Campaign
campaign:cloud_hopper
Campaign discussed in the episode involving compromises of managed service providers and their customers.
Campaign discussed in the episode involving compromises of managed service providers and their customers.
“EP 103: Cloud Hopper”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | Swedish Security Service | Explicit | 103 |
| outgoing | INVOLVES | jump server | Explicit | 103 |
| outgoing | USES | Mimikatz | Explicit | 103 |
| outgoing | INVOLVES | DLL side-loading | Explicit | 103 |
| outgoing | USES | Vba32 AntiRootkit Scanner | Explicit | 103 |
| outgoing | USES | NBTscan | Explicit | 103 |
| outgoing | INVOLVES | network scanning | Explicit | 103 |
| outgoing | TARGETS | United States Department of Defense | Explicit | 103 |
| outgoing | USES | Remote Desktop | Explicit | 103 |
| outgoing | INITIAL_ACCESS_VIA | Remote Desktop | Explicit | 103 |
| outgoing | INVOLVES | PlugX | Explicit | 103 |
| outgoing | INVOLVES | credential dumping | Explicit | 103 |
| outgoing | INVOLVES | lateral movement | Explicit | 103 |
| outgoing | COMPROMISES | Domain controller | Explicit | 103 |
| outgoing | INVOLVES | keylogger | Explicit | 103 |
| outgoing | COMPROMISES | Managed Service Provider | Explicit | 103 |
| outgoing | TARGETS | Managed Service Provider | Explicit | 103 |
| outgoing | ATTRIBUTED_TO | APT10 | Attributed | 103 |
| outgoing | INVOLVES | Hewlett Packard Enterprise | Attributed | 103 |
| outgoing | INVOLVES | IBM | Attributed | 103 |
| outgoing | INVOLVES | Fujitsu | Attributed | 103 |
| outgoing | INVOLVES | Ericsson | Attributed | 103 |
| outgoing | INVOLVES | Sabre | Attributed | 103 |
Cloud Hopper INVOLVES Swedish Security Service
The campaign investigation began after the Swedish Security Service notified the victim about communications with a command-and-control server.
Explicit Confidence 98% · Jack Rhysider EP 103 Details
“they had been contacted by the Swedish Security Service because one of the systems had been talking to a command and control server”
Cloud Hopper INVOLVES jump server
A customer MSP jump server was compromised and communicated with command-and-control infrastructure.
Explicit Confidence 98% · Jack Rhysider EP 103 Details
“this jump server that was reaching out to a known command and control server”
Cloud Hopper USES Mimikatz
The attackers ran Mimikatz on the jump server and obtained nearly one hundred clear-text credentials, including Active Directory administrators.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“including several Active Directory domain administrators”
“It was called thehostingoftheserver.mimikatz.hash.”
Cloud Hopper INVOLVES DLL side-loading
The attackers used DLL side-loading implants to execute malware through legitimate software binaries.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“We found three more instances of DLL side-loading implants”
Cloud Hopper USES Vba32 AntiRootkit Scanner
A legitimate Vba32 AntiRootkit Scanner binary was used in the DLL side-loading mechanism and connected to command-and-control infrastructure.
Explicit Confidence 97% · Fabio Viggiani EP 103 Details
“The name of the process was vba32arkit.exe”
“turned out to be a legitimate software called Vba32 AntiRootkit Scanner”
Cloud Hopper USES NBTscan
The attackers used NBTscan to scan public IP ranges for NetBIOS file-sharing connections.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“It was a legitimate tool called NBTscan. It’s a NetBIOS main network scanner.”
Cloud Hopper INVOLVES network scanning
The attackers scanned public IP ranges, including ranges belonging to the US Department of Defense, for shared network drives.
Explicit Confidence 99% · Fabio Viggiani EP 103 Details
“nineteen of those public IP ranges belonged to the US Department of Defense”
Cloud Hopper TARGETS United States Department of Defense
The campaign scanned DoD address ranges and was ultimately associated with efforts to reach US government networks.
Explicit Confidence 98% · Jack Rhysider EP 103 Details
“This threat actor was using this server and this company’s network to scan the US Department of Defense’s servers”
Cloud Hopper USES Remote Desktop
The malware was placed on the server after an attacker logged in through Remote Desktop using stolen credentials.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“someone simply logged into this computer normally, through Remote Desktop, and put it there”
Cloud Hopper INITIAL_ACCESS_VIA Remote Desktop
The investigated server was initially accessed through Remote Desktop with a stolen MSP employee account.
Explicit Confidence 96% · Jack Rhysider EP 103 Details
“They logged into it and put the malware on.”
Cloud Hopper INVOLVES PlugX
The attackers later installed PlugX on the compromised server.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“they brought in a known malware called PlugX”
Cloud Hopper INVOLVES credential dumping
After entering the network, the attackers ran Mimikatz to collect credentials.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“it was then when Mimikatz was run where they grabbed all the credentials”
Cloud Hopper INVOLVES lateral movement
The attackers used stolen credentials to pivot and traverse to other systems, including the domain controller.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“started pivoting and traversing to other systems in the network”
Cloud Hopper COMPROMISES Domain controller
The attackers gained full administrator access to the customer’s domain controller.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“they got into the domain controller of this network and had full admin access there”
Cloud Hopper INVOLVES keylogger
Keyloggers were found on MSP jump servers and could capture credentials for multiple customers.
Explicit Confidence 99% · Jack Rhysider EP 103 Details
“we know that they found key loggers on the jump servers at the MSP’s site”
Cloud Hopper COMPROMISES Managed Service Provider
The campaign compromised MSP infrastructure and used it to reach multiple customers.
Explicit Confidence 99% · Rod Rosenstein EP 103 Details
“the defendants are accused of targeting and compromising Managed Service Providers or MSPs”
Cloud Hopper TARGETS Managed Service Provider
The campaign targeted MSPs because they had trusted access to customer networks and data.
Explicit Confidence 99% · Rod Rosenstein EP 103 Details
“the defendants are accused of targeting and compromising Managed Service Providers or MSPs”
Cloud Hopper ATTRIBUTED_TO APT10
The US Department of Justice indictment alleges that the defendants worked for a group known to cybersecurity experts as APT10.
Attributed Confidence 99% · Rod Rosenstein EP 103 Details
“The indictment alleges that the defendants work for a group known to cyber-security experts as APT10.”
Cloud Hopper INVOLVES Hewlett Packard Enterprise
Reuters journalists reportedly identified Hewlett Packard Enterprise as one of seven compromised service providers in the campaign.
Attributed Confidence 96% · Jack Rhysider EP 103 Details
“seven different service providers were compromised, and they listed Hewlett Packard Enterprise”
Cloud Hopper INVOLVES IBM
Reuters journalists reportedly identified IBM as one of seven compromised service providers in the campaign.
Attributed Confidence 96% · Jack Rhysider EP 103 Details
“they listed Hewlett Packard Enterprise, IBM, Fujitsu”
Cloud Hopper INVOLVES Fujitsu
Reuters journalists reportedly identified Fujitsu as one of seven compromised service providers in the campaign.
Attributed Confidence 96% · Jack Rhysider EP 103 Details
“IBM, Fujitsu, TADA Consultancy”
Cloud Hopper INVOLVES Ericsson
Reuters reportedly listed Ericsson among customers affected by the compromised service providers.
Attributed Confidence 94% · Jack Rhysider EP 103 Details
“the telecom giant Ericsson”
Cloud Hopper INVOLVES Sabre
Reuters reportedly listed Sabre among customers affected by the compromised service providers.
Attributed Confidence 94% · Jack Rhysider EP 103 Details
“the travel reservation service Sabre”