# Russian state-sponsored actors target cleared defense contractors

Published: 2025-06-20 · Severity: high · Sectors: defense, government-national
Canonical: https://vorant.io/reports/9ae52053-5abc-59b4-828d-36c2abeb8c63/russian-state-sponsored-actors-target-cleared-defense-contractors

> Russian APT exploits weak credentials and known vulnerabilities to breach U.S. defense contractors and exfiltrate classified technology and weapons development data.

From January 2020 through February 2022, the FBI, NSA, and CISA observed sustained targeting of U.S. cleared defense contractors (CDCs) supporting DoD and Intelligence Community programs by Russian state-sponsored cyber actors. The attackers targeted both large and small contractors supporting weapons development, vehicle and aircraft design, communications infrastructure, and intelligence systems. The threat actors use brute force attacks, spearphishing, credential harvesting, and exploitation of known vulnerabilities (including CVE-2020-0688, CVE-2020-17144, and CVE-2018-13379) to gain initial access. After compromising networks, they dump credentials using tools like Mimikatz, establish persistence using legitimate credentials or malware, and exfiltrate sensitive unclassified data, proprietary documents, and export-controlled technology. In some cases, attackers maintained persistent access for at least six months. The stolen information provides adversaries insight into U.S. weapons platforms, deployment timelines, vehicle specifications, and communications plans. The advisory urges all CDCs to implement multifactor authentication, enforce strong passwords, enable M365 Unified Audit Logs, deploy endpoint detection and response tools, establish centralized logging, patch known vulnerabilities promptly, and review trust relationships with service providers.

## Mentioned in this report

- Vulnerabilities: CVE-2018-13379 (KEV), CVE-2020-0688 (KEV), CVE-2020-17144 (KEV)
- Threat actors: Russia-nexus activity (unattributed)

## Detection guidance (public sample)

### Mimikatz Default Named Pipe Created

ATT&CK: T1003.003

Detects creation of a named pipe containing 'mimikatz', the credential dumping tool the report names for post-compromise credential theft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Mimikatz Default Named Pipe Created
description: Detects creation of a named pipe whose name contains mimikatz, an artefact
  of Mimikatz modules used for credential dumping after initial access. Renamed builds
  will evade this.
tags:
- attack.credential-access
- attack.t1003
- attack.t1003.003
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName|contains: mimikatz
  condition: selection
falsepositives:
- Red team or penetration test exercises using unmodified Mimikatz
- Security tool validation or detection-testing frameworks
level: high
id: 28e8f877-629d-5656-9a1a-1c3f93d0d04f
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-047a
```

### NTDS.dit Extraction via Ntdsutil IFM Creation

ATT&CK: T1003.003

Detects ntdsutil.exe being used to create an IFM snapshot of the Active Directory database, a common way to steal domain credential hashes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: NTDS.dit Extraction via Ntdsutil IFM Creation
description: Detects ntdsutil.exe invoked with ntds instance activation and the ifm
  (Install From Media) option, which writes a copy of ntds.dit and the SYSTEM hive
  to disk for offline credential extraction.
tags:
- attack.credential-access
- attack.t1003.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \ntdsutil.exe
    CommandLine|contains|all:
    - ntds
    - ifm
  condition: selection
falsepositives:
- Domain administrators creating IFM media to build a new domain controller
- Authorised AD backup or disaster-recovery procedures
level: high
id: 94f70a0b-c104-519d-9624-48bdb169cbfd
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-047a
```

### Exchange IIS Worker Process Spawning Command Shell

ATT&CK: T1190

Detects the Exchange application pool worker process (w3wp.exe) spawning shells or script interpreters, consistent with exploitation of Exchange vulnerabilities such as CVE-2020-0688 and CVE-2020-17144. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Exchange IIS Worker Process Spawning Command Shell
description: Detects w3wp.exe running an MSExchange application pool that spawns cmd,
  PowerShell or similar interpreters. This is typical post-exploitation behaviour
  after exploiting a public-facing Exchange server (for example CVE-2020-0688 or CVE-2020-17144).
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    ParentCommandLine|contains: MSExchange
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Exchange management or diagnostic scripts launched by the application pool in unusual
  configurations
- Third-party Exchange add-ons that shell out from the worker process
level: high
id: dfe101fe-90c2-5a45-a526-c50e5d3d88b9
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-047a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-047a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9ae52053-5abc-59b4-828d-36c2abeb8c63/russian-state-sponsored-actors-target-cleared-defense-contractors.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup