Russian Cyber-Operations as Part of Ukrainian Military Actions

Posted February 24, 2022

Security concerns from businesses about retaliation from Russia over sanctions levied by the United States are real. We’ve learned from recent attacks that Russia is actively targeting and exploiting infrastructure and public/private businesses to further their political objectives. The SolarWinds attack showed us how organizations of all kinds can have serious impacts from these activities.

Per news outlets and government sources, organizations who do business with or in Ukraine, are contractors with the Department of Defense, or are a part of critical infrastructure as defined by Presidential Policy Directive 21 (PPD-21), are more likely to be a direct target of these attacks.

Scroll down for additional steps you can take to protect and prevent any tangential and indirect effects that may impact you.

RECOMMENDED ACTIONS

Here are several steps to protect and prevent any tangential and indirect effects that may impact you:

Analyze your vendors and supply chain. Review your existing vendors and understand what reliance they have on organizations that either operate in high-risk areas or rely on other vendors that do.
Understand what software may have high exposure. Much like SolarWinds was a path into many federal agencies, you should review your applications and look to understand which may be more at risk through the lens of Russian nation-state cyber objectives.
Create a short DMZ exception list and monitor it. Firewalls are two-way devices so carefully observe your firewall egress (outbound traffic). DMZ servers off your firewalls are meant to RESPOND to external requests so if you see your DMZ servers initiating outbound, that may be symptomatic of “phone home” command and control activity. Please note legitimate file transfer systems and email systems may initiate outbound traffic, but most organizations do not run their own mail servers anymore.
Use geographic blocking. Block all traffic at firewalls, edge devices, and intrusion prevention sensors) from Russia and Ukraine (if you do not do business with either one) but know that most Russian hacking groups do not emanate from Russian IP space. They try to avoid attribution to themselves at all costs. Remember always, the internet can be and often is, a hostile place.
Create an application control list. Know the applications running on your systems and create an application control list (also known as “application whitelisting”). It’s really important to know what executables are “normal” on your systems. If you have an EDR or XDR platform, you should be able to stop executables that do not belong on your systems (set block alerts). For help, there are tools like the Windows SRUM Dump Utility (Windows only) to outline executables run on any of your systems. Linux requires Sysmon for Linux or Auditd.
Vigilantly analyze SIEM and network detection & response tools. State sponsored attackers often use Living off the Land (LOL for short) attacks. These attacks use features resident in your operating systems and applications, therefore evade anti-virus and EDR tools. They allow hackers to blend in. Blocking ports does not help, this is seen as legitimate traffic. This requires careful analysis from tools like SIEM and Network Detection & Response. If you have none of these, have your admins lock down your systems as much as they can without affecting performance of your business and your users.
Increase your logging even at the expense of duration. Logs lose value over time. Logging more has higher importance than logging duration.
Obtain detection & response capabilities. Detection and Response is more important at this moment in time than prevent. Strongly consider a Managed SOC if you do not already have an outsourced or internal security operations center. 24×7 vigilance in crucial. Stay tuned to threat intelligence advice from trusted sources such as your SOC provider.
Speak to your cyber-insurer or broker as soon as possible. Make sure you are covered by a nations-state event if attacked. Do not assume. Many policies have nations-state exceptions, and many policies have undergone significant changes, recently.

FOR MORE INFORMATION

Current GreyCastle Security clients with an immediate need should speak to their vCISO or Solutions Advisor to better understand what exposures you may have. Clients can also expect their vCISO to add this to their next scheduled office hours. Organizations in need of guidance or expertise can contact a GreyCastle Security Solutions Specialist on our contact page or by emailing intel@greycastlesecurity.com.