How to Model Advanced Persistent Threat Campaigns

TL;DR

Model advanced persistent threats by correlating reconnaissance, exploit matching, malware hosting, botnet infrastructure, command and control, spear phishing, and hijacked networks across a global honeypot network. Current traffic analysis can reveal reused malicious IP addresses and complete attack paths, helping organizations understand how campaigns operate and determine appropriate defenses.

Transcript

Hello, my name is Philip Traynor. I'm a security architect at IXI Communications, and I'll be talking about modeling advanced persistent threats. This is my third time speaking at RSA Conference, and also I've been given the pleasure to lecture at Black Hat and a few other lec- uh, different conferences. In order to fully model advanced persistent ... Read More

Key Insights

• Global honeypot coverage is crucial for modeling advanced persistent threats because it captures malicious traffic from multiple locations. Analyzing that traffic provides a broad view of the techniques attackers use to identify targets, breach networks, distribute malware, and manage compromised systems.
• Malicious IP address reuse is a recurring pattern in ongoing attack campaigns. The research described found that both smaller actors and nation-state groups typically used addresses associated with lesser-known sites and specific countries instead of relying on well-known internet properties.
• Automated hacking is the first major step in many advanced persistent threat campaigns. Bots scan the internet, create a current inventory of exposed resources, and correlate those resources with attacks available in the operator's existing toolbox before people make higher-level targeting decisions.
• Reconnaissance tools search for vulnerable services by testing web servers for attack opportunities, including PHP, CGI, and directory traversal weaknesses. The collected results can be combined into a target map showing available resources and the known attacks that might successfully compromise them.
• Attacker capability increases with available budget and resources. Better-funded groups can automate more of their operations, maintain broader exploit toolboxes, and improve their chances of gaining access, while leaving people to evaluate complete target information and choose higher-level actions.
• Virtual machines in honeypots must be wiped and recycled often because they interact with active malicious infrastructure. Observing malware distribution sites can reveal hosting providers, IP networks, botnet components, and other actions that contribute to a start-to-finish understanding of an attack campaign.
• Spear phishing can use email services that require no username or password to access an account, making source identities easy to forge. After identifying a high-level employee, an attacker could impersonate that person and target a systems administrator, especially where spam controls or user behavior are weak.
• Hijacked BGP routers can temporarily announce address ranges listed as unroutable, placing them on the internet for an attack. Botnets and advanced persistent threats were observed using hijacked slash twenty-two and slash twenty-four ranges, indicating access associated with a higher-level attacker.

Questions & Answers

Q: How can organizations model advanced persistent threats?

Organizations can model advanced persistent threats by collecting malicious traffic through a globally deployed honeypot network and correlating evidence across the campaign. Relevant evidence includes reconnaissance activity, vulnerable-service probes, malware hosting, botnet addresses, command-and-control infrastructure, spear-phishing attempts, and hijacked networks. Combining these observations reveals the attackers, their actions, and the progression from initial mapping to attempted compromise.

Q: Why are global honeypots useful for APT research?

Global honeypots provide a broad view of malicious traffic and allow researchers to observe how advanced threat actors apply different techniques against internet-accessible systems. Continual analysis keeps the view current and exposes relationships among scanning bots, malware distribution sites, botnets, command-and-control services, and network infrastructure. These connections help researchers reconstruct the larger scope and sequence of active attack campaigns.

Q: How does automated hacking support an APT campaign?

Automated hacking uses bots to scan the internet and create a current snapshot of available resources. Attackers correlate that inventory with known attacks in their toolboxes to determine which services might be vulnerable. As budgets and resources increase, more of this process can be scripted, allowing people to focus on higher-level decisions after the target environment has been mapped.

Q: What information does automated reconnaissance collect?

Automated reconnaissance collects information about accessible systems and potentially vulnerable services. In the honeypot example, a bot examined a web server for PHP and CGI attack opportunities and attempted directory traversal techniques. Attackers can combine these findings into a site map, match the discovered resources against known attacks, and estimate how effectively they might breach the target network.

Q: Why should malware infrastructure be correlated across an attack campaign?

Correlating malware infrastructure connects separate observations into a more complete campaign model. Researchers can examine who hosts the malware, which IP network is involved, where the botnet operates, which system provides command and control, and how reconnaissance supports later activity. This larger view makes it possible to understand the techniques and actors involved from the beginning to the end of an attack.

Q: How can attackers use forged email identities for spear phishing?

Attackers can use an email service that allows access without a username or password to send messages from a forged source identity. After reconnaissance identifies a high-level employee, an attacker could impersonate that person and email a systems administrator. If the recipient acts recklessly or spam measures are inadequate, the targeted message may reach an important inbox and support the campaign.

Q: How are hijacked BGP routers used in advanced attacks?

A compromised BGP router can announce IP address ranges that are otherwise considered unroutable, temporarily placing them on the internet for a specific attack. The research found botnets and advanced persistent threats sourced from hijacked slash twenty-two and slash twenty-four ranges. Because this technique requires access to a hacked BGP router, it points to a higher-level attacker.

Q: What network indicators can reveal an ongoing APT campaign?

Useful network indicators include repeatedly used malicious IP addresses, addresses associated with lesser-known sites or specific countries, automated scans for vulnerable services, malware distribution hosts, botnet traffic, command-and-control systems, and previously unroutable ranges that suddenly appear online. Correlating these indicators provides more context than examining any single address and helps reveal the structure of the broader campaign.

Summary & Key Takeaways

• A global network of honeypots provides visibility into malicious traffic and the techniques used by advanced threat actors. Ongoing analysis keeps the research current and helps identify attack infrastructure, recurring behavior, and relationships among reconnaissance systems, malware hosts, botnets, command-and-control services, and the networks involved in active campaigns.

• Automated hacking lets attackers scan the internet, inventory accessible resources, and compare those findings with known exploits. Bots perform much of this reconnaissance, while people make higher-level decisions after receiving a mapped view of the target. Larger budgets support greater automation and broader collections of available attack techniques.

• A complete threat model also considers targeted spear phishing and hijacked network infrastructure. Forged source identities can place deceptive messages in important inboxes, while compromised BGP routers can make otherwise unroutable address ranges temporarily reachable. Correlating these techniques with honeypot evidence helps defenders reconstruct campaigns from reconnaissance through exploitation.