Instructor: In this lesson,
we will learn about threat actor capabilities.
Threat actor capabilities are the skills, tools,
and expertise that attackers possess to identify
and exploit vulnerabilities in a target system.
Threat actor characteristics include capabilities
such as knowledge, vulnerability creation, exploit creation,
and supply chain access.
Threat actor knowledge encompasses an understanding
of a target's systems and defenses.
Next, vulnerability creation involves the ability
to introduce new vulnerabilities within a system.
Exploit creation, on the other hand,
refers to the development of tools or methods
to take advantage of identified vulnerabilities.
Finally, supply chain access represents
an advanced capability where attackers infiltrate
third-party vendors or service providers
to compromise the target indirectly.
Let's learn more about the threat actor capabilities
of knowledge, vulnerability creation, exploit creation,
and supply chain access.
First, we have knowledge.
Knowledge is an understanding of a target's systems,
defenses, and vulnerabilities.
Attackers gain this awareness through reconnaissance
or by obtaining insider information.
For example, a threat actor might study the architecture
of a company's network by scanning for open ports,
services and exposed endpoints.
A less sophisticated attacker might use
freely available tools to gather this information,
while a more advanced attacker could employ stealer methods
like custom-built scripts to avoid detection.
As they learn more about the target's infrastructure,
attackers build a map of potential weak points to exploit.
An attacker's knowledge development often begins
with passive reconnaissance, gathering as much information
as possible without directly interacting with the target.
The primary method here is open source intelligence,
or OSINT, where attackers leverage
publicly available resources to gather insights.
For instance, they might search for public records,
scan social media for employee information,
or review a target's website for technical details.
OSINT allows them to compile a substantial amount of data
on the target structure, technologies and personnel
from the information that already exists on the internet.
As their understanding grows, attackers shift their efforts
to active reconnaissance, which means they directly interact
with the target usually by running scans
on public interfaces to pinpoint vulnerabilities directly.
The sophistication level required for knowledge gathering
depends on the detail and stealth
the attacker wants to achieve.
A basic scan with easily accessible tools like Nmap
can reveal information quickly.
However, stealer methods require additional skills
in evasion, such as encrypting communications
or spoofing IP addresses.
Second, we have vulnerability creation.
Vulnerability creation is the capability
to introduce new weaknesses in a system,
often by tampering with software, configuring systems,
or influencing employees.
For example, an attacker might insert malicious code
into an open source project used by a target organization.
This requires a higher level of sophistication
as the attacker needs to understand both the code base
and the target's processes
to make the vulnerability appear legitimate.
Vulnerability creation can also involve physical
or social manipulation, like convincing an employee
to make a configuration change or leave a device connected
to an insecure network.
So to develop the capability for vulnerability creation,
attackers need strong technical skills in programming
and system configuration, along with a deep understanding
of the specific systems they want to target.
Skilled attackers might analyze commonly-used software
in the target organization,
searching for opportunities to add malicious code subtly.
Or attackers might exploit open source contributions,
embedding vulnerabilities in widely used libraries
that are used by the target organization.
Overall, vulnerability creation requires patience
and is often a long-term approach,
as attackers aim to introduce malicious network changes
that go unnoticed but could be exploited later.
Third, we have exploit creation.
Exploit creation is the development of tools or techniques
designed to take advantage of known
or newly discovered vulnerabilities in IT systems.
This capability is essential for sophisticated attackers,
enabling them to leverage newly-discovered
or previously unidentified weaknesses to compromise systems
to gain unauthorized access.
For example, a hacker might write code
to exploit a buffer overflow in a specific software version
used by the target organization.
Basic exploit creation can be achieved
using readily available scripts and tools,
while advanced exploits,
like those used in zero-day attacks,
require in-depth knowledge of the software
and the ability to craft payloads tailored precisely
on the vulnerability being attacked.
Developing exploit creation capabilities
demands programming skills, a solid understanding
of security vulnerabilities
and patience for extensive testing and refinement.
Skilled actors often experiment with multiple techniques,
learning to manipulate vulnerabilities
in diverse environments.
To achieve a high level of sophistication,
attackers may develop or discover zero-day exploits
for vulnerabilities that are not yet publicly disclosed
or patched, requiring sometimes months
of research and trial.
This ability is usually reserved
for well-resourced threat actors
or specialized hacking groups.
Fourth and last, we have supply chain access.
Supply chain access is an advanced threat actor capability
that targets third-party vendors or service providers
to indirectly compromise a primary target.
By exploiting a trusted vendor,
attackers can insert malware
into legitimate software updates or services,
bypassing traditional security measures,
and gaining access to their intended target.
One of the most notable examples of this type of attack
was the SolarWinds breach where attackers compromised
the Orion software platform used by numerous government
and corporate clients.
This allowed attackers to embed a back door in the software,
which was distributed through trusted software updates
and went undetected for months, giving the attackers access
to critical networks globally.
This capability is highly sophisticated
and requires extensive planning, a deep understanding
of the target's supply chain relationships,
and knowledge of vendor security practices.
In a supply chain attack, attackers carefully select vendors
with widespread access to their targets
and potentially weaker security defenses than their targets.
Attackers may use tactics like spear fishing,
social engineering, or direct exploitation
of the vendors' systems to implant malicious code
within legitimate updates.
This supply chain approach means the attack can infiltrate
multiple organizations simultaneously,
often remaining undetected until well after
the compromise has occurred, underscoring the resources
and planning involved in such an attack.
To mitigate supply chain risks,
organizations should thoroughly vet
vendor security practices,
implement strict update verification processes,
and continuously monitor for unusual activity
linked to third-party integrations.
Understanding how threat actors leverage supply chain access
helps organizations prioritize security measures
that address potential vulnerabilities
in vendor relationships, reducing the impact
of any compromised updates or services on their systems.
So remember, threat actor capabilities refer to the skills,
tools, and expertise attackers use to find
and exploit vulnerabilities in target systems.
Key capabilities include knowledge, vulnerability creation,
exploit creation, and supply chain access.
Knowledge allows attackers to gather intelligence
on a target's systems and defenses through reconnaissance.
Vulnerability creation involves introducing weaknesses
in systems often through code tampering
or social engineering.
Next, exploit creation enables attackers to develop tools
to leverage vulnerabilities, including zero-day exploits.
And finally, supply chain access allows attackers
to infiltrate a primary target
by compromising trusted third-party vendors,
requiring advanced planning and a deep understanding
of the target's IT ecosystem.