H-ISAC TLP White Threat Bulletin Joint Cybersecurity Advisory on Russian GRU Kubernetes Brute Force Campaign July 2021

On July 1, 2021, the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and the UK’s National Cyber Security Centre (NCSC) released a Joint Cybersecurity Advisory regarding Russian General Staff Main Intelligence Directorate’s (GRU) 85th Main Special Service Center (GTsSS), Unit 26165.  

The joint advisory outlines Russia’s malicious use of Kubernetes clusters cloaked by various virtual private network (VPN) providers and The Onion Router (TOR) to conduct widespread, distributed, and anonymized brute force access attempts against several government and private sector targets globally. 

Kubernetes is an open-source system for orchestrating the deployment and management of software containers. This advisory is being shared to prevent a disruption of your network posture as these efforts are almost certainly still ongoing according to the Joint Cybersecurity Advisory.  

The malicious cyber activity has previously been attributed to threat groups identified as Fancy Bear, APT28, Strontium, and a variety of others by the private sector. A significant amount of malicious activity was directed at organizations using Microsoft Office 365 cloud services in addition to targeting other service providers and on-premises email servers using a variety of different protocols.  

This brute force capability allows the 85th GTsSS actors to access protected data, including email, and identify valid account credentials. Those credentials may then be used for a variety of purposes, including initial access, persistence, privilege escalation, and defense evasion. The actors have used identified account credentials in conjunction with exploiting publicly known vulnerabilities, such as exploiting Microsoft Exchange servers using CVE 2020-0688 and CVE 2020-17144, for remote code execution and further access to target networks. After gaining remote access, many well-known tactics, techniques, and procedures (TTPs) are combined to move laterally, evade defenses, and collect additional information within target networks. 

For additional information including description of targets, known TTPs, detection and mitigation strategies, please see the joint cybersecurity advisory here.  

View the entire threat bulletin and the joint advisory below.