The security company Volexity publishes threat research on state-backed hacking, zero-day exploits, and malware campaigns.
HN links it for primary incident reports, such as the Nearest Neighbor attack and the Confluence zero-day; one commenter calls a news article on the latter blogspam.
Washington Post attributed the attack to Russian actor APT29/Cozy Bear on Dec 14th [1], quoting unnamed sources.
FireEye [2] Dec 13th & Volexity [3] Dec 14th were more cautious, citing an unknown actor that they dubbed UNC2452, and Dark Halo, respectively.
Recorded Future made a fair but ultimately inconclusive case for Chinese attribution [4], Dec 30th.
US gov/CISA continues to claim "Russian linked" [5], Jan 5th.
Kaspersky reported a link to the Kazuar malware used by Russian actor Turla [6], Jan 11th.
CrowdStrike's report on the malware injector [7], Jan 11th says "does not attribute the SUNSPOT implant, SUNBURST backdoor or TEARDROP post-exploitation tool to any known adversary".
[1] https://www.washingtonpost.com/national-security/russian-government-spies-are-behind-a-broad-hacking-campaign-that-has-breached-us-agencies-and-a-top-cyber-firm/2020/12/13/d5a53b88-3d7d-11eb-9453-fc36ba051781_story.html
[2] https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html
[3] https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
[4] https://www.recordedfuture.com/solarwinds-attribution/
[5] https://www.cisa.gov/news/2021/01/05/joint-statement-federal-bureau-investigation-fbi-cybersecurity-and-infrastructure
[6] https://securelist.com/sunburst-backdoor-kazuar/99981/
[7]…
iVerify uses a variety of methods to detect if the phone has a security issue.
Some of them are deterministic and report with complete certainty. For example, the Volexity report about EVIL EYE includes IOCs for the exploit payload and we can detect and report whether that payload exists on your phone. (read that report here: https://www.volexity.com/blog/2020/04/21/evil-eye-threat-actor-resurfaces-with-ios-exploit-and-updated-implant/)
We also include more probabilistic, generic, or environmental checks that look for deviations from the known good for iOS. These are based on our deep knowledge of iOS and use little-noticed side channels to report information about iOS to the iVerify mobile app. These can possibly detect unknown jailbreaks. We walk a thin line to write our checks without violating Apple's rules (e.g., no private APIs).
It's certainly not foolproof, there are ways that a malware toolkit could avoid iVerify, but it's a great extra seatbelt to wear. It's also extremely effective at determining exposure to an attack immediately after IOCs are released.
Maybe so, but in this case they made it easy for them [1]:
> Upon examining those logs, Volexity found that in January and February, password-spray attacks had been carried out against this service and three accounts had been successfully compromised by an attacker.
> ...
> The Enterprise Wi-Fi network, however, did not require MFA and only required a user's valid domain username and password to authenticate
> ...
> While the Guest Wi-Fi network had been believed to be completely isolated from the corporate wired network, where the high-value targeted data resided, there was one system that was accessible from both the Wi-Fi network and the corporate wired network.
Bad passwords, no certificate based network authentication or MFA, bad network separation. Basic stuff.
[1] https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/
(This should have been the referenced page IMHO.)
https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
https://www.reddit.com/r/sysadmin/comments/lwcnkn/exchange_servers_under_attack_patch_now/
https://www.reddit.com/r/sysadmin/comments/lwah3d/exchange_server_critical_update_being_released/
https://magoo.github.io/incident-tracking/2021/03/02/msft-exchange-0days.html
https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-cyberattacks/
https://techcrunch.com/2019/08/31/china-google-iphone-uyghur/
https://www.volexity.com/blog/2019/09/02/digital-crackdown-large-scale-surveillance-and-exploitation-of-uyghurs/
https://www.theguardian.com/world/2019/jul/27/the-world-knows-what-is-happening-to-the-uighurs-why-has-it-been-so-slow-to-act
https://www.forbes.com/sites/johnkoetsier/2019/09/06/apple-hints-china-behind-billion-device-iphone-hack-that-google-reported/#2cc8f00512c9
> Interestingly, no one has done a deep dive on what Android exploits were hosted on the site that Google discovered
Volexity did [1], although it's not clear if the android exploits were hosted on the same sites that google was referencing.
[1]: https://www.volexity.com/blog/2019/09/02/digital-crackdown-large-scale-surveillance-and-exploitation-of-uyghurs/