How to Respond to Destructive Cyber Breaches

TL;DR

Effective response to a destructive breach requires preparing for attackers who may disable systems, corrupt virtual machines, delete backups, leak confidential data, or extort the organization. Recovery becomes especially difficult when backup infrastructure shares the production network, while attackers with privileged credentials can coordinate widespread damage and deliberately keep domain controllers operational until their malware finishes propagating.

Transcript

Morning, everybody. Can you hear me all right? Thanks. Excellent. All right, great. So I'm Charles Carmakal, a vice president with Mandiant, and really today what we wanna do is we wanna talk to you guys about some of the breaches that we've helped respond to that were incredibly destructive in nature. And, and what I mean by that is, the reality i... Read More

Key Insights

• Destructive breaches are intentional operations that go beyond ordinary disruption by damaging systems, exposing confidential information, demanding payment, embarrassing organizations, or taunting executives. The attackers described in the presentation acted for political objectives, financial gain, deliberate harm, or sometimes personal amusement.
• North Korean government-linked attackers are capable operators despite the country's limited public Internet access. According to the presenters, talented people are recruited from universities and offered incentives such as payment in United States dollars, unrestricted Internet access, and permission to travel outside the country.
• North Korean-linked operations expanded beyond organizations in South Korea to targets elsewhere in the world. Their activities progressed from distributed denial-of-service attacks and website defacement to attacks that destroyed Windows, Linux, and Mac systems or published stolen information to embarrass victims.
• Domain administrator access enables destructive malware to spread broadly through a Windows enterprise. In the discussed case, privileged credentials were hard-coded into malware so it could authenticate to servers, propagate across the environment, and execute system-specific destruction against workstations, servers, mail servers, and domain controllers.
• Master boot record destruction makes a computer unbootable without necessarily overwriting every file. It removes information that the operating system uses to locate files, making ordinary access almost impossible, although forensic techniques may reconstruct that information and recover at least some underlying data.
• Domain controllers may be destroyed last because malware still needs them for authentication while spreading. The described malware allowed those systems to continue running for hours or days, then overwrote their master boot records and shut them down after much of the Windows environment had been reached.
• Virtual-machine corruption can make recovery substantially harder than ordinary file deletion. Attackers manually accessed ESX servers with stolen root credentials, identified virtual machines larger than five hundred megabytes, and wrote zeros into multiple file segments so that the files remained present but became nearly unrecoverable.
• Backup architecture is a critical weakness when recovery systems share the production network or identity environment. In the presented incident, attackers deliberately found and deleted backups, demonstrating that having regular backups does not guarantee recovery when adversaries can reach and destroy the backup infrastructure.

Questions & Answers

Q: What makes a cyber breach intentionally destructive?

An intentionally destructive breach involves attackers deliberately trying to damage operations or harm the victim rather than merely gaining unauthorized access. Examples described by Mandiant include destroying critical systems, corrupting virtual machines, publishing stolen confidential information, demanding money, and taunting executives. Motivations can include embarrassing the organization, causing direct harm, obtaining payment through extortion, or simply acting for amusement.

Q: How did attackers destroy Windows systems across an enterprise?

The attackers first obtained broad access and credentials equivalent to domain administrator privileges. They then deployed several malware variants tailored to workstations, servers, mail servers, and domain controllers. Depending on the target, the malware stopped antivirus or mail services, disabled terminal services, and overwrote the master boot record. Hard-coded privileged credentials allowed it to authenticate to additional servers and spread across the enterprise.

Q: What happens when malware overwrites a master boot record?

Overwriting the master boot record makes a machine unable to boot normally because the operating system loses the information needed to locate files. The process does not necessarily erase every file or overwrite all stored data. Instead, it removes something comparable to a table of contents. Forensic specialists may be able to reconstruct that information and recover data, although normal operating-system access becomes almost impossible.

Q: Why did the destructive malware keep domain controllers online?

The malware needed functioning domain controllers while it propagated because it authenticated to other systems with domain credentials. Destroying those controllers immediately would have interfered with the attacker's ability to spread the malware throughout the enterprise. The domain-controller variant therefore continued operating for a period measured in hours or days, then overwrote the master boot record and shut down after other Windows systems had been targeted.

Q: How did attackers corrupt virtual machines on ESX servers?

The attackers manually logged into ESX servers using root credentials stolen from elsewhere in the environment. They searched for virtual-machine files larger than five hundred megabytes and wrote zeros into selected segments throughout each file. Unlike simple deletion, this approach left the files on the storage system while corrupting their contents so extensively that recovery was almost impossible without usable backup copies.

Q: Why is deleting a file less destructive than corrupting its contents?

Deleting a file commonly removes a pointer to that file rather than immediately erasing all of its contents from the drive. That can leave underlying information available for possible forensic recovery. The attackers instead wrote zeros into multiple portions of large virtual-machine files. Because the files remained present but their internal data was damaged, reconstructing functional virtual machines became far more difficult.

Q: Why can connected backup infrastructure fail during a destructive breach?

Backup infrastructure may be vulnerable when it resides on the same network segment as production systems or is connected to the same Active Directory environment. An attacker with sufficient access can locate the backup systems and deliberately delete their contents, as occurred in the presented investigation. Regular backup procedures therefore do not guarantee recovery if the backup environment remains accessible through the compromised production network.

Q: What activities were attributed to North Korean government-linked attackers?

The presenters associated North Korean government-linked actors with distributed denial-of-service attacks around 2009 and 2010, website defacement, publication of stolen data, and destruction affecting Windows, Linux, and Mac environments. Their targeting initially focused largely on organizations in South Korea before expanding to organizations elsewhere. The presenters also observed increasing skill, capability, and significance in these actors' operations over time.

Summary & Key Takeaways

• Mandiant responders describe breaches in which attackers intentionally damaged business systems, leaked stolen information, demanded money, or taunted executives. Although most breaches cause disruption, these incidents are distinguished by deliberate efforts to embarrass victims or inflict harm. The discussion draws on actual investigations while withholding the affected organizations' identities.

• North Korean government-linked actors developed increasingly significant cyber capabilities despite assumptions based on the country's isolation. They recruited talented university students with incentives including payment in United States dollars, Internet access, and opportunities to travel. Their reported activities included denial-of-service attacks, website defacement, system destruction, and publication of stolen organizational data.

• In one destructive operation, attackers used separate malware variants against workstations, servers, mail servers, and domain controllers. The malware disabled selected services and overwrote master boot records. Attackers also manually corrupted large virtual-machine files on ESX servers and deleted accessible backups, making restoration from protected backup copies essential for recovery.