FireEye Blog

MANDIANT
Full Time ONSITE - TS/SCI with Polygraph Required - Annapolis Junction, MD

Join an industry leading team performing challenging and meaningful work. Mandiant is supporting a critical customer mission to design, deliver, and operate a national network defense capability. We have an immediate opening for a fully-cleared mid to senior Incident Response and Malware Analysis Consultant to provide ongoing breach detection, threat analysis, incident response, and malware analysis. This is an evolving program and provides a great opportunity to influence its progression.

The ideal candidate will be fully cleared, have strong industry experience in developing and operating next generation defensive cyber operations to help improve the customer's breach detection and mitigation capabilities, excellent communication and presentation skills with the ability to present to a variety of external audiences, capable of managing multiple tasks and priorities with divergent schedules, proactive and amicable personality, but also does not back down in the face of adversity, and has an understanding that this program is in its infancy and you will play a large role in development and refinement of its analysis and operations capability.

What we can offer you:
Great salary and incentives, internal training and conference opportunities, encouragement and support for speaking engagements, and career flexibility (though we ask for at least a year at this customer)

If you are…

for example The Equation Group (https://en.wikipedia.org/wiki/Equation_Group), which wouldn't be an organic part of the function or activities of a normal civilian cyber-security company.

While your basic point might be correct, this part is absolutely false. All major security groups actively research all APT groups, no matter where they are from.

For example, here's a 2015 report from (US Company) FireEye[1]. Page 11 talks about the Equation Group (as well as the UK-based Regin group).

It is worth acknowledging that Kaspersky was the first company to identify and name the Equation Group. However, this is likely to be because of the geographical overlap of activities: Kaspersky provides defensive support in Russia and the Middle East where the Equation Group is most active.

This is exactly the same as how Mandiant/Fireeye identified ATP-1 and Cozy Bear/Fancy Bear: they get called in to investigate breaches in the US where those state-supported groups are most active.

[1] https://www.fireeye.com/content/dam/fireeye-www/company/events/infosec/threat-landscape-overview-fireeye-summit-paris.pdf

Private companies like Crowdstrike would probably love to reveal their analysis however they would be restricted by the actual data owners (e.g. the DNC) and I would guess ongoing government investigations. Plus why blow all of your signatures when they still work?

Outside of that, there's tons of data online already regarding Russian government hacking activity:
http://researchcenter.paloaltonetworks.com/2016/06/unit42-new-sofacy-attacks-against-us-government-agency/
https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
https://securelist.com/blog/research/72924/sofacy-apt-hits-high-profile-targets-with-updated-toolset/
http://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/

Do you think understanding the tools, infrastructure, coding styles, activities, targets of these groups allows them to perform attribution?

For threat actors that target Korean users their favorite software to exploit for initial access is HWP (Hangul Word Processor). It's MS Word for Korean users. If you are being sent official docs of any kind, chances are it is a .hwp file that needs the program. Banking and internet access affects consumers but HWP is used by more interesting espionage/sabotage targets.

https://www.fireeye.com/content/dam/fireeye-www/global/en/blog/threat-research/FireEye_HWP_ZeroDay.pdf

I just looked up CVEs for it. I only see 2 in 2017. This is not a good thing, a complex word processor, even if it was rewritten in a memory safe language would have at least some low level non-memory vulns in 6 years!

It's not just the initial compromise that's getting "sophisticated hack" headlines in this case -- it's the extraordinary care that the attackers took to evade detection afterwards. Among other things: delaying communication to home base for a couple of weeks after the backdoor was initially installed; use of steganography to make that look like ordinary network traffic afterwards; use of entirely new exploits, not in any common database, to avoid detection triggered by a match.

The FireEye report describes all of this in more detail: https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html

You are vastly underestimating the lengths that this attack when to avoid detection. They didn't just hijack Solarwinds updates and inject malware. They did things like concealing the commands of malware in legitimate looking Solarwinds packets. When they infiltrated a place, they had the malware sleep for months. They carefully avoid standard malware detection techniques and you can only do that if you have very sophisticated engineers. This isn't just some scripts someone pulled from the internet.