cyber.hendryadrian.com
Threat Research · wiz.io

Phishing-Led Hybrid Cloud Attack Persisted for More Than 17 Months

· Original article ↗

Summary

A reconstructed attack began with phishing, compromised an employee’s home device and Citrix session, then used a jump server to steal data from AWS. Attackers maintained access and re-entered for more than 17 months.

Key points

  • Attackers targeted IT and security employees with social-media phishing, persuading a cloud engineer to run a malicious payload on an unmanaged home computer.
  • They extracted Citrix session cookies, hijacked a privileged session, accessed an on-premises jump server, and obtained highly privileged AWS keys.
  • Attackers exfiltrated data from S3 buckets and RDS databases and installed reverse shells on EC2 instances across multiple VPCs.
  • The operation focused on data theft and stealth; attackers deleted local logs and modified S3 and RDS audit policies.
  • When responders revoked AWS access or cleared the jump server, attackers regained access through the compromised home device and waited for new sessions.
  • The article says the organization discovered the activity after it had persisted for more than 17 months; repeated re-entry continued for several months during remediation.

Article Details

Attack Vectors
  • Social-media phishing and social engineering targeted employees, especially IT and security staff, to induce them to download and execute malicious payloads.
  • A cloud DevOps engineer executed a payload on a personal, unmanaged home computer.
  • Attackers extracted valid Citrix session cookies from the compromised laptop and hijacked a privileged session into the corporate network.
  • The hijacked session provided RDP access to an on-premises jump server, from which attackers extracted privileged AWS access keys.
  • Attackers used the AWS access to exfiltrate data from S3 buckets and RDS databases and install reverse shells on EC2 instances across multiple VPCs.
Defensive Notes
  • The article notes that corporate EDR might have prevented payload execution; the compromised personal device lacked EDR.
  • The article describes changing credentials and quarantining machines as remediation actions, but attackers repeatedly re-entered through other compromised environments.
  • The article reports that attackers deleted local OS logs and modified S3 and RDS audit policies, hindering investigation and visibility into accessed data.
  • The article emphasizes investigating and remediating the employee device, on-premises environment, jump server, and cloud environment together to address hybrid persistence.

MITRE ATT&CK

T1020 · Automated ExfiltrationAttackers rapidly exfiltrated data from S3 buckets and sensitive RDS databases.T1021.001 · Remote Desktop ProtocolThe hijacked corporate session provided direct RDP access to an on-premises jump server.T1059 · Command and Scripting InterpreterThe article reports installation of reverse shells on EC2 instances, but does not specify the shell or command interpreter.T1070.004 · File DeletionAttackers deleted local operating-system logs from compromised EC2 instances to hinder investigation.T1204.002 · Malicious FileEmployees were socially engineered into downloading and executing malicious payloads.T1530 · Data from Cloud StorageAttackers accessed and exfiltrated data from S3 storage buckets.T1539 · Steal Web Session CookieAttackers extracted valid Citrix session cookies from the compromised employee laptop and used them to hijack a privileged session.T1552.001 · Credentials In FilesAttackers extracted highly privileged AWS access keys from the jump server.T1562.008 · Disable or Modify Cloud LogsAttackers modified S3 and RDS audit policies to reduce visibility into accessed data.T1566 · PhishingAttackers conducted a social-media phishing campaign targeting employees to induce execution of malicious payloads.

Products

AWSsession contained direct RDP access to a jump server used to access and manage the company’s production AWS environment. From this server attackers were able to extract highly privileged AWS access keys and proceedCitrixenabling employees to use their personal devices to connect remotely to company resources leveraging Citrix. Unfortunately, this allowed attackers to extract valid Citrix session cookies from the compromisedEC2buckets and sensitive RDS databases containing client data, as well as installing reverse shells on EC2 instances in multiple VPCs. The speed at which this phase of the attack was executed leaves little doubtRDSdirections very quickly. Within hours, they began exfiltrating data from S3 storage buckets and sensitive RDS databases containing client data, as well as installing reverse shells on EC2 instances in multiple VPCs.S3attackers moved in two parallel directions very quickly. Within hours, they began exfiltrating data from S3 storage buckets and sensitive RDS databases containing client data, as well as installing reverse shells on

Related Articles