The US Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have revealed details of how state-sponsored hackers in Russia were able to gain access to an unnamed NGO’s network, in a joint advisory to organisations.

Published yesterday (15 March), the alert detailed the vulnerabilities in multi-factor authentication (MFA) exploited by the Russian hackers that eventually gave them access to the organisation’s cloud and email accounts to extract sensitive documents.

Shields Up! Russian state-sponsored actors have exploited default Multi-Factor Authentication (MFA) protocols. Make sure your MFA protocols are configured properly! Read our latest advisory w/@FBI to defend your networks against this attack: https://t.co/zzY2gkxNkp pic.twitter.com/5m0150wj2O

— Cybersecurity and Infrastructure Security Agency (@CISAgov) March 15, 2022

The attack started as early as May last year, when the hackers took advantage of a misconfigured account set to default MFA protocols in the NGO’s systems, which allowed them to enrol a new device for MFA and access the victim network.

‘PrintNightmare’, a Windows Print Spooler vulnerability that can allow remote actors to take over systems, was then exploited to run arbitrary code with system privileges. The NGO was using Cisco’s Duo MFA security, which uses two-factor authentication.

How did they access the network?

The initial access to credentials for the misconfigured account was made using a brute-force password guessing attack, “allowing them access to a victim account with a simple, predictable password”.

While the account had been un-enrolled from Duo after a long period of inactivity, the advisory noted that it was not disabled from the active directory – allowing for re-enrolment of new devices to dormant accounts.

The hackers then modified a domain controller to redirect Duo MFA from contacting the server to validate the login.

“This effectively disabled MFA for active domain accounts because the default policy of Duo for Windows is to ‘fail open’ if the MFA server is unreachable,” the advisory noted, adding that ‘fail open’ can happen to any MFA service and is not exclusive to Duo.

The whole process culminated in Russian hackers moving freely around the NGO’s cloud storage and email accounts, accessing files as they pleased.

“This exploit is an example of why organisations need to be extra vigilant and adopt a heightened cybersecurity posture that includes enforcing MFA and reviewing configuration to protect against ‘fail open’ and re-enrolment scenarios”, CISA said in a tweet.

FBI and CISA advice

In response to the cyberattack in question, the FBI and CISA recommended organisation to “remain cognisant of the threat of state-sponsored cyber actors exploiting default MFA protocols and exfiltrating sensitive information”.

Organisations should enforce MFA for all users, without exception, and review configuration policies to protect against ‘fail open’ and re-enrolment scenarios, the advisory noted.

To prevent brute-force password guessing login attempts, organisations should also implement time-out and lock-out features, and ensure that inactive accounts are disabled uniformly across active directories.

Software should be regularly updated, included critical patches for known vulnerabilities such as PrintNightmare, and all passwords should be required to be strong and unique across systems.

The FBI and CISA recommended that organisations also continuously monitor network logs for suspicious activity and implement security alerting policies for all changes to security-enabled accounts.

Last week, US cybersecurity companies Cloudflare, CrowdStrike and Ping Identity joined hands to offer many of their products and services to US critical infrastructure organisations, such as hospitals and water and energy utilities, for free in anticipation of impending cyberattacks from Russia.

This followed a joint advisory last month, issued by cybersecurity authorities in the US, UK and Australia, warning on the increase in sophisticated, high-impact ransomware attacks on critical infrastructure globally.

10 things you need to know direct to your inbox every weekday. Sign up for the Daily Brief, Silicon Republic’s digest of essential sci-tech news.

The post FBI and CISA alert organisations after Russian hackers attack NGO appeared first on Silicon Republic.