Just Another Blue Teamer<p>Happy Friday everyone!</p><p>A Joint Advisory from the National Security Agency, Federal Bureau of Investigation (FBI), Cyber National Mission Force, and the National Cyber Security Centre provides updates on the Russian Federation's Foreign Intelligence Service, or <a href="https://ioc.exchange/tags/SVR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SVR</span></a>. </p><p>According to the advisory, <a href="https://ioc.exchange/tags/APT29" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>APT29</span></a> (a.k.a Midnight Blizzard, Cozy Bear, and the Dukes) has targeted the defense, technology, and finance sectors to collect foreign intelligence and enable future cyber operations. They aim to exploit software vulnerabilities for initial access and escalate privileges. They also utilize spearphishing campaigns, password spraying, abuse of supply chain and trusted relationships. They also utilize custom malware and living-off-the-land (LOLBINs) techniques for multiple techniques. </p><p>The report includes a list of <a href="https://ioc.exchange/tags/CVEs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>CVEs</span></a> that APT29 has been observed exploiting and attach the vendor and product that are effected with details that describe the vulnerability along with a section of mitigations that your organization can take to increase your security posture. </p><p>If you are looking for behaviors that are attributed to APT29, look no further than the MITRE ATT&CK Matrix! This resource has collected historic <a href="https://ioc.exchange/tags/TTPs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>TTPs</span></a> and behaviors and referenced them as well. So while you are working on hardening your environment you can also hunt for their activity as well! Enjoy and Happy Hunting! </p><p>Article Source:<br>Update on SVR Cyber Operations and Vulnerability Exploitation<br><a href="https://www.ic3.gov/Media/News/2024/241010.pdf" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">ic3.gov/Media/News/2024/241010</span><span class="invisible">.pdf</span></a></p><p>Mitre source:<br><a href="https://attack.mitre.org/groups/G0016/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">attack.mitre.org/groups/G0016/</span><span class="invisible"></span></a></p><p>Intel 471 <a href="https://ioc.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://ioc.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatHunting</span></a> <a href="https://ioc.exchange/tags/ThreatDetection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatDetection</span></a> <a href="https://ioc.exchange/tags/HappyHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>HappyHunting</span></a> <a href="https://ioc.exchange/tags/readoftheday" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>readoftheday</span></a> <a href="https://ioc.exchange/tags/huntoftheday" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>huntoftheday</span></a> <a href="https://ioc.exchange/tags/gethunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>gethunting</span></a> Cyborg Security, Now Part of Intel 471</p>