Forest Global Training Partners

Cyber Risks · Cisco Talos

The 3 most common post-compromise tactics on network infrastructure

Summary: Cisco Talos reports that APTs and ransomware groups are gaining initial access to aging, end-of-life network devices with unpatched vulnerabilities, and describes three common post-compromise tactics: modifying device firmware, uploading customized or older weaponized firmware, and bypassing security measures such as ACLs, remote logging, and SNMP settings. Talos cites VPNFilter in 2018, which built a Tor network of 500,000 compromised devices before the FBI seized its command-and-control infrastructure, and the KV Botnet, which chained SOHO routers and firewalls into a covert data transfer network supporting Chinese state-sponsored actors including Volt Typhoon.

Why it matters: Attackers typically disable logging as one of their first steps inside a network, so the absence of logs is itself a red flag that a device has been compromised, and firmware modification is extremely difficult for defenders to detect. Talos states plainly that if you are running end-of-life network infrastructure with vulnerabilities that cannot be patched, now is the time to replace those devices.

Read the original at Cisco Talos ↗

Topics
Threat Actors & Nation-State
Related