Russian state-sponsored actors target cleared defense contractors
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Russian APT exploits weak credentials and known vulnerabilities to breach U.S. defense contractors and exfiltrate classified technology and weapons development data.
From January 2020 through February 2022, the FBI, NSA, and CISA observed sustained targeting of U.S. cleared defense contractors (CDCs) supporting DoD and Intelligence Community programs by Russian state-sponsored cyber actors. The attackers targeted both large and small contractors supporting weapons development, vehicle and aircraft design, communications infrastructure, and intelligence systems. The threat actors use brute force attacks, spearphishing, credential harvesting, and exploitation of known vulnerabilities (including CVE-2020-0688, CVE-2020-17144, and CVE-2018-13379) to gain initial access. After compromising networks, they dump credentials using tools like Mimikatz, establish persistence using legitimate credentials or malware, and exfiltrate sensitive unclassified data, proprietary documents, and export-controlled technology. In some cases, attackers maintained persistent access for at least six months. The stolen information provides adversaries insight into U.S. weapons platforms, deployment timelines, vehicle specifications, and communications plans. The advisory urges all CDCs to implement multifactor authentication, enforce strong passwords, enable M365 Unified Audit Logs, deploy endpoint detection and response tools, establish centralized logging, patch known vulnerabilities promptly, and review trust relationships with service providers.
Mentioned in this report
Detection guidance
Mimikatz Default Named Pipe Created
Detects creation of a named pipe containing 'mimikatz', the credential dumping tool the report names for post-compromise credential theft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Mimikatz Default Named Pipe Created
description: Detects creation of a named pipe whose name contains mimikatz, an artefact
of Mimikatz modules used for credential dumping after initial access. Renamed builds
will evade this.
tags:
- attack.credential-access
- attack.t1003
- attack.t1003.003
logsource:
category: pipe_created
product: windows
detection:
selection:
PipeName|contains: mimikatz
condition: selection
falsepositives:
- Red team or penetration test exercises using unmodified Mimikatz
- Security tool validation or detection-testing frameworks
level: high
id: 28e8f877-629d-5656-9a1a-1c3f93d0d04f
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-047a
NTDS.dit Extraction via Ntdsutil IFM Creation
Detects ntdsutil.exe being used to create an IFM snapshot of the Active Directory database, a common way to steal domain credential hashes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: NTDS.dit Extraction via Ntdsutil IFM Creation
description: Detects ntdsutil.exe invoked with ntds instance activation and the ifm
(Install From Media) option, which writes a copy of ntds.dit and the SYSTEM hive
to disk for offline credential extraction.
tags:
- attack.credential-access
- attack.t1003.003
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \ntdsutil.exe
CommandLine|contains|all:
- ntds
- ifm
condition: selection
falsepositives:
- Domain administrators creating IFM media to build a new domain controller
- Authorised AD backup or disaster-recovery procedures
level: high
id: 94f70a0b-c104-519d-9624-48bdb169cbfd
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-047a
Exchange IIS Worker Process Spawning Command Shell
Detects the Exchange application pool worker process (w3wp.exe) spawning shells or script interpreters, consistent with exploitation of Exchange vulnerabilities such as CVE-2020-0688 and CVE-2020-17144. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Exchange IIS Worker Process Spawning Command Shell
description: Detects w3wp.exe running an MSExchange application pool that spawns cmd,
PowerShell or similar interpreters. This is typical post-exploitation behaviour
after exploiting a public-facing Exchange server (for example CVE-2020-0688 or CVE-2020-17144).
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
ParentCommandLine|contains: MSExchange
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Exchange management or diagnostic scripts launched by the application pool in unusual
configurations
- Third-party Exchange add-ons that shell out from the worker process
level: high
id: dfe101fe-90c2-5a45-a526-c50e5d3d88b9
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-047a
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-047a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs