Nobelium, gulu lomwe lidayambitsa kuwukira kwa SolarWinds, likadali ndi zida zambiri zotsogola zomwe zili nazo. Awa ndi mawu omaliza a akatswiri achitetezo a Mandiant pa kafukufuku waposachedwa. Kuopsa kwa awa -mwina boma-backed- hackers sikunapitebe.
Chaka chapitacho, obera a Nobelium adatha kulanda katswiri wachitetezo waku America SolarWinds. Pambuyo pake, makasitomala ambiri a katswiri wachitetezoyu adabedwa, pafupifupi 18,000, kuphatikiza Microsoft komanso boma la US. Izi ndi zotsatira zake zonse.
Kufufuza kwina pazomwe adaberawo adawonetsa kuti a Nobelium hackers akuganiziridwa kuti alandila thandizo kuchokera kudziko lina. Izi mwina ndi Russia.
Nobelium imadziwika bwino chifukwa cha njira zake zapamwamba, njira ndi njira, zomwe zimatchedwanso TTP. M'malo molimbana ndi omwe akuzunzidwa m'modzim'modzi, amakonda kusankha kampani imodzi yomwe imatumikira makasitomala angapo. Kudzera kuthyolako kwa kampani yomalizayi, obera amayang'ana mtundu wa 'master key' omwe amangotsegula 'zitseko kwa makasitomala.
Research Mandiant
Kafukufuku wa Mandiant akuwonetsa kuti Nobelium, ndi magulu awiri owononga UNC3004 ndi UNC2652 omwe ali m'gulu lagulu lachinyengoli, apititsa patsogolo ntchito zawo za TTP. Makamaka kuukira pa cloud mavenda ndi ma MSPs kuti afikire mabizinesi ochulukirapo.
Njira zatsopano za obera ndi kugwiritsa ntchito zidziwitso zopezedwa kudzera mu kampeni yaumbanda yazazazazazaza ena owononga. Ndi ichi, Nobelium hackers anafuna mwayi woyamba kwa ozunzidwa. Obera adagwiritsanso ntchito maakaunti omwe ali ndi mwayi Wochita Zoyeserera kuti "akolole" maimelo achinsinsi. Obera adagwiritsanso ntchito ma proxy a IP kwa ogula ndi zida zatsopano zakomweko kuti alankhule ndi omwe akhudzidwa.
Njira zina
Anagwiritsanso ntchito mphamvu zatsopano za TTP podutsa zoletsa zachitetezo m'malo osiyanasiyana, kuphatikiza makina enieni, kuti adziwe masanjidwe amkati. Chida china chomwe chidagwiritsidwa ntchito chinali chotsitsa chatsopano cha CEELOADER. Obera adakwanitsa kulowa muakaunti ya Microsoft Azure ndikuba 'makiyi a master' omwe amapereka mwayi wofikira makasitomala agulu lomwe lakhudzidwa. Pomaliza, obera adakwanitsa kugwiritsa ntchito molakwika kutsimikizika kwazinthu zambiri pogwiritsa ntchito zidziwitso zokankhira pa mafoni.
Ofufuza a ku Mandiant adawona kuti owonongawo ankakonda kwambiri deta yomwe inali yofunika ku Russia. Kuphatikiza apo, nthawi zina zidabedwa zomwe owononga adayenera kupereka zipata zatsopano kuti aukire anthu ena.
Nobelium kulimbikira vuto
Lipotilo likumaliza kuti kuukira kwa Nobelium sikudzatha posachedwa. Malinga ndi ochita kafukufuku, owonongawa akupitirizabe kukonza njira zawo zowukira ndi luso lawo kuti azikhala nthawi yayitali m'magulu a ozunzidwa, kupewa kuzindikiridwa ndi kukhumudwitsa ntchito zobwezeretsa.