Russian state-sponsored APT actors target critical infrastructure
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA, FBI, and NSA joint advisory on Russian state-sponsored cyber threats to U.S. critical infrastructure with TTPs, detection guidance, and mitigations.
This joint Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and National Security Agency (NSA) advisory documents Russian state-sponsored advanced persistent threat (APT) actors' ongoing campaigns against U.S. and international critical infrastructure. The advisory covers historical intrusions dating from 2011 through 2020, targeting Defense Industrial Base, Healthcare and Public Health, Energy, Telecommunications, and Government Facilities sectors. Russian state-sponsored actors have demonstrated sophisticated tradecraft including supply-chain compromise, third-party infrastructure compromise, and custom malware deployment, maintaining long-term persistence using legitimate credentials in both on-premises and cloud environments.
The advisory identifies 13 CVEs commonly exploited by Russian state-sponsored APT actors for initial network access, including FortiGate VPN, Cisco routers, Oracle WebLogic, Microsoft Exchange, and Pulse Secure flaws. Russian actors have also deployed destructive malware against operational technology and industrial control systems, including BlackEnergy, KillDisk, and CrashOverride. The document provides detailed detection actions targeting credential compromise patterns, including impossible logins, impossible travel, and suspicious VPS usage, along with comprehensive mitigation guidance covering identity and access management, network architecture, and vulnerability management.
Mentioned in this report
Detection guidance
BITS Job Abuse via Bitsadmin Transfer or Notify Command
Detects bitsadmin.exe creating a BITS job that downloads from a URL or sets a notify command line, which can be used for download or persistence. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: BITS Job Abuse via Bitsadmin Transfer or Notify Command
description: Detects bitsadmin.exe creating a transfer job from a remote URL or configuring
a command to run when the job completes (SetNotifyCmdLine). Both are used to download
payloads or persist through BITS jobs. Generalises on the flags, not on job names
or URLs.
tags:
- attack.persistence
- attack.stealth
- attack.t1197
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \bitsadmin.exe
selection_notify:
CommandLine|contains: /SetNotifyCmdLine
selection_transfer:
CommandLine|contains|all:
- /transfer
- http
condition: selection_img and (selection_notify or selection_transfer)
falsepositives:
- Legacy software deployment or update scripts that use bitsadmin /transfer to download
installers
- Administrators manually downloading files with bitsadmin
level: medium
id: 7d2828a6-68dc-5011-b9b0-8e6189076572
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-011a
Active Setup StubPath Registry Value Created or Modified
Detects creation or modification of the StubPath value under Active Setup Installed Components, which runs a command at user logon. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Active Setup StubPath Registry Value Created or Modified
description: Detects setting of a StubPath value under HKLM Active Setup Installed
Components. Active Setup runs the StubPath command once per user at logon and can
be abused for persistence. Known browser installer self-configuration is excluded.
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1547.014
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \SOFTWARE\Microsoft\Active Setup\Installed Components\
TargetObject|endswith: \StubPath
filter_browsers:
Details|contains:
- --configure-user-settings
- msedge
- Google\Chrome\Application
condition: selection and not filter_browsers
falsepositives:
- Legitimate software installers registering per-user first-run configuration
- Enterprise application packaging that uses Active Setup for user profile initialisation
level: medium
id: 91d0df90-d518-5266-9747-7cbd226d676a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-011a
SSH Authorized Keys File Modified on Linux
Detects writes to SSH authorized_keys files, which adversaries use to keep persistent access with their own keys. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SSH Authorized Keys File Modified on Linux
description: Detects file creation or modification of authorized_keys or authorized_keys2
files in user SSH directories. Adversaries add their own public keys to retain access
to compromised hosts. Review the process and user that made the change, and whether
it matches an approved key provisioning change.
tags:
- attack.persistence
- attack.t1098.004
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|endswith:
- /.ssh/authorized_keys
- /.ssh/authorized_keys2
condition: selection
falsepositives:
- Administrators or configuration management tools (Ansible, Puppet, cloud-init) provisioning
SSH keys
- Users running ssh-copy-id to enrol their own keys
level: medium
id: 198f75e8-eeaa-56dc-a6cd-f8450dfd7e9d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-011a
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-011a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs