Analysis Summary

APT (Advanced Persistent Threat) Nobelium is a state-sponsored Threat Actor group that has been responsible for several cyber attacks in recent years. The group is believed to be linked to the Russian government and has been identified by many cybersecurity firms as one of the most sophisticated and dangerous APT groups in operation.

Nobelium was first identified in 2014, but it was not until 2019 that the group gained wider attention after it launched a series of attacks targeting US government agencies and private sector companies. In May 2021, the group was responsible for a major cyber attack on US-based software company SolarWinds, which affected thousands of government and private sector organizations.

The SolarWinds attack involved Nobelium compromising SolarWinds' software update system, which allowed them to distribute a malicious software update to SolarWinds' customers. This attack is believed to be one of the largest and most sophisticated cyber attacks ever carried out.

Nobelium is known for using a range of tactics to compromise its targets, including spear phishing campaigns, exploiting vulnerabilities in software, and using social engineering techniques to gain access to sensitive information. The group is highly skilled and has been known to tailor its attacks to specific targets, using advanced techniques to evade detection.

Due to its sophisticated techniques and links to the Russian government, Nobelium is considered a major threat to global cybersecurity. Governments and private sector organizations are advised to take appropriate measures to protect themselves against this group's activities.

Impact

• Information Theft
• Cyber Espionage
• Exposure of Sensitive Data

Indicators of Compromise

Domain Name

• foreignhurry.com
• macfound.services
• ms-meeting.com
• parseccomputer.cloud
• google-meet.cloud
• microsoftmeeting.cloud
• stratfor.cloud
• wilsoncenter.cloud
• secretiveleap.com
• awsprotect.online
• ms-aws.cloud

IP

• 45.141.58.30

Remediation

• Block all threat indicators at your respective controls.
• Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Apply the latest security patches and updates to the email server software and associated components to address any vulnerabilities that may have been exploited by APT29. Also, prioritize patching known exploited vulnerabilities and zero-days.
• Perform comprehensive security audits on the email server infrastructure to identify and address any potential weaknesses. This includes reviewing server configurations, access controls, and encryption protocols to ensure they meet industry best practices.
• Emails from unknown senders should always be treated with caution. Never trust or open links and attachments received from unknown sources/senders.
• Enable 2FA for user accounts on the email server to add an extra layer of security. This prevents unauthorized access even if usernames and passwords are compromised.
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Implement network segmentation to isolate critical systems and sensitive data from the rest of the network. This limits the lateral movement of attackers in case of a breach and reduces the impact of potential future attacks.
• Implement a regular backup strategy for email servers and critical data. Ensure that backups are stored securely and regularly tested for data restoration.