.GR Hijacked By Sea Turtles

After several months of activity, the actors behind the “Sea Turtle” DNS hijacking campaign are not slowing down, according to a blog post on Cisco’s Talos Intelligence blog post this week. And one of their targets appears to have been the Greek ccTLD .gr.

The Sea Turtle hijacking campaign appears to have recently regrouped
after Cisco Talos in April 2019 published “their initial findings and coverage
and are redoubling their efforts with new infrastructure. While many actors
will slow down once they are discovered, this group appears to be unusually
brazen, and will be unlikely to be deterred going forward.”

Cisco Talos also “identified a new wave of victims,
including a country code top-level domain (ccTLD) registry, which manages the
DNS records for every domain uses that particular country code, that access was
used to then compromise additional government entities. Unfortunately, unless
there are significant changes made to better secure DNS, these sorts of attacks
are going to remain prevalent.”

According to the Talos blog, “the Institute of Computer Science of the Foundation for Research and Technology – Hellas (ICS-Forth), the ccTLD for Greece, acknowledged on its public website [see here in Greek only] that its network had been compromised on April 19, 2019. Based on Cisco telemetry, we determined that the actors behind the Sea Turtle campaign had access to the ICS-Forth network.”

“Cisco telemetry confirmed that the actors behind Sea Turtle
maintained access to the ICS-Forth network from an operational command and
control (C2) node. Our telemetry indicates that the actors maintained access in
the ICS-Forth network through at least April 24, five days after the statement
was publicly released. Upon analysis of this operational C2 node, we determined
that it was also used to access an organization in Syria that was previously
redirected using the actor-controlled name server ns1[.]intersecdns[.]com. This
indicates that the same threat actors were behind both operations.

“We also saw evidence that the threat actors researched the
open-source tool PHP-Proxy. Notably, this particular C2 node searched for both
blog.talosintelligence.com and ncsc.gov.uk, presumably to view Talos’ previous
reports on DNS hijacking and this DNS hijacking advisory from the United
Kingdom’s National Cyber Security Centre.”

The Talos Intelligence blog also notes they they now have “moderate
confidence that the threat actors behind Sea Turtle have been using another DNS
hijacking technique. This new technique has been used very sparingly, and thus
far have only identified two entities that were targeted in 2018, though we
believe there are likely more.

“This new technique once again involved modifying the target
domain’s name server records to point legitimate users to the actor-controlled
server. In this case, the actor-controlled name server and the hijacked
hostnames would both resolve to the same IP address for a short period of time,
typically less than 24 hours. In both observed cases, one of the hijacked
hostnames would reference an email service and the threat actors would
presumably harvest user credentials. One aspect of this technique that makes it
extremely difficult to track is that the actor-controlled name servers were not
used across multiple targets — meaning that every entity hijacked with this
technique had its own dedicated name server hostname and its own dedicated IP
address. Whereas previously reported name server domains such as
ns1[.]intersecdns[.]com were used to target multiple organizations.

“In one case, a private organization primarily used a
third-party service as their authoritative name server. Then, for a three-hour
window in January 2018, their name server records were changed to a name server
hostname that mimicked a slightly different version of the organization’s name.
During that three-hour window, the actor-controlled IP address hosted three
hostnames, the two actor-controlled name servers and the webmail hostname. This
would allow the threat actors to perform a man-in-the-middle (MitM) attack, as
outlined in our previous post, and harvest credentials. This technique was also
observed against a government organizations in the Middle East and North
African region.”

For the technically minded, to read the Cisco Talos Intelligence blog post in full, go to: https://blog.talosintelligence.com/2019/07/sea-turtle-keeps-on-swimming.html