{"id":24418,"date":"2021-05-02T22:51:46","date_gmt":"2021-05-02T19:51:46","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=24418"},"modified":"2026-03-27T22:17:44","modified_gmt":"2026-03-27T19:17:44","slug":"the-quarter-of-patches-apt-actors-increasingly-turn-to-exploits-to-launch-attacks","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/the-quarter-of-patches-apt-actors-increasingly-turn-to-exploits-to-launch-attacks\/","title":{"rendered":"The quarter of patches: APT actors increasingly turn to exploits to launch attacks"},"content":{"rendered":"\n

Over the past three months, the major waves of advanced persistent threat activity have been driven by supply chain attacks and zero day exploits. A compromise in SolarWind\u2019s Orion IT software for monitoring IT infrastructures led to a custom backdoor being installed on more than 18,000 customer networks, while a vulnerability in Microsoft Exchange Server led to new attack campaigns in Europe, Russia, and the United States. These are among the most important findings from Kaspersky\u2019s APT Q1 report. <\/strong><\/p>\n\n\n\n

Advanced threat actors are continuously changing their tactics, sharpening their toolsets, and launching new waves of activity. That\u2019s why, to keep users and organizations informed about the threats they face, Kaspersky\u2019s Global Research and Analysis (GReAT) team provides quarterly reports about the most important developments in the advanced persistent threat landscape. This past quarter, they took note of two major waves of activity. <\/p>\n\n\n\n

The first was driven by the SolarWinds compromise, in which <\/ins>the IT managed services provider\u2019s Orion IT software for monitoring IT infrastructures was compromised. This led to a custom backdoor known as Sunburst being installed on the networks of more than 18,000 customers. Many of these included large corporations and government bodies in North America, Europe, the Middle East and Asia.<\/p>\n\n\n\n

Upon closer examination of the backdoor, Kaspersky researchers noted its similarities with the previously identified backdoor named\u00a0Kazuar<\/a>, first spotted in 2017 and tentatively linked to the infamous\u00a0Turla<\/a>\u00a0APT group. This suggests the attackers behind Kazuar and Sunburst could be somehow linked.\u00a0<\/p>\n\n\n\n

The second wave of activity was driven by now-patched zero day exploits in\u00a0Microsoft Exchange Server<\/a>. At the beginning of March, a new APT actor known as HAFNIUM was seen taking advantage of these exploits to launch a series of \u201climited and targeted attacks\u201d. During the first week of March, approximately 1,400 unique servers were targeted for exploitation, with the majority in Europe and the United States. Given that some servers were targeted multiple times, it appears that multiple groups are now utilizing the vulnerabilities. In fact, in mid-March, we uncovered another campaign utilizing these same exploits targeting Russia. This campaign showed some ties to HAFNIUM, as well as to previously known clusters of activity Kaspersky has been investigating.<\/p>\n\n\n\n

A new cluster of activity by the infamous APT group Lazarus was also reported\u2014also utilizing zero-day exploits. This time, the group used social engineering to convince security researchers to download a compromised Visual Studio project file or lure the victims to their blog, after which a Chrome exploit was installed. The lures often revolved around zero-days and the attack appears to have been launched to steal vulnerability research. The first wave occurred in January and the second in March, which was coupled with a new wave of fake social media profiles and a fake company to effectively trick the intended victims. <\/p>\n\n\n\n

Upon closer examination, Kaspersky researchers noted that the malware used in the campaign matched\u00a0ThreatNeedle<\/a>, a backdoor developed by Lazarus and recently seen targeting the defense industry in mid-2020.<\/p>\n\n\n\n

Another interesting zero-day exploit campaign\u2014dubbed TurtlePower\u2014was seen targeting government and telecom entities in Pakistan and China and is believed to be linked with the BitterAPT group. The origin of the\u00a0now-patched vulnerability<\/a>\u00a0appears to be connected with \u201cMoses\u201d, a broker that has developed at least five exploits in the past two years, some of which have been utilized by both BitterAPT and\u00a0DarkHotel<\/a>.<\/p>\n\n\n\n

\u201cPerhaps the biggest takeaway from the past quarter is how destructive successful supply chain attacks can be. It will likely be several more months before the full scope of the SolarWinds attack is fully understood. The good news is that the entire security community is now talking about these types of attacks\u2014and what we can do about them. The first three months have also reminded us about the importance of patching devices as soon as possible. Zero-day exploits will continue to be a highly effective and common way for APT groups to compromise their victims, even in surprisingly creative ways\u2014as shown by Lazarus\u2019s<\/ins> recent campaign,\u201d comments Ariel Jungheit, senior security researcher with GReAT.  <\/em><\/p>\n\n\n\n

The Q1 APT trends report summarizes the findings of Kaspersky\u2019s subscriber-only threat intelligence reports, which also include Indicators of Compromise (IOC) data and YARA rules to assist in forensics and malware hunting.\u00a0For more information, please contact:\u00a0intelreports@kaspersky.com<\/a><\/p>\n\n\n\n

Read more about the APT Q1 threat landscape on\u00a0Securelist<\/a>.<\/p>\n\n\n\n

To protect your company from advanced persistent threat activity, Kaspersky experts recommend: <\/strong><\/p>\n\n\n\n