Source: Medium Author: SIMKRA URL: https://medium.com/@simone.kraus/hunting-svr-russian-foreign-intelligence-service-svr-exploiting-jetbrains-teamcity-cve-globally-1b40810f8552

ONE SENTENCE SUMMARY:

The SVR exploits vulnerabilities in technology firms like JetBrains to obtain sensitive data and access networks for intelligence gathering.

MAIN POINTS:

1. SVR operations have targeted networks since 2013 for confidential and proprietary information collection.
2. Their latest tactic involves exploiting JetBrains’ TeamCity server vulnerabilities globally.
3. Unpatched systems are particularly vulnerable to the SVR’s cyber operations.
4. GraphicalProton backdoor utilizes cloud services like OneDrive and Dropbox for malicious communication.
5. The SVR employs EDRSandBlast to evade detection by disabling security software.
6. It uses network reconnaissance tools and techniques for lateral movement within compromised networks.
7. Commands like “whoami” are commonly employed for initial reconnaissance of user privileges.
8. The SVR captures sensitive registry data by saving it into files and compressing them.
9. Techniques like tunneling with “rr.exe” are utilized to establish C2 infrastructure connections.
10. Threat hunting techniques and Sigma Rules are recommended for detecting SVR activities.

TAKEAWAYS:

1. Continuous monitoring and patching of software are critical to prevent SVR exploitation.
2. Understanding how the SVR manipulates technologies can aid in strengthening defenses.
3. Utilizing Sigma Rules can enhance detection of specific threat actor behaviors.
4. Leveraging cloud services for data exfiltration presents a unique challenge for cybersecurity.
5. Regular assessment of network configurations can mitigate risks posed by lateral movement tactics.