CyberWire Daily: Credential Harvesters in the Cloud [Research Saturday] - November 16, 2024

In this episode of CyberWire Daily, hosted by N2K Networks, Dave Buettner engages in an insightful conversation with Blake Darche, Head of Cloudforce One at Cloudflare. The discussion delves deep into the operations of a persistent threat actor known as "Sloppy Lemmings," their credential harvesting tactics in the cloud, and the broader implications for cybersecurity, especially within critical infrastructure sectors.

Introduction to Sloppy Lemmings

Blake Darche begins by introducing Sloppy Lemmings, highlighting their regional focus and strategic objectives.

Blake Darche [02:20]: "We were observing some behavior that was indicative of platform abuse, so we spent some time investigating this activity and determined it looked like a persistent threat. And so then we did some more analysis of it and then released this report about it."

Sloppy Lemmings is an Asian-based threat actor primarily targeting South and East Asian nations. Their operations are part of a broader espionage campaign aimed at extracting sensitive information from military and government organizations across the Asia-Pacific region.

Blake Darche [03:05]: "Sloppy Lemming is an Asian-based threat actor targeting south and East Asian countries. We do think it's part of a larger espionage campaign run by this threat actor where they're looking for different information about military and government organizations throughout the Asia Pacific AOR."

Utilization of Cloud Services for Operational Evasion

A significant aspect of Sloppy Lemmings' strategy involves leveraging multiple cloud service providers to obfuscate their activities and complicate mitigation efforts.

Blake Darche [03:40]: "This threat actor uses four or five different cloud providers... they're kind of chaining these different cloud services together. And by doing so, they really slow down response operations... it becomes difficult for all the different providers to be aware of what the threat actor is doing."

By dispersing their operations across various platforms—from Software as a Service (SaaS) to Infrastructure as a Service (IaaS)—Sloppy Lemmings aims to remain under the radar, making it challenging for any single provider to fully trace or halt their malicious activities.

Credential Harvesting Techniques

The crux of Sloppy Lemmings' operations lies in their sophisticated credential harvesting methodologies, primarily executed through targeted phishing campaigns.

Blake Darche [04:42]: "They've been sending out an email that's been impersonating a group of IT professionals... it brings you to a credential harvesting page. They get the user to enter credentials and then they store those credentials and use those credentials later to gain access to those accounts."

These phishing emails deceive recipients into believing they are interacting with legitimate IT professionals, leading them to malicious websites where their credentials are captured. This method allows Sloppy Lemmings to harvest credentials from hundreds of users simultaneously, facilitating unauthorized access to targeted accounts.

Targeted Sectors and Geographical Focus

While initially concentrated on Pakistan, recent intelligence indicates an expansion of Sloppy Lemmings' targets to include Ukraine and other nations such as Bangladesh, Sri Lanka, Nepal, and China.

Blake Darche [05:38]: "After we published this research, we also obtained some intelligence showing they were actually targeting Ukraine as well... including Bangladesh, Sri Lanka, Nepal, China, and now Ukraine."

Their focus on government and military sectors underscores the group's intent to gather high-value intelligence, potentially influencing geopolitical dynamics.

Operational Security and Tool Sophistication

Despite their persistent threats, Sloppy Lemmings exhibit notable lapses in operational security (OPSEC), earning them their moniker.

Blake Darche [06:21]: "We did name them Sloppy Lemming because they made a lot of sloppy mistakes."

However, it's essential to recognize that their malware capabilities have been evolving, indicating a trajectory towards increased sophistication, albeit not at the forefront of advanced threat actors.

Blake Darche [11:06]: "Over time this group's malware has gotten more advanced. So they are kind of evolving and becoming more sophisticated over time."

Mitigation Strategies Employed by Cloudflare

In combating Sloppy Lemmings, Cloudflare implemented a multi-faceted mitigation approach, emphasizing collaboration across various cloud providers.

Blake Darche [07:22]: "We actually took down some of their code on our infrastructure. We reached out to four or five different cloud providers... GitHub, Dropbox, and Discord."

By coordinating with platforms like GitHub, Dropbox, and Discord, Cloudflare successfully disrupted Sloppy Lemmings' operations, increasing the cost and complexity for the threat actor to maintain their activities.

Recommendations for Organizations

Blake Darche provides actionable insights for organizations, especially those within critical infrastructure sectors, to bolster their defenses against such threats.

1. Patch Management: Ensure all systems are updated to mitigate known vulnerabilities, specifically addressing CVEs exploited by Sloppy Lemmings.

   Blake Darche [11:31]: "Patching for that vulnerability is a good way... having defense in depth on your email infrastructure."

2. Email Security: Implement robust email security solutions to detect and prevent phishing attempts from infiltrating the organization's network.

3. Understanding Threat Vectors: Organizations must comprehend their position within the threat landscape, recognizing their role in the supply chain and the potential vulnerabilities therein.

   Blake Darche [14:46]: "You have to know your threat vectors and you have to understand like where you sit in that chain."

4. Defensive Depth: Employ a layered security approach to ensure that if one defense mechanism fails, others remain to protect the organization.

Future Outlook and Predictions

Looking ahead, Cloudflare anticipates that Sloppy Lemmings will continue their current trajectory of targeting similar sectors and expanding their geographical focus.

Blake Darche [15:40]: "Here we would expect to see similar activity... especially with the unexpected targeting of Ukraine."

This expansion highlights the dynamic nature of cyber threats and the necessity for organizations to remain vigilant and adaptive in their security postures.

Closing Thoughts

The episode underscores the importance of collaborative efforts in cybersecurity, as exemplified by Cloudflare's partnership with other cloud service providers to neutralize threats. Blake Darche emphasizes the significance of threat intelligence sharing and coordinated responses to effectively counteract persistent and evolving cyber adversaries.

Blake Darche [14:00]: "We're helping to build a better Internet and better community doing the cyber defense."

As cyber threats become increasingly sophisticated and widespread, such collaborative endeavors are pivotal in safeguarding critical infrastructure and maintaining the integrity of global digital ecosystems.

For more detailed insights, listeners are encouraged to access the full research report titled "Unraveling Sloppy Lemmings Operations Across South Asia," available in the show notes.