Masu Hackers na SolarWinds Suna da Sabbin Hanyoyi don Hare Jama'a

Nobelium, ƙungiyar da ke da alhakin harin SolarWinds, har yanzu tana da manyan arsenal na ci-gaba na iya yin kutse a hannunta. Wannan ita ce ƙarshen ƙwararrun tsaro na Mandiant a wani bincike na baya-bayan nan. Hatsarin wadannan -watakila masu satar bayanan gwamnati- masu kutse bai wuce ba tukuna.

Shekara guda da ta wuce, masu satar bayanan Nobel sun yi nasarar kutsawa cikin kwararre kan harkokin tsaro na Amurka SolarWinds. Bayan haka, an yi wa abokan cinikin wannan ƙwararrun tsaro kutse, kusan 18,000, ciki har da Microsoft da kuma gwamnatin Amurka. Wannan tare da duk sakamakonsa.

Wani bincike da aka yi kan bayanan masu kutse ya nuna cewa ana zargin barayin Nobelium da karbar taimako daga wata kasa. Wannan tabbas Rasha ce.

Nobelium sananne ne don dabarun ci gaba, dabaru da hanyoyin sa, wanda kuma aka sani da TTP. Maimakon su kai wa wadanda abin ya shafa hari daya bayan daya, sun gwammace su zabi kamfani daya da ke hidimar kwastomomi da yawa. Ta hanyar kutse a kan kamfanin na ƙarshe, masu satar bayanan suna neman wani nau'in 'maɓallin maɓalli' wanda kawai 'buɗe' kofofin ga abokan ciniki.

Binciken Mandiant

Binciken Mandiant ya nuna cewa Nobelium, da ƙungiyoyin hackers guda biyu UNC3004 da UNC2652 waɗanda ke cikin wannan haɗin gwiwar kutse, sun ƙara kammala ayyukansu na TTP. Musamman ga hare-haren cloud dillalai da MSPs don isa ga ƙarin kasuwancin.

Sabbin dabarun masu satar bayanai sune amfani da bayanan sirri da aka samu ta hanyar yakin neman zabe na masu satar bayanan sirri na wasu masu kutse. Da wannan, masu satar bayanan Nobel sun nemi hanyar farko ga wadanda abin ya shafa. Masu satar bayanan sun kuma yi amfani da asusu tare da gata na Imel don “girbi” bayanan imel. Masu satar bayanan sun kuma yi amfani da sabis na wakili na IP don masu amfani da sabbin kayan aikin gida don sadarwa tare da wadanda abin ya shafa.

Sauran dabaru

Sun kuma yi amfani da sabbin damar TTP don ƙetare ƙuntatawa na tsaro a wurare daban-daban, gami da injunan kama-da-wane, don ƙayyadaddun jeri na cikin gida. Wani kayan aikin da aka yi amfani da shi shine sabon mai saukewa na CELOADER. Masu satar bayanan har ma sun yi nasarar kutsawa cikin kundin adireshi na asusun Microsoft Azure tare da sace 'maɓallin maɓalli' waɗanda ke ba da damar yin amfani da kundayen adireshi na abokan cinikin wani ɓangaren da abin ya shafa. A ƙarshe, masu satar bayanan sun sami nasarar cin zarafi ta hanyar tantance abubuwa da yawa ta amfani da sanarwar turawa akan wayoyin hannu.

Masu binciken Mandiant sun lura cewa masu satar bayanan sun fi sha'awar bayanan da ke da mahimmanci ga Rasha. Bugu da kari, a wasu lokuta ana satar bayanan da masu satar bayanan dole ne su ba da sabbin hanyoyin shiga don kai hari ga sauran wadanda abin ya shafa.

Nobelium matsala na ci gaba

Rahoton ya kammala da cewa hare-haren Nobelium ba zai tsaya nan ba da dadewa ba. A cewar masu binciken, masu satar bayanan sun ci gaba da inganta dabarun kai hari da basirar su don su dade a cikin hanyoyin sadarwar wadanda abin ya shafa, da guje wa ganowa da kuma dakile ayyukan dawo da su.