patches and prioritize software updates to minimize exposure to these threats.

Once SVR actors gain initial access through unpatched systems, they can escalate privileges and move laterally across networks, often compromising connected systems such as supply chains. This enables them to launch further operations, including espionage, data exfiltration, and network disruption.

Following is the complete list of unpatched vulnerabilities that Russian SVR was observed exploiting:

Not Just a Cybersecurity Threat: Broader Implications

The report also sheds light on how SVR actors adapt their techniques to keep pace with evolving technology. The NCSC warns that the group has adjusted its approach in response to the increasing reliance on cloud infrastructure, exploiting cloud misconfigurations and weak security practices. This makes them a formidable adversary for organizations that are migrating or already relying heavily on cloud services.

SVR actors have also been linked to recent large-scale attacks, including the supply chain compromise of SolarWinds and a series of spear-phishing campaigns targeting COVID-19 vaccine research. These incidents demonstrate the group’s focus on strategic assets and their potential to impact national security and public health.

APT29’s Arsenal: From Phishing to Supply Chain Attacks

The advisory also outlines the tactics, techniques, and procedures (TTPs) employed by SVR cyber actors. Their arsenal includes spear-phishing campaigns, password spraying, supply chain attacks, and the abuse of trusted relationships. These methods allow them to gain initial access and conduct follow-up operations from compromised accounts.

For instance, in recent campaigns, SVR actors were found to exploit cloud environments using Microsoft Teams accounts impersonating technical support to trick victims into granting access. By compromising poorly secured small business accounts, they were able to create platforms for targeting high-profile organizations.

Infrastructure and Evasion Tactics

SVR cyber actors are known for their ability to remain undetected for extended periods. They frequently use The Onion Router (TOR) network and proxy services to obfuscate their activity. In some cases, they lease infrastructure using fake identities and low-reputation email accounts to avoid detection.

When SVR suspects that their operations have been uncovered, they move quickly to destroy their infrastructure and any evidence on it. This evasive approach makes it difficult for investigators to trace their operations back to the original source.

Recent Exploitations: Zimbra, JetBrains, and More

SVR actors have also been involved in exploiting several high-profile vulnerabilities. For example, the advisory mentions the exploitation of Zimbra mail servers using CVE-2022-27924, a command injection vulnerability that allowed attackers to access user credentials without victim interaction.

More recently, they exploited JetBrains TeamCity’s CVE-2023-42793 vulnerability, enabling arbitrary code execution. This kind of exploitation highlights SVR’s focus on widely used software systems, allowing them to infiltrate a broad range of sectors and geographies.

Mitigations: What Organizations Can Do

In light of these ongoing campaigns, the NCSC and U.S. agencies have provided several recommendations to help organizations defend against SVR cyber actors. These include:

• Rapid deployment of patches and updates: Organizations should prioritize software updates as soon as they become available to close known vulnerabilities.
• Multi-factor authentication: Implementing multi-factor authentication across networks and systems can reduce the risk of unauthorized access.
• Auditing cloud accounts: Regularly auditing cloud-based accounts for unusual activity can help detect intrusions before they escalate.
• Reducing attack surface: Disable unnecessary internet-facing services and remove unused applications to limit points of entry for attackers.

Related