Analysis and triage of advanced hacking groups targeting western countries critical national infrastructure : APT28, RED October, and Regin

Mwiki, H; Dargahi, T; Dehghantanha, A; Choo, KKR

Abstract

Many organizations still rely on traditional methods to protect themselves against various cyber threats. This is effective when they deal with traditional threats, but it is less effective when it comes to Advanced Persistent Threat (APT) actors. APT attacks are carried by highly skilled (possibly state-sponsored) cyber criminal groups who have potentially unlimited time and resources.


This paper analyzes three specific APT groups targeting critical national infrastructure of western countries, namely: APT28, Red October, and Regin. Cyber Kill Chain (CKC) was used as the reference model to analyze these APT groups activities. We create a Defense Triage Process (DTP) as a novel combination of the Diamond Model of Intrusion Analysis, CKC, and 7D Model, to triage the attack vectors and potential targets for these three APT groups.


A comparative summary of these APT groups is presented, based on their attack impact and deployed technical mechanism. This paper also highlights the type of organization and vulnerabilities that are attractive to these APT groups and proposes mitigation actions.

Citation

Mwiki, H., Dargahi, T., Dehghantanha, A., & Choo, K. (2019). Analysis and triage of advanced hacking groups targeting western countries critical national infrastructure : APT28, RED October, and Regin. In D. Gritzalis, M. Theocharidou, & G. Stergiopoulos (Eds.), Critical Infrastructure Security and Resilience : Theories, Methods, Tools and Technologies (221-244). Springer. https://doi.org/10.1007/978-3-030-00024-0_12

• Online Publication Date: Jan 2, 2019
• Publication Date: Jan 2, 2019
• Deposit Date: May 20, 2019
• Pages: 221-244
• Series Title: Advanced Sciences and Technologies for Security Applications
• Book Title: Critical Infrastructure Security and Resilience : Theories, Methods, Tools and Technologies
• ISBN: 9783030000233;-9783030000240
• DOI: https://doi.org/10.1007/978-3-030-00024-0_12
• Publisher URL: https://doi.org/10.1007/978-3-030-00024-0_12
• Related Public URLs: https://link.springer.com/book/10.1007/978-3-030-00024-0#toc