SVR APT29 targets U.S. government and cloud infrastructure

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

CISA reports SVR cyber operations targeting government, think tanks, and IT firms via password spraying, zero-days, and SolarWinds compromise.

The FBI, DHS, and CISA assess that Russian Foreign Intelligence Service (SVR) cyber actors—tracked as APT29, the Dukes, CozyBear, and Yttrium—pose a longstanding threat to U.S. and allied entities. Since 2018, the SVR has shifted from malware-focused operations to targeting cloud resources, particularly email and Microsoft 365 environments. The group exploits initial access through password spraying, unpatched VPN appliances, and supply-chain compromises like the SolarWinds incident, using stealthy tradecraft to move laterally within networks and access high-value targets such as IT staff accounts and vaccine research repositories.

SVR operational tradecraft includes low-and-slow password spraying from geographically distributed IP addresses (residential, commercial, mobile, and Tor), leveraging misconfigured multi-factor authentication exemptions and legacy authentication protocols. The group uses leased VPS infrastructure obtained via false identities and cryptocurrency, registers malicious infrastructure on cock.li email services, and employs open-source tools like Mimikatz and Cobalt Strike. Following initial compromise, actors establish persistent access by modifying email permissions, targeting administrative accounts, and maintaining access from dedicated infrastructure located in the victim's country to blend with normal traffic patterns.

Defenders should enforce mandatory MFA for all users, restrict remote administrative access, audit cloud configurations and permission changes, monitor for encoded PowerShell and lateral movement, and segment networks using zero-trust architectures. The SolarWinds compromise remains the most visible recent attack vector affecting government agencies and critical infrastructure.

title: Exchange Online Mailbox Delegate or Folder Permission Added
description: Detects Exchange Online audit events that add mailbox, folder or recipient
  permissions. APT29 modified email permissions to keep access to mailboxes. Review
  the acting account and the target mailbox, especially when the actor is an admin
  account that does not normally manage delegation.
tags:
- attack.persistence
- attack.t1098.002
logsource:
  product: m365
  service: audit
detection:
  selection:
    eventSource: Exchange
    eventName:
    - Add-MailboxPermission
    - Add-MailboxFolderPermission
    - Add-RecipientPermission
    - Set-MailboxFolderPermission
  condition: selection
falsepositives:
- Helpdesk or messaging admins granting shared mailbox or delegate access through
  approved tickets
- Onboarding and offboarding automation that assigns mailbox permissions
level: medium
id: be430293-4c2c-5a24-bef1-7edd62df3fe1
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-116a

title: Cobalt Strike or Mimikatz Default Named Pipe Created
description: Detects named pipe creation matching default Cobalt Strike (WkSvcPipeMgr,
  MSSE-*-server, hashdump, numeric default pipes) and Mimikatz pipe names. The report
  names both tools as used by SVR actors for credential theft and lateral movement.
tags:
- attack.credential-access
- attack.t1003.001
- attack.lateral-movement
logsource:
  category: pipe_created
  product: windows
detection:
  selection_cs:
    PipeName|startswith:
    - \WkSvcPipeMgr_
    - \hashdump
    PipeName:
    - \MSSE-*-server
    - \334485
    - \461092
  selection_mimikatz:
    PipeName|contains: mimikatz
  condition: 1 of selection_*
falsepositives:
- Red team or penetration test exercises using default Cobalt Strike or Mimikatz profiles
- Security tooling that names a test pipe after mimikatz
level: high
id: b186e5ba-236e-534c-aa30-6bbb6386e315
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-116a

title: Encoded PowerShell Command Line Execution
description: Detects powershell.exe or pwsh.exe started with an -EncodedCommand style
  argument, which the advisory recommends monitoring. Best used with context such
  as an unusual parent process, user or host, because management tools also use encoded
  commands.
tags:
- attack.execution
- attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  selection_enc:
    CommandLine|contains|windash:
    - ' -enc '
    - ' -encodedcommand '
    - ' -ec '
  filter_mgmt:
    ParentImage|endswith:
    - \ccmexec.exe
    - \CcmExec.exe
    - \IntuneManagementExtension.exe
  condition: selection_img and selection_enc and not filter_mgmt
falsepositives:
- SCCM, Intune or other endpoint management agents deploying scripts as encoded commands
- Administrator scripts and installers that wrap PowerShell in -EncodedCommand
level: medium
id: c1da27f3-3660-5a34-bfdc-e246e9a1724d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-116a

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-116a