{"id":35740,"date":"2022-08-10T10:23:59","date_gmt":"2022-08-10T07:23:59","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=35740"},"modified":"2026-03-28T01:30:17","modified_gmt":"2026-03-27T22:30:17","slug":"golden-ticket-for-industrial-espionage-apt-group-takes-over-it-infrastructure","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/golden-ticket-for-industrial-espionage-apt-group-takes-over-it-infrastructure\/","title":{"rendered":"Golden ticket for industrial espionage: APT group takes over IT infrastructure"},"content":{"rendered":"\n

Kaspersky ICS CERT has detected a wave of targeted attacks on military-industrial complex enterprises\u00a0and public institutions in several Eastern European countries and in Afghanistan. The cybercriminals were able to take control of victims\u2019 entire IT infrastructure \u2013 for industrial espionage.<\/strong><\/p>\n\n\n\n

In January 2022, Kaspersky researchers witnessed several advanced attacks on military enterprises and public organizations. The primary aim of the attacks was to access companies\u2019 private information and to gain control over IT systems. The malware being used by the attackers is similar to the one deployed by TA428 APT, a Chinese-speaking APT group.<\/p>\n\n\n\n

The attackers infiltrate enterprise networks by sending carefully crafted phishing emails, some of which contain information specific to their organization that has not been made publicly available at the time when emails were sent. This indicates that the attackers deliberately prepare for the attacks and select their targets in advance. The phishing emails include a Microsoft Word document with malicious code to exploit a vulnerability that enables an attacker to execute arbitrary code without any additional activity.\u00a0The vulnerability<\/a>\u00a0exists in outdated versions of the Microsoft Equation Editor, a component of Microsoft Office.<\/p>\n\n\n\n

Fragment of the contents of a malicious document<\/em><\/p>\n\n\n\n

Moreover, the attackers used six different backdoors at the same time \u2013 to set up additional communication channels with infected systems in case one of the malicious programs was detected and removed by a security solution. These backdoors provide extensive functionality for controlling infected systems and collecting confidential data.<\/p>\n\n\n\n

The attack\u2019s final stage involves hijacking the domain controller and gaining complete control of all the organization\u2019s workstations and servers \u2013 and in one of the cases, they even took over cybersecurity solutions control center.<\/strong> After gaining domain administrator privileges and access to the Active Directory, attackers ran the \u201cgolden ticket\u201c attack to impersonate organizations arbitrary user accounts and search for documents, and other files, containing the attacked organization\u2019s sensitive data, which they exfiltrate to the attackers\u2019 servers hosted in different countries. <\/p>\n\n\n\n

\u201cGolden Ticket attacks take advantage of the default authentication protocol which has been used since the availability of Windows 2000. By forging Kerberos Ticket Granting Tickets (TGTs) within the corporate network, the attackers can independently access any service that belongs to the network for an unlimited time. As a result, just changing passwords or blocking compromised accounts won\u2019t be enough. Our advice is to check carefully all suspicious activity and rely on trustworthy security solutions,\u201d<\/em> comments Vyacheslav Kopeytsev, a security expert at ICS CERT Kaspersky. <\/p>\n\n\n\n

Learn more about these targeted attacks on\u00a0Kaspersky ICS CERT<\/a>.<\/p>\n\n\n\n

To keep your ICS computers protected from various threats, Kaspersky experts recommend businesses: <\/strong><\/p>\n\n\n\n