All language subtitles for 003 Adversary Emulation (OBJ 1.2)

-: When you're conducting an engagement

sometimes you might be asked to perform adversary emulation.

Now, adversary emulation is a specialized type

of penetration testing where you're trying to

mimic the tactics, techniques, and procedures

of a real world threat actor during your penetration test.

For example, maybe you're conducting a penetration test

against a defense contracting firm that's responsible

for writing the software code that's used

by military aircraft.

That firm might be concerned

with the possibility of a data exfiltration

of their proprietary source code from a nation state actor.

Now, for example, APT25 is believed by experts

to have been attributed to Chinese nation state

actors who target the defense industrial basis contractors

in the United States and over in Europe,

with the goal of conducting data exfiltration

and theft of their trade secrets.

Now, if you're asked to emulate this threat actor,

you would then need to use spearfishing messages

that include malicious attachments or malicious hyperlinks

because that is one of the common tactics,

techniques, and procedures that are used

by this particular threat actor who is characterized

as an advanced persistent threat or APT.

Now, a threat actor is really just a generic term,

and we use this to describe the bad folks

out there who wanna do harm

to our networks or steal our secure data.

Put simply, a threat actor is an unauthorized hacker.

However, not all threat actors are created equal,

so there's different categories or tiers

of adversaries out there.

Some are structured, some are unstructured,

some are more skilled than others,

and there's many different things that motivate

each type of threat actor.

Now we're gonna look at six main types of threat actors:

script kiddie, insider threat, competitor,

organized crime, hacktivist, and a nation state or APT.

The first type of threat actor is called a script kiddie.

This is the least skilled type of attacker.

Now, a script kiddie tends to use other people's

tools to conduct their attacks,

and they don't have the skills to develop their own tools,

like more advanced attackers might.

Instead, a script kiddie uses freely available tools found

on the internet or an openly available security tool sets

that a penetration testers might also use.

This includes things like Metasploit, Aircrack-NG,

John the Ripper, and many others they can use to

conduct their attacks.

Using these freely available vulnerability assessment

and hacking tools, these script kiddies can conduct their

attacks for profit, to gain credibility, or just for fun.

For example, there's a program out there called

Low Orbit Ion Canon.

This is a simple program that's often used

by script kiddies to conduct a denial of service attack.

The script kiddies will simply enter in a URL

or an IP address into the input box

and click the button labeled go.

Immediately, a barage of traffic begins to flood

the victim system to attempt a denial of service.

It's just that simple.

There's no skill or underlying knowledge required.

They simply plug in a website address and hit go.

Now, script kiddies often don't even understand the tools

they're using and the damage that can cause,

or even what those actions are performing.

That being said, these script kiddies can still use simple

tools to create some really undesirable effects

to your organization's network.

The second type of threat actor we have

is known as an insider threat.

An insider threat is an employee

or former employee who has knowledge

of the organization's network, policies, procedures,

and business practices.

The insider threat is one of the most dangerous

for an organization, because these people usually

have authorized access to the network already,

making them both dangerous and difficult to find.

An insider threat could be either skilled or unskilled,

depending on who they are.

For example, an unskilled insider might

copy the organization's files onto a thumb drive,

and then walk out the front door with them.

Even though they were authorized to access those files,

they were not authorized to remove them

from the network or post them online,

which then results in a data breach for your organization.

Or you may have a very skilled insider threat

who's able to elevate their own user account permissions

so that they can access data from across the entire network

and then try to sell it to a willing buyer.

To prevent the insider threat,

organizations need to put policies

and enforcement technologies into place,

such as data loss prevention to detect these insiders

who are attempting to remove the data from the network.

Also, all of the organization's standard internal defenses

need to be properly configured

and cybersecurity analysts must search

through the security information

and event management systems to identify any patterns

of abuse in order to catch the malicious insider.

The third type of threat actor we have is a competitor.

Now, a competitor is a rogue business that attempts to

conduct cyber espionage against your organization.

Competitors are focused on stealing your proprietary data,

disrupting your business, or damaging your reputation.

Often competitors will seek to use an employee

as an insider threat

inside your organization to steal the data from you.

Or they may attempt to break

into your network over the internet themselves.

The fourth type of threat actor we have is categorized

as organized crime.

Now, organized crime is a category

of threat actor who's focused on hacking

and computer fraud in order to receive financial gain.

Due to the internet's wide reach,

a criminal in one part of the world can hack the computer

of somebody on the other side of the globe

with ease and within seconds.

Oganized crime gangs often run different schemes

or scams using social engineering,

or conduct more technical attacks using ransomware

in order to steal money from their victims.

Organized crime hackers tend to be well funded,

and they use sophisticated attacks and tools.

The fifth type of threat actor is known as a hacktivist.

Hacktivists tend to be comprised of politically motivated

hackers who target governments, corporations,

and individuals to advance their own

political ideologies or agendas.

For instance, an environmentalist might be considered

a hacktivist if they hack into a logging company

because they wanna see that company's stock prices fall

in an effort to drive them outta business,

and thereby they could save the forest.

Hacktivists can be individuals or large groups.

For example, Anonymous is a very large and well known

hacktivist group. Hacktivists tend to vary in levels

of organization from loosely organized to highly structured.

And they can have a high level of sophistication

in their attacks, or they can be very low.

It really does depend.

Often though, these hacktivists tend not to be well funded.

The sixth type of threat actor is known as

a nation state or APT.

Now, an APT is an advanced persistent threat.

Now, an APT is the most skilled type

of threat actor that you're going to encounter.

This is a group of attackers with exceptional capability,

funding, and organization, who have an intent to

hack a particular network or system.

Nation states don't simply pick any network

at random to attack,

but instead they determine specific targets to

achieve their political motives.

These incredibly organized team of hackers

conduct highly covert attacks over long periods of time.

In fact, on average, an APT is

in a victimized network for six to nine months

before network defenders actually discover the intrusion.

And some have gone several years between the breach

and their eventual discovery by defenders.

Nation state actors are extremely good at what they do

and they're very difficult to find in a network.

Over the years, many nation states have also

supported various threat actors that pose

as hacktivists or organized crime groups too,

to maintain a plausible deniability

for the hacks they're conducting.

Other times, a nation state might use TTPs

of a different nation state

in order to implicate them in the attack.

When this happens, it's known as a false flag attack.

For example, back in 2015, a French TV network known as

TV Five Monde, was taken off the air by

a sophisticated cyber attack.

The network's website was also defaced

by a group calling itself the Cyber Caliphate

and made to look like it was launched by the Islamic state.

When security investigators actually looked

into the attack though, they found the attack

was actually Russian in origin, because the code

used in the attack was typed using a cyrillic keyboard

during normal working hours in Moscow in St. Petersburg.

If this was accurate, then this means a Russian

nation state actor was trying to appear

as an Islamic state actor, so they would be blamed

for the attack making this a false flag attack.

Now, each threat actor also conducts these attacks

for different reasons and are motivated by different things.

This might be for greed or money,

like crimeware and ransomware.

Or it might be for power, revenge, or blackmail,

such as in the case of an insider threat.

For a script kiddie, it might just be for thrills,

increased reputation, or some kind of recognition

from fellow hackers.

An APT, though, might hack for intelligence that they

can gain this as a form of espionage to further

their nation's political agendas.

By keeping these motivations in mind, an organization

can build better defenses against each type of threat actor.

So, why is it important to consider the different types

of threat actors?

Well, as a penetration tester, you can use your knowledge

of these threat actors to conduct

threat modeling and emulation.

Depending on the objectives of the engagement,

you may be told to simulate an attack by a script kiddie,

a hacktivist, an insider threat, or even an APT.

Depending on which archetype we're emulating

we're gonna model our techniques after that threat actor.

For example, if you're asked to simulate an APT attack,

you're gonna have to develop your own

custom codes and exploits, which takes a lot

more time and effort.

This is gonna require a higher cost to

conduct that assessment.

On the other hand,

if you're asked to emulate a script kiddie,

you can simply use open source tools to

conduct your attacks.

Modeling an insider threat would require some

insider knowledge, such as a username and password

of an authenticated user

or other information that somebody would know

as part of a known environment assessment.

Now, these are all factors to consider during your planning

and scoping phase of your engagement.

In the industry, we like to categorize

these different threat actors into tiers,

and we call them tier one going up to tier six.

Now, tier one is for people who have little money,

and rely on off-the-shelf tools and exploits.

You guessed it, these are your script kiddies.

Next we have tier two.

This is people who have little money, but they've invested

in their own tools against known vulnerabilities

and this includes hacktivists, like Anonymous.

Tier three actors tend to invest a lot of money

to find unknown vulnerabilities in order to make a profit,

and this includes criminal hackers who create ransomware.

At tier four, we find organized, highly technical,

proficient, and well-funded hackers who are working

in teams to develop new exploits,

and this includes some terrorist groups.

Tier five includes nation states who are investing

lots of money to create vulnerabilities and exploits,

and these are your low end APTs,

and these are gonna be some people who are state sponsored

but maybe not working directly for the state.

And finally, we have tier six, which is comprised

of nation state actors investing even more money

to carry out cyber attacks and military

and intelligence operations that achieve political,

military, and economic goals.

This tier tends to be exclusive

to the larger and wealthier countries

around the developed world, who essentially have an army

of cyber attackers that are combined

into their military intelligence agencies.

Tier six threat actors also are known to

conduct supply chain attacks.

For example, back in 2020, there was an attack

on the company SolarWinds that was allegedly tied

to Russian nation state actors.

The threat actors hacked into SolarWinds

in order to add a backdoor into the SolarWinds code base.

SolarWinds had numerous corporations and governments

as their users, so when this backdoor was embedded

into their next update and release, all of these companies

and government networks effectively became compromised

and given over to this nation state actor.

This attack was not directly targeted at SolarWinds though,

it was really being directed at SolarWind's customers,

making it a supply chain attack.

Another attack credited to tier six nation states

over the years, was the embedding of root kits

into Cisco routers and switches that were purchased

from third party suppliers.

This is why supply chain management

and using trusted suppliers becomes really important

to the security of an organization.

And it might be something you're asked to consider

as part of the scope for an engagement.

Now, to summarize this lesson, you need to remember

that as you climb up the tiers of threat actors,

going from one to six, you're gonna see more money,

more skill, and more time being invested

into the capabilities and attacks,

because more is at stake based on what

the threat actor's motivation is to conduct those attacks.