World Bank network intrusion COMPROMISES World Bank
The incident was a serious breach of the World Bank network.
Explicit Confidence 97% · Jack Rhysider EP 91 Details
“a serious breach in the network of a major bank”
Incident
incident:world_bank_network_intrusion
Intrusion in which an attacker accessed and changed configurations on numerous World Bank servers, including systems associated with HR and an HSM.
Intrusion in which an attacker accessed and changed configurations on numerous World Bank servers, including systems associated with HR and an HSM.
“they had evidence that this attacker had accessed and changed configurations on thirty different servers in the bank”
“we had thirty machines involved”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | COMPROMISES | World Bank | Explicit | 91 |
| outgoing | INVOLVES | file integrity monitoring | Explicit | 91 |
| outgoing | INVOLVES | hardware security module | Explicit | 91 |
| outgoing | INVOLVES | Forensic imaging | Explicit | 91 |
| outgoing | INVOLVES | lateral movement | Explicit | 91 |
| outgoing | INVOLVES | Active Directory | Explicit | 91 |
| outgoing | INVOLVES | multi-factor authentication | Explicit | 91 |
| outgoing | INVOLVES | smart card authentication | Explicit | 91 |
| outgoing | INVOLVES | Password cracking | Explicit | 91 |
| outgoing | INVOLVES | Honeypot | Explicit | 91 |
| outgoing | INVOLVES | Mandiant | Explicit | 91 |
| outgoing | ATTRIBUTED_TO | China | Uncertain | 91 |
World Bank network intrusion COMPROMISES World Bank
The incident was a serious breach of the World Bank network.
Explicit Confidence 97% · Jack Rhysider EP 91 Details
“a serious breach in the network of a major bank”
World Bank network intrusion INVOLVES file integrity monitoring
The intrusion was detected after file integrity monitoring indicated unauthorized changes on a server.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“the file integrity monitor triggered an alert and it showed that someone had made changes to a server”
World Bank network intrusion INVOLVES hardware security module
One of the systems touched during the intrusion was the World Bank's hardware security module, described as holding cryptographic material.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“one of the machines that got touched was our HSM”
World Bank network intrusion INVOLVES Forensic imaging
Investigators created forensic images of affected servers and later used remote forensic imaging on a suspect's computer.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“they had evidence that this attacker had accessed and changed configurations on thirty different servers”
“We could push out our remote forensic imaging element out to them and grab an image of their hard drive.”
World Bank network intrusion INVOLVES lateral movement
The attacker moved laterally from one server to other servers after gaining access.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“Once they were in one computer, they were able to traverse the network to get into other computers.”
World Bank network intrusion INVOLVES Active Directory
An enterprise administrator account for Active Directory was compromised during the intrusion.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“one of our three enterprise admins for AD’s account was compromised”
World Bank network intrusion INVOLVES multi-factor authentication
The bank had abandoned a multi-factor access program before the intrusion.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“they had abandoned a multi-factor access program”
World Bank network intrusion INVOLVES smart card authentication
The bank was transitioning from token-based authentication to smart-card authentication when the attackers gained access.
Explicit Confidence 98% · Jack Rhysider EP 91 Details
“they were in the process of switching everyone to use smart cards for authentication”
World Bank network intrusion INVOLVES Password cracking
The investigation involved obtaining password hashes and cracking the enterprise administrator password.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“she decided to get the hashes herself and see if she could crack the password”
“was able to pull out the passwords for the enterprise admin rather quickly”
World Bank network intrusion INVOLVES Honeypot
Investigators planted fake information in a conference room as a honeypot to identify an internal leaker.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“We decided to set up a honeypot.”
“Started writing some fake stuff on the walls; put up some papers on the table”
World Bank network intrusion INVOLVES Mandiant
The World Bank called Mandiant to provide additional incident-response assistance.
Explicit Confidence 99% · Jack Rhysider EP 91 Details
“the bank realized they needed even more help, so they called Mandiant up”
World Bank network intrusion ATTRIBUTED_TO China
The attack was not identified with certainty, but clues and some Mandiant analysis suggested it came from China or a Chinese asset.
Uncertain Confidence 88% · Jack Rhysider EP 91 Details
“there were a few clues that suggested that this attack came from China”
“they knew that it was China or some Chinese asset”