Hello gang,
I know I saw this on Mastodon today with it being 4 days old and I did see it also on Bleeping Computer.
This attack they’re talking about is a 2022 attack where a certain threat group was able to get on a network they were interested in by finding something near by that could connect to them since they were some oceans away.
This proves that strong passwords are a must, because if the password that was used to connect from another building wasn’t, they couldn’t get to any other point nearby or otherwise.
This type of attack is clever, and would give my pass of the sophistocated test smell, because this is not something you have to actually be involved in.
Volexity first reported on this, and others have picked this up.
The threat group in question breached multiple organizations through this method, can you name the threat actor involved?
While the initial report did not name a group, a Microsoft report in April was able to confidently determine the group behind this sophistocated attack.
If you guessed APT28, Fancybear, Forrest Blizzard or Sofacy, you are correct.
We’ve covered Fancy Bear for quite awhile and this doesn’t necessarily surprise me.
Speaking of Fancy Bear, did you read the book by the same name? We did, and we’ve talked about it through TSB in the past. Find it on our resources through EMHS.
The text in the image reads:
“Nearest Neighbor Attack
Attacker compromises infrastructure in physical proximity to target of interest.
A dual-homed system is identified and attacker enables Wi-Fi.
Attacker uses compromised credentials to connect into the network of actual intended target.”
For complete details on the research to identify who was responsible and what the research found, please read Hackers breach US firm over Wi-Fi from Russia in ‘Nearest Neighbor Attack’ and stay safe out there!