Don’t just track threats. Test them.
Security leaders have no shortage of threat intelligence. The harder part is knowing what to do with it. How do you know whether your organization could withstand the attacks you’re reading about? We’ve created three practical attack scenarios based on real attacker techniques. Use them to challenge assumptions, validate controls, and test how your organization would respond if the attack happened tomorrow.
Scenario: North Korean IT workers hired in a financial services organization’s engineering team pursue exfiltration of IP, and brokering of long-term access
A long-standing DPRK operation for funding the regime’s strategic goals has involved remote IT workers hired under false pretenses in the technology engineering or software development teams of firms across various verticals1. This originally focused on US-based organizations, later expanding to targets globally2.
Although these operations usually avoid intrusive activities with an aim solely to maintain this position for siphoning of salaries, the hypothesis is presented that the actors receive new instructions and adjust their targeting to pursue higher risk/reward goals such as:
- Access and exfiltration of internal confidential data – including Intellectual Property (IP) such as source code, or sensitive PII – to sell it to other parties.
- Backdooring of internal assets to establish and maintain long-term access to the IT environment.
- Obtaining or creating credentials or other means of shareable remote access into the on-premises or cloud infrastructure that could be sold to initial access brokers.
Indicative high-level scenario
Reversec simulated this scenario by performing an “assumed breach” exercise, from the starting point of a hired remote IT worker with typical developer access, in order to assess the impact of such a scenario materializing. In detail, new employee personas were created, each granted a Virtual Desktop Instance (VDI) as was common for this organizational role profile. Crucially, this profile also involved access to the organization’s Source Code Management (SCM) systems, with contribution permissions to assigned projects – as would be typical for a standard developer.
Initially, the attack began with reconnaissance of the internal environment, searching file shares and gathering information from internal document stores (T1083, T1213).
With this understanding, the attackers created exfiltration channels by leveraging proxy exemptions. They then used these channels to extract information and infiltrate tooling into the environment (T1105).
Reconnaissance also focused on the SCM system, where the attackers extracted organizational secrets through weaknesses in Continuous Integration / Continuous Deployment (CI/CD) pipelines (T1087). These secrets were then used to perform additional reconnaissance of the cloud identity plane, as well as to backdoor software packages in internal registries and binary distribution platforms (T1525, T1195.002).
Within said CI/CD environment, the ephemeral execution instances (runners) were exempt from the standard security monitoring stack, including endpoint detection and response (EDR) tooling. This allowed establishment of Command & Control (C2) channels that were not directly connected to the initial access accounts (T1071).
Exfiltration of larger scale could then be carried out from these runners, allowing all source code repositories to be extracted to attacker-controlled infrastructure. Analysis of the exfiltrated source code repositories for credentials yielded several valid instances (T1552). This included an access token with administrative access to further repositories, which was iteratively leveraged to configure a backdoor through a deploy key. This successfully granted persistent access to the repositories from the public Internet, bypassing enterprise access controls – access that could then be sold to an initial access broker.
Other credential hunting activities carried out from the VDIs discovered privileged credentials in a file share (T1552.001). The corresponding account controlled users of an internal system, allowing lateral movement to their VDIs (T1021). This enabled hijacking an active session to the internal platform, which they then leveraged to download and exfiltrate sensitive data through previously established channels (T1041).
Threat intelligence is only valuable if your defenses can withstand it. Let’s test what would happen in your environment.
