Threat video1:00
APT29 Mongolia Watering Holes: Detection & IOCs
APT29 (Cozy Bear) hit Mongolian government sites with n-day iOS and Chrome exploits; 9 detection rules, 20 IOCs and a free Splunk SPL rule cover it.
Read the full threat intel for APT29 Mongolia Watering Holes: Detection & IOCs →
Chapters
- 0:00The hookThree exploits hit Mongolian sites.
- 0:04The storyMongolian government sites compromised.
- 0:10Attack pathGovernment devices fingerprinted and exploited.
- 0:23AttributionAttributed to APT29.
- 0:28Indicators of compromise9 indicators to hunt: 2 domains, 4 SHA-256 hashes and 1 SHA-1 hash, and more.
- 0:37MITRE ATT&CK techniques10 ATT&CK techniques, from reconnaissance to collection.
- 0:42Remediation4 steps now: Update iOS/iPadOS to 16.7 or later and Chrome on Android.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Three exploits hit Mongolian sites.
0:05Mongolian government sites compromised.
0:07Cookies and credentials stolen.
0:10Government devices fingerprinted and exploited.
0:13iOS WebKit flaw stole cookies.
0:16Android chained exploits escaped sandbox.
0:19Credentials harvested from Chrome.
0:23Attributed to APT29. Confidence: medium.
0:289 indicators to hunt: 2 domains, 4 SHA-256 hashes and 1 SHA-1 hash, and more.
0:3810 ATT&CK techniques, from reconnaissance to collection.
0:424 steps now: Update iOS/iPadOS to 16.7 or later and Chrome on Android.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.