Pierluigi Paganini May 23, 2016

The Ruag firm is a technology company, based in Bern, that supplies the country’s military with munitions. Threat actors exfiltrated data from the systems of the firm, which is wholly owned by the Swiss government, though the extent of the theft was unknown.

Below a portion of the interview released by Parmelin to the Swiss daily Tages-Anzeiger.

“According Tagesanzeiger.ch/Newsnet-Informationen hang the attacks against the VBS with a major cyber attack on the defense group RUAG together, behind Russia is suspected. Is become active in this matter, the Federal Council?
The Federal Council has been informed. He has proposed several measures that are now being implemented. The Attorney General has instituted a process.

What were these attacks?
The attacks were of industrial espionage. Because Ruag working for the army and the federal government and 100 percent of the federal government is one, it is very important for us to minimize risks.”

Parmelin pointed out industrial espionage has the root cause of the cyber attack and said his department was able to mitigate the attack and restore normal operations.

Now the Reporting and Analysis Center for Information Assurance (MELANI) has published a detailed Technical Report about the Malware used in the Cyberespionage against RUAG.

The experts confirmed that it is quite difficult to estimate the damage caused by the hacking attack. The analysis of the proxy logs revealed periods of intense activities in alternate with very few activities. The report published by Melani also includes recommendations and countermeasures to defeat this Turla variant and promptly identify the presence of attackers, the authors also invite victims to share information about the attack.

The strain of Turla used in the attack against the RUAG did not implement rootkit functionality but relies on sophisticated obfuscation mechanisms to stay under the radar. It was a surgical attack that compromised only the systems the attackers were interested in by implementing various measures, such as a target IP list and extensive fingerprinting before and after the initial infection.

Once the attackers found an entry point in the target network, they moved laterally compromising other devices in the architecture, this was possible by targeting directly the active directory.

The experts from Melani distinguish the following phases of the attack:

Victim evaluation: During this phase, the attacker tries to get as much information about the target as possible. It is a preparation for the actual attack and covers at least the IP ranges, platforms and some usage patterns of their users. It is important for him to place the right waterholes and to be able to filter out unwanted victims from the actual targets. This phase is divided into several sub phases, not all need to be necessarily be in place: • Passive information gathering • Active scanning • Preparing waterholes

Infecting: The infection phase consists of a fingerprint of the victim in order to find the best suited infection method (using an appropriate exploit or a social engineering technique). It has the following sub phases: • Activating waterholes / sending spearphishings • Fingerprinting: This is most often done using JavaScript • Exploiting: Depending on the target, a suitable exploit is chosen. If this is not feasible, a social engineering approach is applied.

Active Infection: The attacker is now in the network. There are several sub phases here: • Trojan supported Reconnaissance: We often see an initial reconnaissance tool being placed, performing additional reconnaissance actions from within the network of the victim. This tool has not many capabilities, but can be replaced by a more powerful malware at any time. • Gaining Persistence: If the recon tool has been placed successfully and has sent out enough information, it is replaced by the actual malware with more functionality and deeper persistence in the system and the network. • Lateral Movement: The attacker begins to move laterally in order to gain access to the information he is interested in. Lateral movement is often done by using “normal” tools that are also used for managing systems. The lateral movement also comprises the collection of credentials, as well as the elevation of privileges. • Data Exfiltration: As soon as the attacker begins to steal data, he must transport it outside of the network without being discovered. This is often done by first compressing the data and then sending it out, piece by piece.