Cell division Flashcards
(92 cards)
Current or former employee, contractor, or other business partner who has or had authorized access to an organization’s network, system, or data and intentionally misused the access to negatively affect the CIA of the organization’s data or information systems.
Insider threat
4 insider threat methods
Steal sensitive data via storage devices
Open backdoors
Logic bombs
Attack internal resources
Insider threat detection and prevention techniques
Data/File encryption DLP Data access monitoring Data redaction Data access control
Discretional access control
Only users specified by the owner may have some combination of read, write, and execute rights to file
Mandatory access control
Access control policy decisions are made by a central authority, not by the individual owner of an object, and the owner cannot change access rights
Direct remote attacks
Attack delivered via wifi, ethernet, rf or bluetooth
Drive by attack
Malware automatically downloads to user’s system after visiting legitimate, but compromised website
Attacks on south korea
DarkSeoul Gang
North Korea state sponsored threats
TTPs include weaponized email attachments
Human intelligence usage
Russian state sponsored threats
Russian attributed malware
Zeus Gozi SpyEye SpyZeus Ligats Trojans
Vietnamese govt suspected
Poses threat to companies doing business, manufacturing or preparing to invest in the country
APT32
APTs associated with China
30, 18, 17, 12, 3, 1
APTs associated with Russia
29, 28
Attributes of an APT
Loads malicious software directly into a computer’s memory in a way that bypasses HD
Uses blackcoffee malware as part of the first stage of its attacks
APT 17 - China
Attributes of an APT -
Major data breach at community health systems
Exploited “Heartbleed” bug in VPN server within CHS network
Gh0st remote access trojan (RAT)
APT 18 - China
Attributes of an APT -
Components designed to infect removable drives in order to cross air-gapped networks and steal data
Steal sensitive political, economic and military info about region for gov espionage
Associated malware: Backspace Neteagle Shipshape Spaceship Flashfood
APT 30 - China
Attributes of an APT -
Only compromised servers for C2 communication
Associated malware:
Hammertoss
Uploader
tDiscover
APT 29 - Russia
Associated malware - Chopstick, Sourface
Targets former Soviet state and NATO
Gain insider info related to govts, militaries and security organizations
APT 28 - Russia
Maintain surveillance on media outlets that could impact reputation of Chinese leaders
Targets: Western journalists, US military contractors, Taiwanese and Japanese govts, Japanese tech companies
Associated malware- Riptide, hightide, threebyte and waterspout
Most clandestine, discriminating, skilled Chinese group
Adapts tools/techniques based on news reports about itself
APT 12 - China
Associated malware - Leouncia
Tends to focus on sat telecoms and tech companies based primarily in SE Asia
APT 5 - Undisclosed
Main actor behind a major attack campaign: Op Clandestine Fox
Associated malware: Shotput, cookiecutter, and Plugx/sogu
APT 3 - China
Systematically stole hundreds of TB of data from at least 141 organizations spanning 20 major industries
Specifically targets industries that China identifies as strategic in its 5 year plan
Associated malware:
Backdoor.(random names)
Steals broad categories of intellectual property
APT 1 - China
Agents that make use of cyberspace resources for intel collection
Cyberspace espionage agent
1 of the critical infrastructure protocols in internet traffic flow
Can be manipulated to route traffic from 1 country to another
Border gateway protocol threat
